container-selinux-2:2.119.1-1.c57a6f9.el7>t  DH`p^$ƨ ?m봐IQG'JaDryŸڬ?@F 6h nѽQIGHOOXsӲ톇ԁ0u[yhd2 +ܸiC:coNtp/JXZjdPM0:o O8*b6S^9c݇;ȀUr>΄0"Br(6ʉ/Z =տO][p/ODfLuho:?XAn<8d`fY'vd!?5\?5Ld, 0 X %+2              $ L |     ( G8 PI9tI:I>1z@1B1G1H1I1X1Y2Z2H[2P\2h]2^2b3d4e4f4l4t4u4v4w5x5(5HCcontainer-selinux2.119.11.c57a6f9.el7SELinux policies for container runtimesSELinux policy modules for use with container runtimes.^A%x86-02.bsys.centos.orgCentOSGPLv2CentOS BuildSystem Unspecifiedhttps://github.com/containers/container-selinuxlinuxnoarch# Install all modules in a single transaction if [ $1 -eq 1 ]; then /usr/sbin/setsebool -P -N virt_use_nfs=1 virt_sandbox_use_all_caps=1 fi export MODULES=""; for x in container; do MODULES+=/usr/share/selinux/packages/$x.pp.bz2; MODULES+=" "; done; /usr/sbin/semodule -n -s targeted -r container 2> /dev/null /usr/sbin/semodule -n -s targeted -d docker 2> /dev/null /usr/sbin/semodule -n -s targeted -d gear 2> /dev/null /usr/sbin/semodule -n -X 200 -s targeted -i $MODULES > /dev/null if [ $? -ne 0 ]; then echo "Error loading SELinux module." >&2 return 1 fi if /usr/sbin/selinuxenabled ; then /usr/sbin/load_policy /usr/sbin/restorecon -R /usr/bin/*podman* /usr/bin/*runc* /usr/bin/*crio /usr/bin/docker* /var/run/containerd.sock /var/run/docker.sock /var/run/docker.pid /etc/docker /etc/crio /var/log/docker /var/log/lxc /var/lock/lxc /usr/lib/systemd/system/docker.service /usr/lib/systemd/system/docker-containerd.service /usr/lib/systemd/system/docker-latest.service /usr/lib/systemd/system/docker-latest-containerd.service /etc/docker /usr/libexec/docker* &> /dev/null || : if [ $1 -eq 1 ]; then restorecon -R /var/lib/docker &> /dev/null || : restorecon -R /var/lib/containers &> /dev/null || : fi fi . /etc/selinux/config sed -e "\|container_file_t|h; \${x;s|container_file_t||;{g;t};a\\" -e "container_file_t" -e "}" -i /etc/selinux/${SELINUXTYPE}/contexts/customizable_types matchpathcon -qV /var/lib/containers || restorecon -R /var/lib/containers &> /dev/null || :if [ $1 -eq 0 ]; then /usr/sbin/semodule -n -r container docker &> /dev/null || : if /usr/sbin/selinuxenabled ; then /usr/sbin/load_policy /usr/sbin/restorecon -R /usr/bin/*podman* /usr/bin/*runc* /usr/bin/*crio /usr/bin/docker* /var/run/containerd.sock /var/run/docker.sock /var/run/docker.pid /etc/docker /etc/crio /var/log/docker /var/log/lxc /var/lock/lxc /usr/lib/systemd/system/docker.service /usr/lib/systemd/system/docker-containerd.service /usr/lib/systemd/system/docker-latest.service /usr/lib/systemd/system/docker-latest-containerd.service /etc/docker /usr/libexec/docker* &> /dev/null || : fi fi #define license tag if not already defined&IvZA큤AAA큤A큤^A%]R^A%^A%^A%]R^A%^A%093be781f9916163b4f01d3f7edd672d735d3d8347b5aa643cfa3c58057c6d5db1581d0bc0ea7dd4f3844dd771c2e1f30d62ad976626ab513efeecab4ded27c0f61b32d4ae21c94ba1a9d43ceff69a560289bddf743be374a3b1663fea9cac45rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootcontainer-selinux-2.119.1-1.c57a6f9.el7.src.rpmcontainer-selinuxdocker-engine-selinuxdocker-selinux        /bin/sh/bin/shlibselinux-utilspolicycoreutilspolicycoreutils-pythonrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)sedselinux-policyselinux-policy-baseselinux-policy-targetedrpmlib(PayloadIsXz)2.5-113.0.4-14.6.0-14.0-13.13.1-216.el73.13.1-216.el73.13.1-216.el75.2-14.11.3]]D%]'$]@\@\N\w@\4[k@[@[[@[[Xf@[L[K7@["X[@[@[[[Z@Z?ZZZ%Z%Z@Z - 2:2.119.1-2.c57a6f9Jindrich Novy - 2:2.107-3Lokesh Mandvekar - 2:2.107-2Lokesh Mandvekar - 2:2.107-1Lokesh Mandvekar - 2:2.99-1Frantisek Kluknavsky - 2:2.95-2Frantisek Kluknavsky - 2:2.84-2Frantisek Kluknavsky - 2.77-1Dan Walsh - 2.76-1Dan Walsh - 2.74-1Frantisek Kluknavsky - 2:2.73-3Frantisek Kluknavsky - 2:2.73-2Dan Walsh - 2.69-3Dan Walsh - 2.69-2Dan Walsh - 2.68-1Dan Walsh - 2.67-1Dan Walsh - 2.66-1Dan Walsh - 2.64-1Dan Walsh - 2.62-1Dan Walsh - 2.61-1Dan Walsh - 2.60-1Dan Walsh - 2.58-2Dan Walsh - 2.58-1Dan Walsh - 2.57-1Dan Walsh - 2.56-1Dan Walsh - 2.55-1Dan Walsh - 2.52-1Dan Walsh - 2.51-1Dan Walsh - 2.50-1Dan Walsh - 2.49-1Dan Walsh - 2.48-1Dan Walsh - 2.41-1Dan Walsh - 2.40-1Dan Walsh - 2.39-1Dan Walsh - 2.38-1Dan Walsh - 2.37-1Dan Walsh - 2.36-1Dan Walsh - 2.35-1Dan Walsh - 2.34-1Dan Walsh - 2.33-1Dan Walsh - 2.32-1Dan Walsh - 2.31-1Dan Walsh - 2.29-1Dan Walsh - 2.28-1Dan Walsh - 2.27-1Dan Walsh - 2.24-1Dan Walsh - 2.23-1Dan Walsh - 2.22-1Troy Dawson - 2.21-3Fedora Release Engineering - 2:2.21-2Dan Walsh - 2.21-1Dan Walsh - 2.20-2Dan Walsh - 2.20-1Lokesh Mandvekar - 2:2.19-2.1Dan Walsh - 2:2.19-1Lokesh Mandvekar - 2:2.15-1.1Dan Walsh - 2:2.10-2.1Dan Walsh - 2:2.10-1Lokesh Mandvekar - 2:2.9-4Lokesh Mandvekar - 2:2.9-3Lokesh Mandvekar - 2:2.9-2Lokesh Mandvekar - 2:2.8-2Lokesh Mandvekar - 2:2.7-1Lokesh Mandvekar - 2:2.4-2Dan Walsh - 2:2.4-1Dan Walsh - 2:2.3-1Lokesh Mandvekar - 2:2.2-4Jonathan Lebon - 2:2.2-3Lokesh Mandvekar - 2:2.2-2Lokesh Mandvekar - 2:2.2-1Lokesh Mandvekar - 2:2.0-2Lokesh Mandvekar - 2:2.0-1Lokesh Mandvekar - 2:1.12.4-29- update to 2.119.1 RHEL7 branch - Related: RHELPLAN-26239- use 2.107 in RHEL7u7 - add build.sh script- Resolves: #1626215- bump to v2.107- built commit b13d03b- rebase- rebase- backported fixes from upstream- Allow containers to use fuse file systems by default - Allow containers to sendto dgram socket of container runtimes - Needed to run container runtimes in notify socket unit files.- Allow containers to setexec themselves- tweak macro for fedora - applies to rhel8 as well- moved changelog entries: - Define spc_t as a container_domain, so that container_runtime will transition to spc_t even when setup with nosuid. - Allow container_runtimes to setattr on callers fifo_files - Fix restorecon to not error on missing directory- Make sure we pull in the latest selinux-policy- Add map support to container-selinux for RHEL 7.5 - Dontudit attempts to write to kernel_sysctl_t- Add label for /var/lib/origin - Add customizable_file_t to customizable_types- Add policy for container_logreader_t- Allow dnsmasq to dbus chat with spc_t- Allow containers to create all socket classes- Label overlay directories under /var/lib/containers/ correctly- Allow spc_t to load kernel modules from inside of container- Allow containers to list cgroup directories - Transition for unconfined_service_t to container_runtime_t when executing container_runtime_exec_t.- Run restorecon /usr/bin/podman in postinstall- Add labels to allow podman to be run from a systemd unit file- Set the version of SELinux policy required to the latest to fix build issues.- Allow container_runtime_t to transition to spc_t over unlabeled filesAllow iptables to read container state Dontaudit attempts from containers to write to /proc/self Allow spc_t to change attributes on container_runtime_t fifo files- Add better support for writing custom selinux policy for customer container domains.- Allow shell_exec_t as a container_runtime_t entrypoint- Allow bin_t as a container_runtime_t entrypoint- Add support for MLS running container runtimes - Add missing allow rules for running systemd in a container- Update policy to match master branch - Remove typebounds and replace with nnp_transition and nosuid_transition calls- Add support to nnp_transition for container domains - Eliminates need for typebounds.- Allow container_runtime_t to use user ttys - Fixes bounds check for container_t- Allow container runtimes to use interited terminals. This helps satisfy the bounds check of container_t versus container_runtime_t.- Allow container runtimes to mmap container_file_t devices - Add labeling for rhel push plugin- Allow containers to use inherited ttys - Allow ostree to handle labels under /var/lib/containers/ostree- Allow containers to relabelto/from all file types to container_file_t- Allow container to map chr_files labeled container_file_t- Dontaudit container processes getattr on kernel file systems- Allow containers to read /etc/resolv.conf and /etc/hosts if volume - mounted into container.- Make sure users creating content in /var/lib with right labels- Allow the container runtime to dbus chat with dnsmasq - add dontaudit rules for container trying to write to /proc- Add support for lxcd - Add support for labeling of tmpfs storage created within a container.- Allow a container to umount a container_file_t filesystem- Allow container runtimes to work with the netfilter sockets - Allow container_file_t to be an entrypoint for VM's - Allow spc_t domains to transition to svirt_t- Make sure container_runtime_t has all access of container_t- Allow container runtimes to create sockets in tmp dirs- Add additonal support for crio labeling.- Fixup spec file conditionals- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild- Allow containers to execmod on container_share_t files.- Relabel runc and crio executables- Allow container processes to getsession- update release tag to isolate from 7.3- Fix mcs transition problem on stdin/stdout/stderr - Add labels for CRI-O - Allow containers to use tunnel sockets- Resolves: #1451289 - rebase to v2.15 - built @origin/RHEL-1.12 commit 583ca40- Make sure we have a late enough version of policycoreutils- Update to the latest container-selinux patch from upstream - Label files under /usr/libexec/lxc as container_runtime_exec_t - Give container_t access to XFRM sockets - Allow spc_t to dbus chat with init system - Allow containers to read cgroup configuration mounted into a container- Resolves: #1425574 - built commit 79a6d70- Resolves: #1420591 - built @origin/RHEL-1.12 commit 8f876c4- built @origin/RHEL-1.12 commit 33cb78b-- built origin/RHEL-1.12 commit 21dd37b- correct version-release in changelog entries- Add typebounds statement for container_t from container_runtime_t - We should only label runc not runc*- Fix labeling on /usr/bin/runc.* - Add sandbox_net_domain access to container.te - Remove containers ability to look at /etc content- use upstream's RHEL-1.12 branch, commit 56c32da for CentOS 7- properly disable docker module in %post- depend on selinux-policy-targeted - relabel docker-latest* files as well- bump to v2.2 - additional labeling for ocid- install policy at level 200 - From: Dan Walsh - Resolves: #1406517 - bump to v2.0 (first upload to Fedora as a standalone package) - include projectatomic/RHEL-1.12 branch commit for building on centos/rhel- new package (separated from docker)/bin/sh/bin/shcontainer-selinuxdocker-selinux2:2.119.1-1.c57a6f9.el72:2.119.1-1.c57a6f9.el72:2.119.1-1.c57a6f9.el7 2:1.12.5-142:1.12.4-28container-selinux-2.119.1README.mddevelincludeservicescontainer.ifpackagescontainer.pp.bz2/usr/share/doc//usr/share/doc/container-selinux-2.119.1//usr/share/selinux//usr/share/selinux/devel//usr/share/selinux/devel/include//usr/share/selinux/devel/include/services//usr/share/selinux/packages/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m32 -march=x86-64 -mtune=generic -mfpmath=sse -fasynchronous-unwind-tablescpioxz2noarch-redhat-linux-gnudirectoryASCII text?7zXZ !#,_] b2u jӫ`(}_ﰎBy4Q [;]QB:xHWF79lJ+[yq^WFiHf"c|Jg̓\ދ">PڠR\H`/E7혥L(8Ҕp9zu @(8^ߥ*wF6§ZzD&&jFα6{1wO$Br_֔^-w.xo<|6-?+OļTßu( ]ON-m?pqsUqqtŢZ]|Бi dQNl>+Q4ʠz,IOP"V0kcj|ceVИn-HMDANZ#יpk]AUp|+DlyoDtY|s LyTCFQ_uyk-~RH>$,*O&3D] {Wl,!6u.  *'taڎ!Z[ 뻡@-~.):J0G&0/^,m O64 CtM"VU] xC ˝^!hTh_LhYF]0-)M͂/%LTN"kWO<3l ||w: AcE[L`c\[{CL#0l9bR) @6IotӗqSw5h}| >d7wt>N3S'lr\ !' !E,.$o8j+]ą q]&~<.k;)1nG@R(1BSeʷJj=ObɱX+[v?4OA*fK, :|ss۳=4P]՞9T5fQQ,klo(zĵVw+%(v&BTۜPoozťeZ Bhj6g +PkO+_`u>}RRL }j5XBKm/=*AcLʷyEr0URj!rCO6H{t1ߊHqê~+&g~Er~q '63Ni!fOF٥I $1VI& sE¸Τ`3nW7 ZK A#f3(H}\lٴ_㈕N(LI f]Է4B',&U9)cvuӫ8 <C{8dQD#mC`ǵq 1O}GpfqѯOZ cCHj/bY`pN 4鎇<("# ٚNJY鸑&/ @-f9 {1k!֞hPHzCdͪڃH%`<0%h~,Tӂs~ 3,dOIETGS0 %_Ec\iAʶY2[r:Zu{ |%cN+ݳe.U-B!IG٩8A\@Β$yuBˇ 6dɂQ:O@(wo`cҶZVuVD`Aq^k|\^8T}OQa>0Ȗ et5V*Kޘ?n cq] 8dkI\vyyd$ϔ9ř_Arg: Db T{9;O`rA5EFzXF.Vl|GG#;Wm0`s6,c|5 RS9)g|!TG ۮ;țбj(ӓPq֢BW>HjŏF[H *?a N _C']c73'VD8:@p <_CoZ<"vxj YN*p4X.ن}>6Jլ u%uRp#; [ĞfoNC'~UYn N {|*#60]`BfXESj! OD% A-Jh4S5&Bx6%ݙBoB!G^ a'|1mVM7h4ey>bVho;/jV5cC9aCzvv,Fvh[ )TɉՀ]Ϯ0]C ;=Q+Z΋U]> $n~޼( r/SR -CO"<Ȇ ,bI0pB{}.V_{]Nm<{yn@@=3nw.gmHʃo=U@Vb$Vc;wZM3. P&ue$71󀃃sOQSo$~_>"V_:KhpȠiK;w}t(?Z9@F }n2ȣ1Wmκ T}5C:PJҶԣ b_rJKoYow]1:k7-UWFmG k jjȺ3u.΋C$fA/Y4bvުuo+Qt/1 ӗ$Y[,zA8rg̉vfں.)wReGB>c1܎|#xcx&〶ݿӣ9uz }>4e2#oгYXG.)HIcL 8^NaL|HD{}r4mbg[9<^nrG]j*~;^ɃM!qa'hgZGvv"Qf{;yx\+c5 Du*)-\gjR+bɩנ n^C^C;f^s&!r[Ŀy:/ A gk5,n j/ 2JHeW٢+(b8,/f}v~]*5,^Eyox}FX'jWUkr5kY5= {ݼ˪rf-* $';JꠟjZaShI]]aPeڳ_:{w*uwI1!$峿!xM2aӫu$ UFaE{b!B$@2 n‚5Ccf86A_04"I]>[)P4'(p3 6k4- km > [nl}],QPtrD. կIx7jlA&x޽K@9D<[hr #{PABoUVVO3eGOdj+WfDH|OVu"_C{`3͙Zp_:Q3I%TNFk ϢnX _JP2)B#l`ή[NLvfC ݤ5Q_/0QLe*3*2+!!ޟPAqrM'? G8bKuAݻA:va)wF>Q|51Me {9?{FtP::BܮA8I`-4+ 0TT><9Mn ~0[kR2s= ߑSؗpd, ͔k*0llh+!.`l ^FP<{!o'zAaCHܧvTʘ*#*p;s w3 ?\` lmZ(MO BPiQ I$,ƉvS:uMu NH4 plנ#|I8]7YB"pߌVY*xp4tRuR]p c0l3S7j$ku띈^##GN9w:-}*T"ɘSkH4=OM5`Yڣ(dG})CKp4cBF$\bp֤r. Tj\]s Kfλ?/=|Za|w#"ƛ)Hm>7-ƴuk]<麷2C-|CMR|wV%!Sc*\L??5Ċҷ} ,8H(^=ݝ~$$U ٟ C 1ݢqm!-$}:( Hn.c.uR֗U8V g)F̝>`c)VmGMY~EykQ/0Ca lҸ,&H -|Iu Iw`GOQp vR&fD0ۿ%&Ze-S`K -^kvAR_%Fkq{$Dž9E9I8h%k7"0s̺=@կ O-D#{U+`(;9x/i˯*FV^kZt8.21BY>匐IYΐF-5iҶ2^QyY5Fa:!w~wKT&n}Dړ!|rQ!}Q's9(IF9Tɇ(ndeЁe0k÷%r%1r%1!}`q瘞da1#'PRcC& DVwyW=!xRу8eJEo1WIɲ:\ICn>k*˨%L+,W@<6'2ƘF]I@"JQGѽ. D2آ.5M'.WY\OnKCN") ! E] "Y}%Y1+4bW4{hR oeGGTLU-5NS.w&}t,(MF|q9L w\yJ-)N ߡCЉNH%laHҷ33B ݷ$ïu_ervkWAUw5NV P W{ NDbBҙrr8%Z8z^y>R4$tdm0ڮj+$tٹ@@ىҩW<B-oqT$ &_>Jj"9ϨvV' ƪ>"GwPxh!MGqѶ2zqrEJԢRßdlDKיwl~HAq;wΒ>twiij_ 5լI.;WCMq3edV, Jd=Hnb* /bӃ8R ) tI=eE4S֢ _9+c)m dz9J$N b&6vf!f7E) 68 a0Y-SwgPR@OD}72<`,0XX}xv9覤j]ԂAx0 _M2kw\?Q8Ҡ`D c]O׋'CfOj0L~; Ojl{Sr;ovmzX2~P ==+)z%2x͍t(> _GM,Kץ߁~ M<<h *R:>kBتCM@=G)@#?%c \`u 7\[zh /uȴxFz_DcӍXD}HEvkt¤e]ZX/}H_0wTzSl.jzmyfѱ 4ckGB.ކ%&N6%Gjg3Ld+?͂{D SAʤd}^AЈ54h(-#gP.GdGLic :GvujWpiOn"P2 ئrq1/X'f-LRQRp] ~:wRo2~q/a^ Wlq$z;Zv6'3m h08DMuZ+L99UB=gczð;if 9 :TK7|>3D@l:7"/]@ܤTaPE)%=ի-?së\)"Ed0+)"c0&׋ꦊ?kyҧe2H@Ө?C(NhӽO+FxR)EMf\ٛS)ꝞqJ{rh,_X5ع( ' E1*[Sv# d y-&)b1iOQuY   Phkx_9s W U5'=ُ+9*"u\'g|}`9*^gl4V3βv],20<㧟jǺw4#1<Ӟށ = ->6!$%JcYb'0a?ڔ+OHce38gDl5$jPxx}P ;ܚ~}X 1 Qx]v2򒙅 *d @=u;^͞U;FӸ(8, ";ù깷Ufh=Y8%a w0Y]OI[eț9o*~Ԏ̹*17%VVpaq 'iV=۝<1sL\3f7n|dOܔҦ/rR0QhY fV.Ԫ'\ )dXH"E|iFn/[vY#4Hw4" ͚E,(UiK|F<}fׂ-(1᭼%q׏2뭇?TSP2K]w([Qg_)[ :MBIg tIo豼>YŸAβaƠi}\ᜇОnQFPx=,ShJ v 0y uY`7m\Qim5JqNގA tޣU ڡYK7y*jztࠏ*.sN*[TR !q@~ TaV_h kzd0^}Buc›@{Dž@U!y)WӺTEr=ݒF&hAYF8j'o5i/8Y/Dn^}4,/Ja/1mzQi2*SDZ.X M_i'0/՟ClC $7ZOK!7Y e.Dz6"7JhHӏjhA:O78Wj2G.Nxm~4'wJkyCsXree9p@A? NK?@Ze9-TAO$g5Pyu&H = [Ef>~GnJ)` o\_B'@Cg<P1=m7GSSoGE^/苿OPcnj銶8nOщ=7솵fzۥ JcITSjMv^`/C=%P:Tp%1ݰ,EzeyncV(u`;۫NY\GY`p HܢD)LSKmv82N`:v+Ps bjк 4یy=i|\;$͡B$&Jv>['5 s)g849LC{O̡/V{aWi!J[,.&#Ɔ鄄5VM(Ck`i~$Z;ҍ x^&mҰ/bTlF̈́{{qhyVe CԳ6}4Ϯ=B7,iU{RoSWuD/ ZԀ}_yy)szR=kϬykfgV&u݅5ГRAk'ȒńdTŸV]NOc>u.L6kޝ!A7%$5V}vuÏ|Kƞ=yE[gBӄ|q:$J'3EzP\$7Tf/n#bwXUBgz$k8^Rhn[+nN[LsG)*IL8pv@ bu0fYA2{6;SS\vpCJ +f}pFʖٴTšmWt2blO&h>5e&״xǨM[ i C>]g4ሖjI dcfPp2=HYt9+V:o;2C P!o* hslU37[@BgSF&,T9k=бlxPFԛ]2]6$sGԹV=ΤZׯSQwr%6Z,K)mj4 X:(Q1F\3g)]- @VVX6I~l/.4.`Ȩ2.;9hRQ;be,jVӴHzg% ME7\L99PRcΦb)RQS֡(leKOT!?yupD]l|H pou,%52 qTe7[X¼G0т sgJB\QkSsK۾\xqۢbϬ`IHoQ *5kq4 Lv22*-Y7 t)81a}[/2;VAuvH@nsS@B{lNYT}m2/qB:ζcwi1|)KicwwB7m_ۤ\7ή*0"aifm5~8.eށ&{eLef4BLп=0 e$i<4nԑ/%_AlTNBux]C. HCV+EEepkDV!9*ˍNLTᅕvј2.J)Jy͔d+K* o+lԵK ;xǦ}>]z$ XxdĶ;=ccQ Da%?Ak%\; LIrupζJV3ގ\饛K%Ys8 ^d,$whvJ;q׺ӶdKʖVkځoqo,|KPф!(ǘF%/&\hSs澑5"R|XjyX mz^1fw y_oТa<p| M|~`DO\Js4[=0dqH۽S:xJjǠeh lr%#ץoew*7F%k%fIL.-ةɨ"S(1]a rRɼn&bjS"-Ļ5ܶ6 $ @ ǣxL"eӾI*5D-#ˑ^!Q:2y!!oaT?fjtz$BcA4R?A0 T aOBݹLEjs-BjyTW0+dz&GBgˌ ]ٱqg]@io=KkB Y@O-X{g̾w9Z ͑eV=rJ$[;<Ãn6tة]e'X@b m_~VY9P#\ic("ǎ !,$ 1 ~LҶ$X$&zٲxlX5-6AhWWn}_d5fdDOV(V6u9x##v 8/\d_fU7i#6kI!Y9u->cJ3b(Ea`swsy{7r\*F w+`HsCEjѩIvid<-sW3>:_,) 1[π=> 1bh ~{giuEJ,u7F64q7#jjm\+!>h$)9X"\)Xr[:z=u:EȺ;Vvwۖa3l &bzs`x5XH|mu'%}!] 4fVcI~t(q$k߈(`yajc"v;l.o: nq]+#CJBb@Q ,[JM@uїȉM2}aХG=UgUFo*B Jx(/-Zz~`1Գ|C/APcoie%LT̹Zs[d r#ZrI+oSMeJyWOE?yFCØD_g8Geﰴ) Q]a](@"u.iYd+tM:|F-liA:O|.'Vڦ[r:2ona.$;^pl&tj{vV33{yEFJr?M@d6n*HNUZxƳٺ2MzzɸNb*U[0UqjJ[8Y$,QyH,|S\wVj6uoXuEͷD qyC9 udu#k9dK]F0iu -`R`@(0W?6jp-l߲D~-5?0 l6)M3w2J|'$+d $, [ƘVM]n{LV:f#[9V(:QDU8Г(jlØW8Jݭ*ZCOx' >R51$?y_+n^* ^YwNKدY1=#⢰rtdR1~ڧ rkm$jCbMdxlML9iIѽCT-. 0oCٚ8Bjjr4;;ΆnkƆyMѰ'x}NN2 7eKqnbRq4I72/TOһ3/A!Vˌx5{jf.F@/UGUHEןH'O(Qݲ0Yà>[^=}+7{R'#Ln*/֋/EnНWTWp'dMߪp3iEF@?ȤqF0jh/] o]ְ5$kvT, ''vߕcYV6:RDq4Eq#e݌x!O*@ ީK)2#/8oO.)JiAL ˻"VO3~eS!`픆]c~2z5_U6ߦ4ဃ'o>*H_7[4/ +6h){=W~Iri Y gc]Wy3.o VLiyiNQ-1` \JWvx&CU[8[bB’uL+҅ ^dhI|s#Λuc#.:j>zb\̬C~UGkWw~U)m_?a|PĦ_= #NfƵdRgUZR#ZPA"*M[5tO YA | 27*;i@u߁{`5r_tL!pW}TJVXn)|+ ߁ՏP ) a{ǁ{i_|r<_9(W%jS62`ښ)>H@%7Q72L_4ULRE-WUx$%OX1'Y@g&2. }/N\ όP'!, QuW;q0f_(}ZؘdQљl@rT[_ ~ uJ#kpSuDw%q}-XAv*VP=+(lM>>\V ZᵤӸa$!q{ݣȽAQSHk方pkU'WǠBӸcDi1VKJ}k¬94-G5ntF˧HSL In4߉MCѬ W T{w&91I IX4bH`|X:PM3v]|-Ij[BC4VD7} 74o;_ߔrƢRx*}pW#+kFO߂ aNqh.w.I+!6^&(<`xIvK!cM+!A&A;%o}xk9D}i& 2&y{)s3ƞpapR:ZFºPSsD*@Ǚ}^9)N#?jC<2(2ͱ(Hv%M ݨڛ"1{o5^HSؤ>jڎhO|eY h ė;R0}L OR_/˪\,$;"ė8`aD!ɇKq_y)7^ 7S]veԮs;օ//(s"04WM%_X)mc`%Œ=>ؕ &䪆ԣvی9HJq/'S=?]*>kR$-5̇oFA|UMשׂ3Q%ŵxLWfv@wi hQ5~]9]-aX%> ɰ!8.HZ?Zk(E ~\w6;uqTL +zQz|D(G?N7p|S6wA c**`875"۳d=C'M=w1X}tn,,uʥj %*MrhzjAбjNIRɁcKUuKdN3OY*LѲ8e"Ӽ +61-6;U j~&=~v5'MH?\%U6/`a#0[Sm 9S3?dy$c硄4BI9wc-O&^ P_L $TM ljPˊ1=`<+/^T4JN|i觾&+iL6v{@cõGS*(\TAUYѻόVڴSXy::"$g<}vM)3+ʕ}^;_9$-$[#t 7}m48=cX  4`<+ZE=ȳ+YfI~hO bm~E7FU.L&Lœ)/WpXUf,K=}4-Y*spuI0K\Q9FܽgѶ _qh ޕύ|V,RX7J *"W4FJXg}{Q4 ZP\4*ꊂd@i?#`ƹ LmkL4!wMHpRh|v=J*Ċ^ Hz b2X'.Z9IXw˷&.ueNIFsT%z5LhCK(X[oM쓁I|ۭm70-W'b(*~ک =5)A%* k *t&JcgB CʱduI 6+=zwU1oC.LovF5p`{|zuJhHnL{:R5)ϰ!'<s\*fX~j0ct*w $9zjK N٧d[:F 춃R#y!a;>L\lO,Db׸AQ2lk|a"#b3fdZɥ[ & CS1;۪x2\Ϊ67$QJWoQI@ 3rvI9kxfi uY$eI QvnMFɓ+ykGM t꠽?!csD$z߅0 m` Ϩ;5N8zP YDkmʷ Ubi0n%6DRq LXؚZGZ:&NBe o*sZCѶX .q{4>0&і|+"18j1"RP)mEMPZXl_ 2!p&^Njֵ6#.3}'&j`3"/i`\zd=]c K!`Of^Y%ST=iT権ʼnאIgy2] TW6@|%[ZTRF`E`N\$#)դH-S1kV 1[>.FίAuk&&D Ȅ2QF!0cj@ӶԕO8 jsY#SA14_+hLL#$F\husEVx2nDqsl8t%:]ĵVAӯwb3ݬpJAy#Sdŋ/XjVZcydZiSٙ5hSY]dD{pfCjrB7paD2N-pX< w<j`*?.{&C Ѷx1hs8v2GxMՎ~QkyMY:>wׂҌ0 p\" Q>b]" ):ֿRBGы+l>ik)Ncyƀ1KRޝToؤJPT v 7mDH@O}drt`6!1SYg -}\|u`91CM=m>e]1aI5][H p6VNC3tچRcnޛW `͝K^ cRna[# SX*% (.ɕL /=*ڷ.\mS9?]cB91jyaAlυ_j* !ԣ. g`۶{MSKߐLnX+`ۏ=i9r$t ԝ շ1ː• [2bxW&X[y\yLD82&O=k̗%6S$NbDogT\HH=!15]?FH'8#&lWv_tUwo^VSs1~m)F#da˂Q2Ϲ(̣V>VցT.4ec)0{@eopa|qvvĊQTb8?q>7 ݂g\ +؃8̃ax/:>{58t\4C(&u%z#ȣyB'<}(swuvt3)?R 9_Kkk.iW[:ǫTH JP><,|Ȧ0Af`0(Y-~D^[oՕ >S[]?JyfI%D=g;6Sh7!76ϫX4:9~A[2Z+mH2 ? 0JBFRm^BԊݠ!CICO&*ӃAWt?{~_78+q̂>a<&`|ف^si=M8eK[cUcj@v(VcomY9?WUI_AE1, CzI:?o+̀[o~>|0WaqՂRФD Asd9+`OO^CiFR!2 /ؖYd`CC~~4jyP!ɁefuV4§//8vL{. `*}jb:څuU=Z Ei ؎ek9V I}I PZ"b>8~?iu;bͶ \2c87\),? #%-4ex/:#o ܳP3[H*0UĺMQR#^X%kuǗнXP8oO֭Ǻ!nlCceu˳ߣȎMoTNTJ#H@<gtrNMv"m$eAA8DZXhkG7wo  ~l!Ｐ&dzLjwFF.>qortzp70X,^4fSBIcm!A!S%=LDe K_9BǪFR??oq' ~ NPUp?"d YTU(zP|.D_Wb:1+ 3 572-OmD3u|VVټDO==sxbgtqk=g:qq\1G0!˄\"b.Vtwd1R4tN0)N(^5^-#3