selinux-policy-mls-3.13.1-166.el7$>N,Aҕf 3N0 `<^!>B?d $ <hl  U4U #U ,U =U qU U(LU=USSUee\effff(f8f999:T9=>BGUH),UI:UX>Y>Z?[?\?U]PpU^mGbdefltUu,Uv wUxhUyCselinux-policy-mls3.13.1166.el7SELinux mls base policySELinux Reference policy mls base module.Y-c1bm.rdu2.centos.orgv0CentOSGPLv2+CentOS BuildSystem System Environment/Basehttp://oss.tresys.com/repos/refpolicy/linuxnoarch if [ $1 -ne 1 ] && [ -s /etc/selinux/config ]; then . /etc/selinux/config; FILE_CONTEXT=/etc/selinux/mls/contexts/files/file_contexts; if [ "${SELINUXTYPE}" = mls -a -f ${FILE_CONTEXT} ]; then [ -f ${FILE_CONTEXT}.pre ] || cp -f ${FILE_CONTEXT} ${FILE_CONTEXT}.pre; fi; touch /etc/selinux/mls/.rebuild; if [ -e /etc/selinux/mls/.policy.sha512 ]; then POLICY_FILE=`ls /etc/selinux/mls/policy/policy.* | sort | head -1` sha512=`sha512sum $POLICY_FILE | cut -d ' ' -f 1`; checksha512=`cat /etc/selinux/mls/.policy.sha512`; if [ "$sha512" == "$checksha512" ] ; then rm /etc/selinux/mls/.rebuild; fi; fi; fi;if [ -e /etc/selinux/mls/modules/active/base.pp ]; then DONT_REBUILD=1 /usr/libexec/selinux/selinux-policy-migrate-local-changes.sh mls touch /etc/selinux/mls/.rebuild systemctl daemon-reexec fi . /etc/selinux/config; #TODO: (cd /etc/selinux/mls/modules/active/modules; rm -f vbetool.pp l2tpd.pp shutdown.pp amavis.pp clamav.pp gnomeclock.pp nsplugin.pp matahari.pp xfs.pp kudzu.pp kerneloops.pp execmem.pp openoffice.pp ada.pp tzdata.pp hal.pp hotplug.pp howl.pp java.pp mono.pp moilscanner.pp gamin.pp audio_entropy.pp audioentropy.pp iscsid.pp polkit_auth.pp polkit.pp rtkit_daemon.pp ModemManager.pp telepathysofiasip.pp ethereal.pp passanger.pp qemu.pp qpidd.pp pyzor.pp razor.pp pki-selinux.pp phpfpm.pp consoletype.pp ctdbd.pp fcoemon.pp isnsd.pp rgmanager.pp corosync.pp aisexec.pp pacemaker.pp pkcsslotd.pp smstools.pp ) if [ -e /etc/selinux/mls/.rebuild ]; then rm /etc/selinux/mls/.rebuild; /usr/sbin/semodule -B -n -s mls; fi; [ "${SELINUXTYPE}" == "mls" ] && selinuxenabled && load_policy; if [ $1 -eq 1 ]; then /sbin/restorecon -R /root /var/log /etc/passwd* /etc/group* /etc/*shadow* 2> /dev/null; else . /etc/selinux/config; FILE_CONTEXT=/etc/selinux/mls/contexts/files/file_contexts; /usr/sbin/selinuxenabled; if [ $? = 0 -a "${SELINUXTYPE}" = mls -a -f ${FILE_CONTEXT}.pre ]; then /sbin/fixfiles -C ${FILE_CONTEXT}.pre restore 2> /dev/null; rm -f ${FILE_CONTEXT}.pre; fi; if /sbin/restorecon -e /run/media -R /root /var/log /etc/passwd* /etc/group* /etc/*shadow* 2> /dev/null;then continue; fi; fi; 6- )#)") y*)!)#a) ?())h-){/)8bb)[-) /j)()#$)4)2?) )`)7%>)&"))0)B%)1p);/X)/))%") "0)!)$|)%)!x)y!m)*2=)")b")P2c)%)3#@)!) )X!) ()2!5) ))#6)}!u)&K=)@g) +) ' ) ()#)-) )2n) @(y)=)&)E!)w!^)?) \')%)J5h)2"E)9/ ) g'Y) )g)N$o) ')%H)-?)")22)7)0)#%s) ') !) x() q,)4:)p")#)%)3[)%%)2)Gz)%)<) -) &[)!3)%P) h() .)x%)1)$)@!)"\) Y()3D)W$) F),1e)b)Y")=)*3) *)w-)w:%) *)!)"H) ) &)m )"a)>3)E%r);) F) >,)o&)4)>j)1)!B) ) (<)) )-)96) ,Z) I))!N)&#) ') &)X$)!)V7) >&v)#)O$)&K)"bC) )1)$)$)0)$%)F$]) )AP);$)$)0)/().)D#I) u()>")#?)|z)})2@)>-)&u)%) +)"C) +)/ )^$p) S+)%YJm) ')J8%)/)$) 0a)e%s)!,B) H,) C()g )")-P:)w$) ,)6"-)+9)$F)4)!) 7*)K )8$)O!d) '() b)$)%)s32)#)x8)0)$L0)X/$)S@)&T)-$?)m$)w)%){9)")#ED)!m) ))/p) 1&)&$)f") ()8$)#)K-]) (\)!G)"$)&))Cz)5&/)w)V;)7$A)S>)%) ()GVq);)N%)g#),) y'o) )4) ))& )U1x)+@T)Fax)1) y&),8Ue ?r6V)/F+M!w59\3F h,8\U0 _fYPHA큤AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA큤A큤A큤AA큤A큤YiYiYiYiYhYhYMYTYZYZYMYMYZYZYNYMYZYZYNYNYZYZYNYNYZYZYOYNYZYZYOYOYZYZYOYOYZYZYPYOYZYZYPYPYZY[YPYPY[Y[YQYQY[Y[YRYQY[Y[YRYRY[Y[YSYRY[Y[YSYSY[Y[YTYSY[Y[YTYTY[Y[YUYUY[Y[YVYUY[Y[YMYMY[Y[YVYVY[Y[YWYWY[Y[YXYWY[Y[YYYXY\Y\YYYYY\Y\YZYZY\Y\Y[YZY\Y\Y\Y[Y\Y\Y]Y\Y\Y\Y^Y]Y\Y\Y^Y^Y\Y\Y_Y_Y\Y\Y`Y`Y\Y\YaY`Y\Y\YbYaY\Y\YcYbY\Y\YdYcY\Y\YeYdY\Y\YfYeY\Y\YgYfY\Y\YhYgY\Y\YiYhY\Y\YjYiY\Y\YkYjY\Y\YlYkY\Y\YmYlY\Y\YnYmY\Y\YoYoY\Y\YqYpY\Y\YrYqY\Y\YsYrY\Y\YtYsY\Y\YuYuY\Y\YwYvY\Y\YxYwY\Y\YyYyY\Y\Y{YzY\Y\Y|Y{Y\Y\Y~Y}Y\Y\YY~Y\Y\YYY\Y\YYY\Y\YYY\Y\YYY\Y\YYY\Y\YYY\Y\YYY\Y\YYY\Y\YYY\Y\YYY\Y\YYY\Y\YYY\Y\YYY\Y\YYY\Y\YYY\Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY]Y]YYY^Y^YYY^Y^YYY^Y^YYY^Y^YYY^Y^YYY^Y^YYY^Y^YYY^Y^YYY^Y^YYY^Y^YYY^Y^YYY^Y^YYY^Y^Y YY^Y^Y Y Y^Y^YY Y^Y^YYY^Y^YYY^Y^YYY^Y^YYY^Y^YYY^Y^Y YY^Y^Y#Y!Y^Y^Y&Y$Y^Y^Y)Y'Y^Y^Y-Y*Y^Y^Y0Y.Y^Y^Y3Y1Y^Y^Y6Y4Y^Y^Y9Y7Y^Y^YY;Y`Y`YCY@Y`Y`YHYEY`Y`YLYIY`Y`YQYNY`Y`YVYSY`Y`Y[YWY`Y`Y`Y\Y`Y`YdYaY`YaYjYfYaYaYoYkYaYaYtYqYaYaYyYvYaYaY~Y{YaYaYYYaYaYYYaYaYYYaYaYYYaYaYYYaYaYYYaYaYYYaYaYYYaYaYYYaYaYYYaYaYYYaYaYYYaYaYYYaYaYYYaYaYYYaYaYYYaYaYYYaYaYYYaYaYYYaYaYYYbYbYYYbYbYYYbYbYYYbYbYYYbYbY YYbYbYY YbYbYYYbYbYYYbYbY!YYbYbY'Y#YbYbY-Y)YbYbY3Y/YbYbY9Y5YbYbY?Y;YbYbYEYAYbYbYLYGYbYbYRYNYbYbYXYTYMYiY%YhY%YhY%YiYiYiYLYLYLYLYiYiYiYiYiYiYiYiYiYLYLYLYLYiYLYLYLYLYLYLYLYLYLYLYLYLYLYLYiYiYiYMYMYiYiYiYcIYcIYiYiYiYiYic3fe5270d84991c6d8419e9a89841027872506c19b2fb5f0424ed41d8a745063255cbe0ae3ec01b56845b0d03a121e2f2eef1815b019731507a6f19fa140f14807a90c79be1c23dcbb5fdcfc6f9920a5fac211b9540e6bc8fac9487700fa5ca99097fb3b701c6e66b7d09c928801becede437e935dbbdaed1ee14b9ccc47d7ce62b9db4f8800d4e51b561ad20e676097a274f12b2681c83d0c2957508d849f8f8801acc8a66be1a05b0541d471d44ec08d564d7b5680b44d4a682ab9d0696236d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eb09b762dbad2f1be14f65ba8f76a520f46e7f0fabf93b2d71a301a46936847e177a80434fec52b84be663d8e873852afce8d5cf48ad1d32a1cfbdbb1b059592cd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eff3c77bab3deb3a58edbe7d9807b57fa56939e7f5dc9d7fb43727d1a621048040d3e3676dbca6a3f789aaba2fcd7fcd3f48b0289f4aa34aaeb672bf79be13dd6d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e22e210a44bca4511ee24f7261938b6d81505cb24c5c384249850532fe47e5c2df17a12e29e419aa7bfb96643c533eea4b8264b584d1f5acc0155308cd9e0c02cd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e28f182709abd41ef0916287b867c5f4eec193a97616d0f0f9ed20d8386d444d93f1be75c13b43b3322de24bcc5faa88c3171f8005ff41b553b0be93d1683a7ccd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eb256eab4415af9dc1b88a996987bbb03bbc5805738524168e0240b3e15d58d308f3ac8eebb36d6ef5aa62504f45c2785f9755cd83ea6bec70c414c2f9b0d9e4ed53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eea78809195da4edbf021b91a2b3b2cc0c7b46668e56cf74e67c717245608444daec9842b962028064d7786a6777ac0a2fc1976b1a6aa51b386f37fb46c40397fd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e3f95ba9c9f2c3638c392f58f747f7d428b544d6acd0a15d5ecc46f4e90f2d60dacf3bb9a033223f8b6b7af3b205f44d1e7f26b79f07532f1808630534e300b84d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ec2c4e0e3457d4612812785621b52643b5de585e9338d41f92f40e5819d59d0e53aca0a53ff4ee54a805d1d297aac118b8e4c6a4d02186b74b77d95359b5276a6d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e8baa04524e76838bb633ae8b8bd6115bd5d97e2cf59568613d5794a790faeb63820cf20529f936f4bdf0b99544673533b350fea0c91fc7a499936bec38b8cf1ad53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e1762f192761ec4d28e9ac26282278bde65b06c4cd1557c432e3421a4da0a149240d081f790e6b6d2e31717ab4014f2e747dc858548f0f3d616050cbe38a51720d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34efb29d02af953b98d57f803f54a07604877f72c31cfee62080dc20cdf3470c7d9800f27139f2fcb0dfc04a81c5e669a5159aba85a55a3df46d9908058352cda19d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ec484dda3e23c8013c01e5730e940248efa9b0a6ca22370bec7fd3d8c3cd3668ecf2c57149433ac7243d341d5a2bff910d3c72ca212260348a5d585a83d3d509bd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eeff95ba93dbd6713201bd50f47939c0725cdef09a116637e8f4ce3ec388ff7c66591425fc19028b00ae16594593a45bc8cdbb68fa7a3f66633f8e796d30ef05bd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e518f9d9c5d594d124ca11cfc611908cd4f02d8abc879042c8e518558aea7f23a25a63c0a0a0d98173d276db8aa5fcf618fcab4a2571774d2346f12df40466e57d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ec2615b7b3e771abaa164dc40c9cc1159d6e2451f86a2102b9db344e43749626934344e154e5f8d703764a1b286fdf9f0bfba0a5fe8effff622ba43ed9fe3ae03d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e9f4f3ff41c6060368ebc9962670e08fc4bdedd40140c6fafa3587f61c0abc093ac9bfc1e2491d9f168534a97ab6578ba1e79df7514d8309b82039250314237efd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e34a7449594abdb34420b90f9512493deb71d50f13c42a3d4c1cd7e29ac0c0db58264b79e0eb2d0d24ba01394f932fec54ffda0222e049019af52fd9886e6d9bfd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e23bfe2a68caa35847123592ff78cb89f36263559396276ef149d3b350dd16ff8a2b13a092ce590c1d03f4394cb04e34c2dbaae2455e00a5d045c4cc4d7dc5248d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e4868ca89cb79f5f431bc27d634a609f2ab30883682a9fa22b817424fe36cb986fbc4d299a41102d7f491cee9ef5c0e10955f60b4bc9959013d8256ef6a6e02ddd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e1d64da4ac73bf62ecfc50c9393c68aab065c816f2014ea903f5b8b8ddf8613d4f7b2c2a3e64e9b1fe7738a1898aaadee1f7c0d99a138400c37ee7e6742cb5129d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eddf316cec39e430b5bca3a0219a692ba1dadb1badd90a4395c3321204d728d4ec9129275ce13e9696ed2af8a6e832fe5d12c8cbdaa1ccfb5b6c127d0bfdf9547d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e536dad6c09156a00060545fb2f5b0e5a0a24ff85d161ec0eae97fb60892946ee7bb9165e7bc83ca6a56fd090ac11d8bc7da55a600018527ccb8d7803e67edde4d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e0072e40417d66a92c4c97c3d59d6523d0911b374cd77313dffc5a7dbe673bf1a3ea57ef4d1c1c93b1e622113e976e03f763b0f82eb0da038b2c0469b65a744d3d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e41917dac58e9b9b4f499ba5a47ec870254f0a58d4e35a8eb31f14d012222823b50a1ffc1b4041bcd824d7bb55d4792a7039d0ff849cf79c658207870da52c62ad53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eedcf08da2f4259b9d37cf39719ad097466c3e118225e10efe8cd822976eb63c5d2e2f8c6466d4c5306f656ab31a44153bddb693807ae55cf980ba1d3942dfb39d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e78d5792dda8c4bd1b2f508fbbb3b6e17a61efc7ed9651c4e90bb6dc4bb7642d1a51021d8b7a1cec4812b25a3c1def73ae3beb8f5779d48b7109c7b1544a1dcedd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e8d6e82412c7aaabe7cc094f5dc04199852db95b82c86ba96dcef0fd472033753f070b4fb936249fa5357f55f70d0f57181a8b262d6a46ebe0d6373f19e671a7cd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ecfa9458e2e9948e187193c78540e1cfb29701bdd830406253a431bd0f6543b43c2339727d4e659a2456383e9a17508c67a6d990d5497dad96104ca54e7506b59d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e66dc814eb54a7cce7b8c802d11d258c4b65406197ddfb13789c6c1a17b022971a894694adc3101ce715f73e2a04cff2f1bec6d260d74e98b4d6b86ba4a1323b0d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e0c16c03eff78ada682b6d2f878be0c6c4919b6e548d2873931e5726d000f357d7d9dd51d583308e40721ffc69226e3da6b433e0217360f1e12907031548281f4d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eb8b59d4d37adbdd250f057b6057d0c111258d4cb472d532c81e4f211fd6b361834e736fda1a9101e6310e6663ed78b24ed0b22c7e0d6c654b6c93033e34eae47d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ef7403c2815578f675a7db5dba4aa2d71e2b819143088d225547923e9180386e6b324510e657e58fee102b836ce98de0674e1a8bee7d88a74a8e64a6b5f1635ecd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e35e0d0d8d756b8aabe012c310246f15697f89e16deaa9935088de6522d2adb2aef8976d3f8683209b12a49cbf7f8e188ae5dda8425ae8529a901f39eee19e7ebd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e1f07983ae8215b74f30cedf5e294773a879ab944204d5a3a698640fc67de7524db2df1f3979d9db321082f35341dd475a2173ebbd2627642b92e6bef4043c359d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e1d8a036bc2bb8d975daec9a8e437e9161ecdb62d912a90c004c421b3ab582746569e9faabc5b97a3dd490b9c0d76404b2e9d9921d65f95979a6ca26f35f64377d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e4b7c433076cd8686ac04fc3ccdf5ba309069a9e431815337b80352b6bad30d132fd849a7bc8abcd47ea609715daf8fa4c66bca4062a45edce318cc64f0fdb6fed53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ec3a7a7cf928c3e61a34321075b1ce772c93fe19851407c8d285b417f0e79c7808151758a4ca47f294fea69abdf467c79524608e3706e80d52bbbb44b7088822bd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eb5e4ae52e03da69a038838d69c70a8c6e2ae0b25d4149f5fa054d784153a7852c89bb8c3fafdfdaaf12095322c0c1e01fcfa3bff1033788f4df7a77376688154d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e1836596543659f3a2f1b05fbe4ddb3b5d3e074d3f0ab82430f3a506adeefafd6d8895698884cf2f59f9f3ea7d4c641f092d5955461884662a6bbea08023f361ed53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e68908d6726077db657b8192338afb0d5e714f1ee7ae54883137fe153859f37616569a7be2a62b64069a8c04cd43d87ce7e4939d825505f17fce226a15f9b0906d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ecc32f4ab15213087ffe7efda3e59fc7413a00110245d9b5d10502c5741cb54d821c479b39ad97c64e427f7e6e63c210624e5083c9e317fc812fb57b8606f189ed53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e61fe9fea73327d59e2039ef9ee97fd561591c72c0c1e6e3972e6a69b09bcf6034b73049e8a8a05dba890c163972f0a39e5a053059743830ffb4b4e255f0a59d8d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eadd9a0cd0032599fecf4542f2c7257b65322929807dce7e2f3f9f41a89910460b31d617be65bada1638fe462d6fa25202cbb062b3624b248b8db4a77bdf5129ed53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34edeb91aad9d17dbde8e1b803406d9d27f6b89d0df50d745731724c0ef524aa0a7ececb6d9a014aad184a85382886e64d9f28f661f16446300a5b5ddceddb1623bd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ec2cfcf10ab145c7d046f52b4358c34c4c9172d1acbb2f140456b0635d3c92754986d070d8162252af66648d657df04e0f3ec4df8cd8973dbf23521b6ce467379d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34efe828e33e5d73dde4916f1464a7895ef6946a0f9aa504f492eaa4e4d6027fd56e5f5d4769c3e884e46e6ae4d15c6123aa0fdacfa173f7f0898e08f5979410a39d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e8500d6c19a9098fa8da7842440ba007f17b35e927763fcddbd990fd496a6a673537adeabf0ae875faad8bc1d3cb53a82d05a090b6d59c9495114e865ca4ff619d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eae2c6a3b5b48fb7ef67af88c4973a24edcc9343ed63cf9e53689baca8b75d508a088ceafbf960d6663a8e973e7bfebcdbc1aa086973fca04b27b08c2518b2006d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e439d44d67007ebb1b64922b6197f18db19c854e9da038f12176a0f22bfe48b12948ac96c5f91892bb9a949a3b0f5a70e6d4c1e365b63a7d7d33261397b0851a7d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e233ee97ca1f5b49ca3a0018555d27b4befa80ea371e906dc6e3505c4423d5acd9ae93b4eea7458811ebefae68a3ba49fc802e47ea0144ecc1f2acf17a2e1935fd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e2358990d7784137f9dd1c18d288ec7307f773221ea81aa81118a847178d2afa67b180f47be18f7cb5cc0918e5b40e4dcb611d85143279d75127c42b7e1164fd4d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ecaf14531b3733967f7eb87a1efdda87b54fad2169bc4adb60894f3668fa43b2b13c5ad4e0443f7cf4e8f22206ad339cc43ec38a20b99ddbfcd56d8d30fc3c3f8d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e93e7b3b5e99cb9cd8832c7e7ffe79514f8cd903e440fa5a1ecfce18f9146ca63bff3fb950e67e3f75d81e9b67814889a4488d0f6562be96d0b877c4a4a7067e5d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e95f367c37cb0e6760f43eaa35ac80337b7b474e5d5bea6841cdb87e0e99bf0f094a5250582cac7ab8cbe7352927e68280e43a7885bf0a7fef9e8c0dc4cdfb7fdd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34efbc5117632a6d3325e338d16d632116cf65658bb23797dee92460b290049bd6ccfb96bdf0bb4504f74b8ea09ff81719c3ed8e4b058560c8cfbcfc3a85bec2e8fd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e862338fee28482de998516c68dbd282dde544b5461967f5aed95282acbd7357452cfed9bac517d8e3669f64fe391868c09b6562f7bc9eb6d129880d708248f45d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ea0c654dca08bc58cd311cba5e7996f51344c49087d8ee86ccfbb9271d0a86d4c861ef73fcbc1695b44f4b2e7f0ed3383bd3eae253c49f2990ede266fca717c37d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e2a7c5975fe38de95fdd84332ca80e8e20ba007c2f52488e78ce9bafdba13f5a121fddf4c7cdc0779fa41e3f0f928077e9a5ba7f828f260fa7a034675a81c1756d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e23e28283b4dcbb9d947f4bdc53210738317613ab18b69fe811011e9aa48f1aec3709cc81d2beb543e9d282d6ed89026673781342f93da69d532e6861a15e1eedd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ecb71ff4a0c2c3d51a3b885348754145bd7f11ca09bc480dd74f8351a5920ea7569e9bb6cdce8b0d70bf59f2ce2a4faa27b6acc973fa59b6f800dcbfb83239612d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e926d5c3075433aa328ff9121a7721769b469d194b0cc468535e660f0883786f197daa1864648256f99eff8b8a019d97aa9ac0576affcd7e4641467c888ad40c8d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e7be88677545ccd4bb52b5a06905b762bc8d14c24b5980717131c52b5f7d3d3239ad659b671bbc620ecc2481932542c7edb9b19055ba70c85132cdb480f6af34ad53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eaa5f7308c730cb9971477d7dc0d049467284b9b49e279ac60cdb6d49ee12dbf950d5a594a45b5b425ed8f3cf972e916a11653a29cfa496fc474b896045ca7e9ad53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e8d7ca1acf6c96b8732e4bf396c9ea92052a3b7a9d9d169115e9a9c8a229ed637cebe26fc19536cc23c4a8711435968f14e9b5967cb3226c3f5947e77f84db39fd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e4f4edd84a6686f009392c4b299259b4e426564772edd4a345213df82d1386e7656fb47b2005cbfa3a5fe9e9ed5fa8e6d6049678db9394e3914f21c2edc57c58dd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ede98db67cac8fb643a22d141e6b262fd515bc7b0af3c32bbb8c42dd78ebeb82c95bae83eb6fa3f8262103e072b12825e75e54bda58465441f9a1d9d68898e8e6d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ecae9930867069af390f1f49a4920d326835cd628031b30f3aef135c9129e55fa6054ff7d0f121ffb8f3a8149a613eb88ca43992bcb9cfd03ece09f824ed04249d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ebb06a259558c5398836af0b20b65768cfd6c81c260be30f44628c9efc1a6e1f048b9af51f4777eac5de059cddadfec9e1c1845cc9b4ffde7d815fdcd8089b795d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e7b4affa6137fc394706ba53c2fb1df839fee50ed37a9376ca09a986cf38af56950c534c068b74eea02ad27c4bc4d831e05f4fa882e958271142e943ed3aa6105d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e8f584b5e1c4a28523dceac8d4f73a48c5a1c475f7848840c61c36b1b3ba391dd53be7e15ab318c3c9f3eabba3d22f0c25a44736e2a9c0d774d7f243f317202e6d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e8383982e7f2e8148761955671e783b046fd29f73322e173ead07ab204b8d736540284cdda2ded0e2ca70377397b30d4b840d46c0d6d9b2d213d2a8e18e87c3e8d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e4fbe3f773176ce35038c1dd050d90ce86c47685dc4455e2798c56238e6ee6318d1fb6b8b15af8a793e581aa134e8f64ee41c4ec8e30f47db4816824cac2081edd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e9bca228da0483806b01513fbead319f2174d6e05ea1f61b3bc03df31d7f3d7afe207875289497df9731a69a7cc82c0055e8e40e5593f50daf577b5a0aed6eb10d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e783d5d8eda29f0361ccabbf1d171c2f6dfc30093ac127841980943aa9cd5646b5e4316979a9ca7b08b8eb5d6c61d382c684bcdf5e4e855f40e3bc4daa0a2bb52d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ef5cc9ed83554a1efa743139dcf9dc70e958bc5c104b7948de6d6f6ab07ab55cafacbf2b7eba7bf72a1ef0e530f9689bb776e3152389492717ccf9f46754a1015d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e3ad186689bd491b690290a6103dfa569256e70f9aefa11cb9acbb754bb344cd5361526278d34bba97c843a8e808c789c0d60e95638002478ca9587f396abe754d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e851205cb1b1f1a8d1974b636b02bb3cfcb68e9dcbaf7df75761244d7c4b8902d01f127c48ddecaa02803604a1ba1393c1ff6985315466c34701a56570ebb1e2ad53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e9b260fa6d73b8babc5a9e9feb8742dbb1829629c353157233049b13919b860a8765c57e577cc3f9ff601e5226a7dae26fe3b5d2805b9f49f42dc443528a7e828d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e2cc275458363750818ff6c3796258663159cbcd4961704e8d13bee3e03f9005cfebc8ac0398da13298a5ee6e8e3e9600ab7df4f9336cd3246778d65cd8e0f80ed53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e95b9b16238be09aa9a7d7458ec1fe6b96c7d3fca29e38d2ed7dc5e4fc18439ade88c006ae6523ee6cd3f26e17078293c7a62d77b709cee1d44acce633072dc38d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e215a67d9751a6b15521e4284afc869efa380ac971ff94586f046a63c76adbfb0c89954b6d6fe79158c2bfda60fea57f089ad8c1ef5fdff9179691e8b84e9813dd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e21ce61af33ec965d77ed43f788db3b39827112ea91100938ed0a4412914bd0c49942520ccb0dad5f4deb8726a2b2e419d0ad309cbc63bf7aa8b061db126d1409d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e80835a5dda38d2a7aa2bee0075c3c09dc8391d5c8fa206ee9ea995bcf4704d59ee116c1de49d23d812ab48a145a47f84bac3632de5f0971dd710ec4d4af12847d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ee016105a3c322f317c3272e0166c45d7f0d84be1fdc8d3508c3890b31f0eeb5b6528697423655d104bec15fe13cdf48c8f1d2fe288a8cc546358ffa5134fab29d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e4cd6d672a8ba9b69e7333fa9aefdd4529b0cc81a6854831caf68449f8368b46d5e608381acfaa6fd036a668be85852020a885452dffca67502226530ff2a90ffd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e5143bac7dce3112197c1a368bd98ffd53da6bbe712225b45784f39a89316315fbe9a07037e7933e41b4f58609400129589ae380b198299dd88a4f68316f8c708d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e0d9a4418ec5fb92bad79ca6e32e0342046591ec8ce7cfe3231b30f9bfcf633d6822444c7df73c2f05f74bd2fef7732f5417c931472e98c147854808203a457b1d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e6261881255256086c6e7863547adaa85cb90a9aea64b25a3d9a9126aed20de4370d19e9e2aa0f21a2f606cbfdc8f89de5b01142c62c525ce13de18f1642daed8d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e12b715198e20cafc0b055758c609e935295288195c63aa68e40cb44a4ff15ee8320b5c38f68b41da5c2a616a1cf098770b8026098ecbdbde4c1fd7f2c282ef67d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e7f489c91377158883b07110acf0d2dd08664ccac19fa5f430c4cc1aef8c8c66cec0aa129accf87cf7fe950fb52aeb018f57ff3b6f9bc964013ad16c378e183add53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e48283c27c47c9ea5b4c1e99870b7620a8224325384476ef8a4df837920b1bf5b08cf4c37f564b47b4836e088051ed0cd33e52a30d1f68a9a11a926de0593f60ed53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ecde99e9e10a04625bdedfa733533577c583e726923be4812d1dea4ac9868fa31ee6838a5ae674c93e9cd66e645ffa59f9a29e0d7b7f2c5a62a293fab49b54cb7d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ef34f0880908fc50dbb022ed1ab8ad4b1af9ee27c74b7626e5d262c6df88826494c0558183e3bec0f46f40325aba305d92c3915cf902a0875d9bbf8e70989abffd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ef07a3a38dfb7db2ef0c12d79cdef5099b3164a5a94e3e4ff5877dd86b03efbb8d61afe703455890bc976d8224f1b23801280e5b53707152501fc5e3414310624d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e009e3e2d838c14c13ccf39a95139ee4e64b70895a5817d7d613ceab0a928cf22e9d1d5e23bc859b72790034cd049d18cfd5c1cf81893dee231b718717de3d4fad53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e331d1e4f307d43e50bca74d81f97e62329b2fcb095117e4d2018488c887ed798ab08d3dfe15434342d01a2f2a6f9a3f492bb1d11bebca16fa2782bf331ac5952d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e61973ef483051995e29f3082013db072fa2d4152f62877a613b00d2b28d728ed73ccb0782b4d0b6a941d745e4cd84be0704b147382eaf9dc0639f603341b5da8d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e4faa21731a1b40db60b797d940f746c233a5682283bd8aa7bb688e1005817534cab5a8d822b92e48d80e9879f0156764a9f53b4e11a386a9f952f656bd33d899d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e19724813c0310965966b5714a9741b8d5e2e3c785e78ddd38b00e8b42ffc55c1331d334dd03ba82bb213d6aea4bea87ad7699156c0e5496d0ab64bc069e59e97d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e622254b9255c7bf9f7765f2c656a45926b21a4bddbd8a26ca3e29bcf78b5d97c7bae61c37d354d4786162fac4947892790174fa7391993f4da9946ec3343f72bd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e09d7870f877bbfff0f4c35cbaa9613362bc9b2ff2ff77334c26454512cb0f56c7dc67d4b546299ed2502ab99d38bdd23b20d2ada94d28383038b6187b00a6bbdd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e868348453badb3e24b4c18e71e581876f7deb9b8226fdea99eaf97d4bdc32c47ac2fd1dfbada0ebedd52bb0b2e9bfbfc09d099d9a440f7a81cd50f6715507a0dd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e7805d75c9521333c25132a5e312029c82fb7f34a1212ec7bb2b86f43c48907310b1fd7ed515127daef49452b17e941a6f27248be7930a202c49a714f617d8d69d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e9e95ace80fbbb45f9c57ffac8803308fb960f950f603d09609b13ae6ddb0e260eb4c08a5e3f8e9e845a389ced280ea91ca0c393666da585a3f9939667991ad92d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e65f294bb338fe33e0fdb63455b940bea6973edc453e5958d59786d9053611b84460539a5a457b1b573a9290a2cd2e343b4f22664b012e0acf7be0c658681861dd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e29a8ec93ed1ddacadddf05986f2c4b312e50d7490f0502fb9d8588d416a8b0e3aeb051a310fd037ef98fce1d87527312b4e14dd1e47e7bfa3e6069ac49a61f42d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e2666492bbea9b0ca609a229687b91ba8e6e31f19b1a71fdba66d63acff447847a7fc1f481307072f32fae25749bcb5663f87210c60cb102d505932898fa67f96d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e37c104a29ad03e697f09e8b6437c985eb5213f176560b07139c392470cee64aefb001e8952d690472cdcc789fbe03a12368522d3568fe03afc1842b36eec4a13d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e340a36aa053baa3f143e900cc9402ba658495b9311e0e6e7daa05c5be8223a373f720b391ded4c381a146f195dfc21260bd0960a65dd07771f5731bb469552a7d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ee79d71f3b23641b48e4a1b605e19edd7c3411dba926a4b2fe2a2116d5319378421d139859c3f415e5d06e6cf6c49af55370a99feca086d2aae89ba720c25302cd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e410fcbefdcf6eba735474b19108972a308a8143a4b8b24d4f68993fd8b2e5f001eec7f8c2a364c64a753b84e236bc53b17ad41e9e310459e6fc99102539fabb1d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eb226bc5381302ff9abba278302ce78bd94b82a29a7b064073f68cd524b9601c8c5e84160091108c4e77bffe6092f91abf44a2960d53451492e4333119d176f7fd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e72286ed708bc4a129a0465e1a2690b27140f49876c5c36ac3784cb7e6cdaa656cde528d4ed6f6d3647a693b3b46557797417241ba3aefcf948291520d7044749d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e7f2e5a139778123cd1999ce5ff17d6fdeee166df128e404714b2b2c585508d2d85c6455fb0e2b454cf1f6584ce1fbe99f84932ebdf341c6e848be7831da1dcd6d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e5d26648f319f687161f7c28af6d613734b9f5145f77947bae2041593a42e2f58d4689365c88a615cfe8addadc63376c148e83bbe80c97cd72d9a87cd3033246bd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e456d76555c1d87903b6078b3b51facbac9d60648b6a2f3fea05503e2bcf816207c9fed20c72a41acd4dee686b6aff59917ca435a86aaa629aabaf6e4f86036ead53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ed323670c46fdf43ff5d8f7f33d0be5448989dfc5bdcb35544a32699b949a114d462b9327fbd61da0065f6fe65ef919b34397d266c85a2a7677d658f5f8fb99ded53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e2c30db595d08d11946056ac9df82c99ab649a52368f9be8ed48ee4f75a721f5427249d9776077b71c935b20be20bd62c08fafedc4f4b8c4515ecb533bf40d7f4d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34efec493634d0236a58a81fa59fc7dcfc4e385f3f7c33160529b40a22570e86dc21e7398bcb2cc1a970487dfc8157020192f00f97de0c7439b4566581842d3386dd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e50b8c49455815612ca6cd3f8872f2615c3ad3b9663a3d13ce8bf6547ccd88133e63d5d7e7c0e8d61c60936cd6229404cc98897b7e4a57441ac4a879517540ca6d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ee1cafe446a408b1e1144ef29b044df2a4a697eee859a39c69ff25fb7856830d87cb5d38a49e5e6c36b6bd532c22c95f26f5aa569c0ffc389a26da27839496102d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e8946760eeeedf57fd2fc38bf3247c55ac3f5d967c2a2d6193d04aa8c25b7e6ebab21f46cff0e32d8bd4fbf2c8bd56b8b48d49cfaf15994acd26a4bc55448e8c2d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eefc25657814f4feb5f0558ebaf04ca353d5a10e89b44e06f63531b22933250905ef76a7600c7d4330ae5adad5737f7aec63634cfa2c9f1db76904ff659fc74e7d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34edd189490da59a2dc654b3890bf17f674f58b771cefc35a188d51a5b36fa50c5cca15bf18d069d46d246c2f082b19a7f3d3524e36cabe3d7b11aaf3c64b1b79c1d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ead7d17787eeef0175a2c5332299e771c97bbb7aed19e230f50298a787e9d58574277cd06a8252292a7a62ab453766a35d8b765494e767a987af12c1dd4ec5c60d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e1545a03f674dfa5ea3e982a4dbd65ffdd62f9298cd32ce0abe2b4ab28c8c8fb46b5061659eef6e16b918ea0227861d290fecac98a8f93ba137845f947b8e5a06d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eaf5a0bbda22b5466f425b0559509e690e574b4867b7513440b9c956d57fe6c4c66805a0c798b01b3a6e9e5bfafa91456f73af35ddd038176e3650b6488aeb1b9d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e18f0c4e2144f4485c284b6d39205717dd23a5b2acdc9e31e99413ba4419e8d20108ac3d6ab573156c731de31a570b54ca050dba189a8cdfa587df4325912cbdcd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ed0ac39a4de4a9da80ffba469566c7383a35f881a8caf7a40f2d67c4aa437153fb65ffe5e88654f7016ba913e10293126f9abdcd04c37057d90e3658bad472cddd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e4345d2d27d910b8b5dd9cc1336d33055c8b6efa31909618c1b35c8058d2c5735845070954b967c3fcde0774dea4fefdc3877c832f859d1d2eb15ce1ed6b85be8d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e2591df36734f3b3be01547cf6daabee4594694f2515ba3c030aabf46c05dbb40eaa283e797458685bd27e813bb83f8f46ee9ea73c2c1a148de6c57e6593aa014d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ecb6751240f4f44aca66df1be85933ab453a70b9cbe0cd5b61a678e028ef41e1e9c6c4a3ba2f02605495c6e59964985cac71d68e6c3e73045bfd3792924d698f1d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e454c59db9023a17ec9f2ea56c3a5a9ecc7863a04c5f31bcd2930b014268c2caa4c98eebcf8d61a8b1eb34ab14f9f65aac170f010d61e5dfaf3f54868a9819df5d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ec53b4b875e65abea9c45e934f9b6bbd28acf8e0cdff33a9eb945bf2dfa6d1c10acd8d570b0661421a2235ddc2f82c0bb3a47800b1eddaceb7ab68c1bd24b0828d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e398edeb728eafc1b943a34b55ce495ed61c01b7c0310f32af5269f3f6a611dcc7aece0af0805e394d3d930b5f7f6ac00511e1687ead828bbf6a2bae09e447596d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eb8b63a85fea9cba492dae61194b9e65ac89b748bb821d7fb041c0e7a56f1cdc37e6ea534bd783c1c42d30b92ed71545bfd9383567866c2dd8ba5692478a415fdd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e93f5060e60753d0adf25758fc90035ab2c61a0a3e34e492e0faf9a1cfdbf5ace824ab8a93cdb6835579d0b3eefc9e9ee4a704df641e54360335997db65d3e2d9d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ec5841d171016bdab230133e90bfacec05bdcad60f4aa5d894d263e5d57e5c3f57e24b50b9f3dcbc404181814049678075e91d149a96869655f9fc6cbb65537d4d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e43b5c2495c396fbdf81ea603b048f1da16265e330ea1aaf5be75a0c91e508eb2b13cfbf3aac15d35022101dd766d8294a061589d6185d325abcfaa202010e366d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e919a378f37a540e82b346508ecb95f65a53e3cd740444eb2b03fe58074c6438c47998f9aa4cb192002bf5e373bc990f4edc6402757689b5fc552f42a33628887d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e8900b157839f90e218e2b731b4b8a2c183adcad71d381c937326b7571889ed19ada9d22bd3d23ba48e7085466f81cd6113ecaa0d3e1cfdcf8c596f7baac193eed53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e2c0f64352dee9f2c872895fdb4a74098ec9be2ffeb6f8a97cc830c8e9e1bc5d86e50cc840a4dc39aef91dd1a453c1a5bbc85d477e4f16df672766534839bba39d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ed6f1ce22d0b1a8f044765472c1ab7883dd8de2c3200708ec568ddc25c20d8e2cbba754d5bb92d7303807861702b7fe3e3f76a87fe96f8313df1977a2f423fcafd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eeb899c5069f73332efdc39b3ceebba056d20a1c08c521efb443b5853aa2ffbe902a72b85f62e56448f200524266e216a97a5829413cb6d0b0d07b034707eafc8d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e30486ddabe641593c0a65444236a103231b765f402207b651847c99a1aa87c9efd61ca9727d2c4f19ef3897e9943e13e40fe46ae890f4f77dd5728a989a7c963d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ed061f426e6519ba761d1cc0fdd0f074fd3e638cf4cad32cfcf0414cb29b86dd2d1e6f0b22b88051d07f5821488214dbb8e104c087e93e6c5e06c96db94ef4d8cd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ede0517e42dd2a30ffbec9e5275cbc27cf1791399191d6343e697dc3e54d35d049cb42a54726a2963d007353330f1cfffd39984e6d477381980981d50c86aaa16d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ef121c6b10fb048c3e77b611b875a104e18b663ef6860e92d40e5459df2fb39c66948493be31beb1b011ef22c58206860d01d5b47c32c7edbf9c9eda0610ed8d2d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eee50b7f5d810098809ca19fe6bdc68116a64e81ad2d25e122d44b24305e92305e50cc4df2014b36f51f2d5f5cada86a2a7e38e40a88b9945821200d9f0bc81bdd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34edf43e505eaff384eddf4db37a5e1a2d8374ec5b6f8366a07a56e6842e6446ca6b2e669a3e480d7c471c28fd88f3d703237bb8b00d5e0f3f99fa368cb0bd92765d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e64ff453b827d6fa46ff2822f8862adeda945bf806e1cb214dd2a60fc80387e2152f6840dcce50927d604e6fb521c55742a2221879a031b06f2ede29c8873bf46d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eb66806bef5b8d79dc1e8ca594ae462725126160f90d14ef62f16b7da3da1a6fa085d33082bf06e044b87321ddfd244237f33a25e92c98acf9f5d8030b455b64cd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e51bef2d93c95e377bb27c1c474f8ac7a4ac43a62650572da3c600e4f35f6187941eaceecb5f8d06bee402e8580b0deba86a956a0524e70b74e60416cdea195ffd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e3086f69762e782896c0a15cf6192a4ba07017d6ce518fd10ffa41a0580daa0902d71cdcda9a5a1db6b5183418ac277fb1033cf5749966c0f6e16f7e943c03e39d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e70f876f9eb50afc45179f38824fad6b68838c3265ade5b5d6999cd350e05dd7f381b3f809035de6f8d88921fcde590a4048b419fba995509c7d4345cd3d3a9c1d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34efff29040e10a19a11de993a7e7bf9994ab05d2b99b2035e136ef2d599ff5994106a7f164b0600a9f37af8e8f0c4970d181def394761d16d4d52c396ed3171ee8d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e956f1ce6bf99dd2ab04e0cba426b0a9f597a74d818c2d141b6f74d3cc9ca59e01ddb7de92bed0c7aa2e263be3bca78ee4626c1d2bf006bcb79b8695b1b6e93c1d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ef5aae7389df54c0456e6a28a76cdb7bcaf3808a346acc4a5e6e21cbdfca61386398498ab4db57278a35773157369888a945be4c3fde532c4e4cf141529e3f91cd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e20af2fde9bf23ed60b94caa3c71541d8332f2ab2764d107e36b82c68942ebf2a8395a13bfb72e601c3f7561d882b2cf396e4fd143209890cf82561c2b4dd7876d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ec2f8dd5c5a25303e633c175b1ffa69f953694fb921265b25a43931a35763c8f1ed4971a77bfaa41e35d863f5d1d348265a7eafeb4a64bd9f7d0609ca9ead8c4cd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e77263f3e56288a3dd1173aa4559f39162f2b5d8638167fca520f385aacb1a524e88e3bc54eadbefe21464fc683e96821aed36bfebf28aa4965a143610d5f87e5d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e03a5c62fd80afdfa34d6d1ca31d8a6c723371db7a952aedc16b3c3bea87e6d36e95af97507f5d0ed2df9a82528ff7440bac7cbc7d4702dabd0182b7aa0f19e33d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e909440489ddaba56df9b483a1172da18a94814e677a92a5a27bc2d54f763efa883e06349bde9853df7c589d6bc3428de6e0a79c2491d030506978928474e2276d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eeb897779805923ed67fd190411f141fa4931debf57937ac9e7fadd73b99b9ffcb6801cf27e39dbc12e0c47d978a67958f35550a2ae7111f193c7fc079bc34343d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e3e6954d0a51643c104cd5da11a69efd2e181d722132e55b6065a12c0757113c73a266b018e3dd504ce5b228e98d78ae240fe3c37ebe863180a09c92ef731000cd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e1e759c00ac3079461d493405352d80f7218d745d207fcc3308ee4b5c3ad23d6441fdcdc189604de1e80ec4a9ff64b35a68616bf669898f7682f00053fd116271d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eecd142d40dee3321d9bfd5fbb8def5adb2b18258642cc926dd81b4d26eb54c1515a44a00abaedf270610f90d0c90898a79b1743f7e69fbe4ce7b6fe362398fd3d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e7d58ff8e46ab965c4a27466a79b1b2ba669bae7d290acc823de88100319ed0084d60ab3d9baf358db00197113f67ab8d247d92d05bd4ae4d635349ade8b10d2ed53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e7a48487f6fa3c9b8e3cca4e63e0c4dbabde4be1d81ac10e74f2659ea78049ac67819fc6ff48bcbb111c05db6d385eb2c65fbeb28de966937da06903194de51d5d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e4f4a0982447d0505f4f52cb2c3ea74e5d381a1ab8be251d89fa7bbebd4f3f9ebde68d58170eb8723062bbf314a757385507b9c167cbf2eca35da01c67d0e01a7d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ea0dc3f28a42eaf62e62b6e8c4996548c6dda04579c4c119f23a1825bf26d79426079d0d289d84a19f84fc49908c502e68f890839d8200790996d332113b1fe8ed53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e1ad986a4eb9068b026fff19baa6de67b4f9b6fca4ccd4ab4ddf6aba9f1f1fb754680fd73ccc425cdcf0302b4b953d12fe5c6d9ec52ca7764dc2168a97f2a08b8d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e8e9c88a23ea5564749f416b05135fc7687ddfbe5f2e4c9bf6c4378e69ef5009e9f54b9f341254bf7bff5a8b848c2186208e5416084aebe5edf37c58558934ce5d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ec7544fb3eee982e106d9cbd4981044095cd69e7510dde8469d0914c3935f924e128ec9ae04c61587945799fb7817bdfef789bf38e9f2d2dff60728385a87f97dd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ebd331e39e91570e7ff0272cc801df3239ac542771155f02ef1e2d1e35e342c0d933196e1654c372a05a86d5a5445711b5f4642722a726397cd0a61c542014136d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e9dd02ca5ca91dea10fd468be92fcb10e6a583cf85161dcae77eac4f7fac24126c6df9a90b5f8f5adbd48e0973ee26d1bb7f9e334d02a6e387c1d02d03db0bc07d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e2f627ac747db3fed67eba81c13d076ad8d1f535854b0754c01d8b120ec3c940e0c612c4658914864c9efcfbbaddb0bfecdbf2c290f9974b47714e78739c9f93fd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e634f6b3efd2c8ad6d591d7149cdc03783631a58a7e8504906c821ba903347b95e061f9b58b5a18e328bbaf47649814c0a35aa4f8481165e53956704854b4fc82d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eb94667ef08338feaac3634ac25c0f2031490e9ef058ecfb9677256286bb3e0dafdb10a4c10e833dda8f3cacd5afbc62024f8fa2f40dab6417bb908542a1a03e4d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e1e9b089eb76cae4b7eb6ed1cdd20ee8c4a986de9f8fb50ab77d4c1d9cf1f6e7414ee90b73c94ea0a050ac59d9012ada0f01d6baf73ab90248c4cc25266b790a6d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ea880cdfd649a7c3720b9d4000b0fad412940cf0140aa9fb68fed146d3300efa74b707e17508cc945c96a9e311b5092397e174895c3dd81376bdb0d2cd5c06654d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e455e0e672e084e7bccd3ddc861c54931f62cd32fb1918af8e43aca526043d99e90e8dd94802474793eb6b1a178718e7254cc6c6fa13d6bc2b30a2ba550b0701fd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e5c3888ac62099bfd54dd1e81ef6249b4bf62580a2f2e9d9aeb65274c66e6d89f8dcf7ca6ded9b681220172b054c49c4b7927859dbba071f0b891bdee9143c082d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e7d867059280398c391ec945b37785f0894da3952f3026e6b7f73c31b182d43b23259c8f8401a046388dcf96b8d6bd31256a8d211bdd5617f5ad401da398fc687d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ed654ea98b8766911964cb0373d52adede05af86cbd4f25d50aaa025132e79be34f88e2db42126e37b0b594dcbdd9bd5cf853b46499186f25fb0def67b6e73899d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eb04eccc7d391c126fc5767100c88c282f303dcfbfe2923adda061b9fe552e90d64b974e4f489847452e9ee0e1eeca72b5b7ccc8689df4b1c403fc6e45434f067d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e8c551fe71d6e2efc03925a783eebf3c39f40a2b01b7457ffea6b9fa922c2cdc3d353bac01d0842698f882a028492f39a08952945ee2ec17841451dacfe9a2fdcd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e824e210a0b30a6140d5a92a92b4b1b81b2314ee71f7a2047bd9fcd93f672a6d2833b77f77201ab97e49291607cd1a58af9493a258a0227ca180eb223b91782fad53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ef05f4e781c40d692b992719d2c47bb8c396957fc28719e2032b1c4616c064f43b09afdddb43d0690105572a908c7e339d5190ddae7e70978b84fdb0da16de232d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ef6fd4e2e8688a3f8ba3d54fec088a5d62c621a759a46b8e4ea40d106c56446d645c768d8d9ff5f382f1667a645f91fac5650c0281e29c8fd7e00684d2de43708d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eeb89f18dde276a576ba02443cb759733f7e8688d159574279bf89f8abd6d213383ea5431208351f2d71ec7e17a97db82f6e3252f3c629853a6b7a91699ebf9e4d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e69fcac4a5c044cf9bcadd1ab70ed099e81b88db31ceb21e8a37f0ce195ffa929c95ee647d122f0ca78c6d1aafdf87b40ad6591debe2f0a40c032536ff778e0e4d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ec29654c733230880038913112963c3acbc55a22287fc73aa079fa36fea99ee71acb1b5027ae637f582f997877dda0c1946d59e9cd8acc5a28ddcc67fc562ec0dd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e6be6f182317b5c3faee8465ca46b9da3f721b20e21d3bc568af5e67ef7bdee7db27ee16d578969c30a20631f8cf6af755e9c99bda1788997b79a7a2ee60ef5bfd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e20072182c09d487569c1d2f1ab44efc42e2e427bb2d0b878d2029ed0c25139e5cbc09efe1fe3c9e8e1bc8836b91ad3bb893f5366b90e6fe9962f541dd78c6287d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eb1ef16ccbbd491c176022a704f3202b3d5357d4628738b01a092046ffa6c692d3054855a6748ac097a0dacf43ec776d3ad408c89c11bcfe37cb8bff4a569f942d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e08c9b0353a9708968549444c19dfa424e98c81150f4db7af0f1fd36fe2a403c8dd258f2a375f3df342721400054ec556f8f91da5ba3d9ec5ca74545f7610c487d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e5a135427e43a629c5a21c5e22683c1824d87e60e33eed98c6b3a36dfd1d8151e75d3b02177a918ed917dc1b1b018bf7c4fbe01fa0f17b291eafa63623453e7b2d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e708d0c9234dc5f56833f7cd961d18423264e69addd56da7113861b1db0d01089e6cbd6638430c5acdd194c805384992c60c9d8d77fb6e1f132e7ec22e1227f60d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e2383d7f5a2b0806d0e75398759b8a19efec3caf7019117c8ea768e0929fbf749123d64d39c8873206995f629f05657c56d9d533a1f1ec081e2bf6735b4251db0d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e9f7313d8840a4824a1dd8ffa6ce2fb9ad10352f37c344a88c8a947a770e91f8d8dd30d2369e96872046a8bdb9a025034363d13267c2e1d74bd443d5fce08b48bd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e424d76a03ea708b960121872e9e625b72dc1626ef8350d84b68f163c5d9362457c532eb0e3f5de80b26910f74d281b67ec2004206caeb610c8efdc25edd31e3cd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e2c731066d9f69fb4fbaee950ee8fd0a42991ee327702e154fafcabe109fe6c67dfc71b564eb3d18fcb37d808684606c72f7bc9767dc1fef423adc30da003bddfd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e54726f7b698a7e97a3bdc720111ccd86aa85bbcaa75b654aafd95f515398af5f363b8ba2672fda58cb5fa3c76a17734f24db1501b762969b4e13e15a15637e65d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ecd29d719a853c8f3d18fc708a8e68cc86f52f6992e49bfe972c48b8f810574da3d962c8ce563d6282d0e2443db064179eadad47a6c9c2d665bc7d55a1d6889c4d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e6d0599a50d471e4757fdf093b103bbd96d81e08014295611ff4771c184928d7a01df89a7754cf1a6f01bcade15aff999283f116d914c8a6fb4ffc584dc03b2dcd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e4b3a0eb261c16e59f5ce1dbda1148f8546da59bb6236e672df1d0f7f8695edb0e7e5ae83576cd7948b87839042d7d0409143d6e92a38479f45c5437f917643abd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e49cce29e8eb1c963d745a6f8b98d4828306fcfe1e7909a8a42875f6e210920298c19998ff27e9e9062249a53de9cd714b6e14548d8e9ec44da04e3c986dc24cbd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e23628d48f730e094393a722c365403fa6e1c7963f0162d23a88dc96e4b2621b0037f9d16804a716a569ecab008b49c2159297291b5ad838376501425be3dc76fd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e914855b49ab65cc8aa8e7ff9ae3a1a1db9ae5d9f4c9cc7c699c50688dc1a8f2b9e2f191f7aecf0d29da7570fa6c08b0ec2e637259c3ca09fece5999a1c5967efd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e61d72483731dcf622ed28eafefac62e20afeb0405a2a55de2547c4cdb771687c345c339ae3b2190c75c2e273525b7a667d33eb24d2de68c4a78f184893a68aebd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e32480ad2a2eb7e39f0125b26a7a4155c7b1b6df10d9ce0217cd15e69d10fe238d3727acfd3025635d087f67dece5368746b4aab973dfad648273eba708d4ed6fd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e94abeb73c2619fb46f7d00e4b69703c852542be6caf354c82a8c3e6fcc2950a60faf9133fb3c63245a6a336fc18c8ff892315118f5dbe379e0461b042157e25cd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e87bda16cff2e42ff2d13e94c6fe4072e312153db9b37e87fda93575c37fb1f0bf327ce786ff6ea275d5a30ed4ab248ca8a2cbca2f5d6f9f56d97e069431bec8fd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e83b877ac13701ae826ef1584e8654a4b3054b7143d3403b854290bcc90ddc0f1108d48f35bbbfba64dc750772acaa6271cf54bf7a1383202ee0547f3191b0ff7d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eb622addc202d3ba5289e46b991ba9c941a5b9f58aee40ff3e71fc4a23318045cc4646a43b4e99309df6a69ffdffb1aacc11fb20669ccc3a231792b7ae87da287d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e2f1caf0797abeb5bbecdad81f3bce15048ba20562e149672f53eb01394dff3bd7156d325606f6d42b231e6371c27085f9a6958c880f5940a6fb9422bcb5c62d0d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e845cdcb67c7db630149efce79927b2ac85a87a2358daffb70ddc40d3cd4697e9ea72671137e1ae675fd1e77a1aa7204e6732026e9093c37c03d4d66d506f8353d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e60d60a12c5c07299c3b0c2729b67cb5d9c969ca88a063bf2e192d7e5ee7f82243f685396a67a3f872c6ee2173ee1993af20dced8a7845cbb6ff560dcff07766ed53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ef49fbb24a84a90ac5088d1556f651c412e614d846b1139311eb998e06c49440a1e1cd214b273fe19bd1256f2ce3cdb24a07b1cbf6f0ca94b5a5d75b42420e91bd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e4f0e67554689aa052f53d15c7d8bcbab925bd6a7575678f49822905a8a9327ee03ad3b70d42cb09ed53cbd0c292684342398c64867c4497aae20c33ea84eb409d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e80667d57e2aac0aeb74f1f497d129dde4d6ff5c91847e08fc6d8213ceb781cd1ce90dfe5b648a18ff743398e44aa7bdb267c997278a0351130ea9135868ffd32d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e489ed446f5c10fcf2296d72e49503f0ed0d61f22ca263943e2d8de5af57ddadfd9cfdd6445a3ac5518feb82ad9d6f492ab34dae9f6703dae45626a44515a9e16d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ef4c090b605eaaa7fda57885e09a64daf4b3a166e0b936c54736d9e241204fc5f35e3a19b6540c7d32867068cc5a6092811f186733914b0ca858c7375c4c536a1d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e9b077de7c5bfcacba9158a02edabc13a26c9c197f73c41fb580d63d5343ce3bab4f059ef62dc96efc2a06cd2264897d4b9557a59e87735938e78e0ef426d8336d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e3a0bf9856967e75533188662d7cccaae153655382d2989494f2f27acd69fc2646a8aa88b27da831cdd0d859405620145e43c50a8a954fbee585c2244beb0e9ced53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e1fcf7ebd8f9ea15e8cdd7649a3b3057c1b3e792e9f31f303c13b32980fe36394c2df3cb1fe8b6f28afa81123cf5966040ae783c43e346cc7dec454d15923e26bd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e075fdacd902db0d65536c905ea07c2c7006628cb21644fbbf2a2e9081917fad5bb14b44f9e957cac75ebdcaaff4f3bf86dc77620b2c1c4ccd4ae3e15a2dc5069d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ee06e7deba38d122fd29619ecb13a8d4a76033783c13cd0265631d0c6651a5b7b910713c9fd614d8c94d99b3a36e63f372a7410eaded7a43c323f2337b19ed65dd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ed4f7d7f2d5bfa247cc08f42d1e66c54d687fe6378dd50e342983c0f04c2453c602de1fd82c1080cb093eff7fa98354c19c6d3db5478dc45558a4ed2134ae23e2d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e85feed268f8b65410ff87ba9da55275dd09eea5faf46a99d75d8081934668c1dabec2543ebf2086d2f4940f60fc2572cae8bfa30392499f7a42944e0f8b50a6cd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e3cded84ec5f7ce69e3a214d2357c93f766143eb02237a64d33aae473e45190ac10175469938894b74b3996082e305388e509125268707f22410cf900e103119ad53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e392b45cba2628bc764f62a048a770e6f10c0ada341156580a6992370fe48447fd44dafe298923ad6d45323025b5a1db7877b7a9b6a2146896d28b7a86aba9130d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e07a1b0340fbfa944b8f3719b08e81bd9129dfbe4679829cea9c42455067ed039958812354afa38048c1b8f38bf4661bef83e7666e5a46f474a8e43ea902b3097d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e328c27559e6cbeb1e1464233a7c89ef609115e1eee53439423b97cbebdf550f492c8e92135dafb79767a6727127424ec071cb72e7b42472dadf11bc1d041a84cd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eca7cf6e1a00523fe6b30ffcf61ffe62e25b93d93c5eae99ad12c4203413e75e069fea6e4e909bb75394f9b028c0fbeec539b8c975e2530ed74e7bf2f63ebf29ed53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ebb0da4f4c6723cba0abaf596aa79bf9f852ace44e0999d3c4654f49c716bee963babfc86def4ca96df9ca2488a3bd6361284ebf37ab0d70f5fbe1a86cb131330d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ea2219ea06fab0be4bbbac4fcef0ed7df2320c68898744e82fdb82ce6d9a0f9861bc4b1a6d5a0ec44eaf642150ee5daacbb04950a872f8906e85aab574b4b2c14d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ee40f2c6f62aca8b79dc45d9c17b6ddc40fa68be8a070c3834595158d1328a220af7549d79e5e3de2b85032f568ac3a244f722fe500cf55005638ba077169f216d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e2f1d9787669eab3eb86c9757f7f2d27cd71487e292c3aa73669d3065b14ecf8e801b4281a6f1f807a981c0a5b09382d374aba1de4320209b1857e8e8bd08896fd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e3a86efd7e67f04f2cee1e98ebb400bbaebd2243f3170f21b3873fa334ef11c41939b79617a94aa89a41c3a47e23b9773fc506893a6e1c54dd8756d3a000a0272d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eed9c06c4393c00351e6b79d42b6f589d73c268634996bb0f77b7d8b37656749a45a47409f3d89e8470e6fcdff0411c938d9c153a1162fa0b80194a35cabbe0e6d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e1307a83534168ee24af1977bf535d630a9f844e77c579c388754c58f78af0627b8a6b9192c3ef905ceca91cd0b7d94615f6b315573a54df3b9ca8b96e5660513d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ed780aeb7abb5db2cde5a5d6118bfae495c63364567f73331f35e3060266857258eacdadf9abe8cc6c886b9aac25a7c6def2d0ce6be2798eba53f8245d8f12fedd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34edf422403b8e2f4e02f7bffe75322fbabdcc567f17e63780a00518db8094f542d5690e21221d014170f37f149e8fce0ccbb65ad71b06e792caca859a8c7974df4d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e396d656e284ae45b5850b0bf8be916b3e537c87a8c8ee05051b50bbfd7600d4172c09f7b97a28ea5b3af045d6ecadf08a9f9fc685a12f9bae978564e685028fdd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eda4cfcafc5f8f5bf0a33545d5ed811d0e8ebcb9f77224c6ee1b8849eb6c343843d8de90b3bf4797091db958cacf3f565e0469ae08eb503ca6c2810f294e134d7d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e831f2b81e8bed49b11f72b616490937cb436a6efa92102b995c55f13b72bbb8a7cd49d24f559adb80dd9a392f6440e3e728107bb091682f0212398821ae960a0d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34eb33add4f66cbf27f9fe785a0be2b75693eaf2a551370c47677c95e83f74b33a734f1a665c522bb986f908559b35925dcf810171d6912802449c05a5a2a51f3dfd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ee051cb196d33e6c60e083fe830b5b385545df8615f85b69921d47438ca28120d9467e1d958be554d6f061f5f8798d134b7e3376d8a2f952d94d51944672d1c15d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e371b6815854d507672913cf795a756813d118ffc3672b6d0421058f5275925f62feaea6803d922686f829f1ab39203bea0b1d21cafcac131829404aa4ca1d71cd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ec9c7412177c53866fa39504f9dc4bdeb43f5183477ce2f8ddd809141dea5444fc7f8a662df3ee6d2995c12edac5c62b5cdf2adb54f98df6d9dcc97951395990fd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e213d878673b7c90cd7a7bffc7baa274cab94bc3cf00cab3b27946381b68f377c7df2e103a54a704f527ae5c3ea07770563baa86ece11534d601e26e443694eead53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ea594a163fef5354ce89cd459b8c6722b3fce33e9af27c51ac0f0c91cf2ef24d3f17d797c4d6e6c62903bf6ab121780bb46c0db3307d33737f6ff3b50335eb28dd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34ecd15b5b3d01ce5aed4db50d5af893b765bca2ee7f090f46a7d0e7ed98b1b5a53035cb980794df934573b913cb1f78fd2d917a27b75f954451ada5fa842503143d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e6fe204df2f68782d87df0218e915150094babffcb64a32fefd378940757e17fe1f2772d405c97f4880818977904b959f3bde063618249e67a1ca2fe24d8d07ced53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e06ca0db9303dd16229eb80a669c514a4a65d8903e7897be8f97eca467445853c46b51af3efb805c2a5fc03f3b51130b96c80f58eaa212793b7cb41523f862f5cd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e72d600b63209ed7e80750c75d3e6a52dd98633063b7250bc8c2cee169f3840727dfbf05a60da27128c25e7ef25e05a692ae20ddd3a1730e4a22196c1c9899e79d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e45d6ca66a711a61c8fe8ab522a5a34fd825ea18f926f1713b9b1e994001c7caee3e09405400d00cde22b1b0e829ddaa06627db51d480818f2fef3846ee9c38cbd53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e06b2a19c4a8a0ffd7adb60b6c8791c660c095f32fa9beb69673752dc23a78e91eab6ffcd4fbb6dfa1220e529f973cd04658e0e1bb39982a74c69a5c722e3c603d53315bea08cec50d2591fcaf3b32dc5d289cdc6c16b7e8bed8c8e3f7ceaa34e3134c3ffb0028bf9b8e7137b49944ca8168f69485a3e457f80096bcb81d79f26f5e6cee970c29382cdf1dd9a3dcd8fad2e3f5bd0ece8cacf6a6f95db1916152e7336e4cf97adf5f0114759176842596133e86e735d249d5151f04b5fc35b289cda1fcf0bde6f255c2853bbd173a17b1b25d62771e3b7e3d90661b6d4b7e534f0db85a973259a48f811edf199b81341d353d89b2aefb08a309125ee481ed4311c33115c8ae83b6d571d45099e1758b571209e2808eed26389ffc50c1d5409cb372193bbeb31675d218652e2563042f424ba7c9512412552c594429ce1e9464e9b8583ca57f622a7ef83c25b1234a40fe8ac5e89cba4e75b8f20da4f206c830a485f8015d0c273021c83e476a651a54a36f573ab304002326a6640e5086ff3854c07a90c79be1c23dcbb5fdcfc6f9920a5fac211b9540e6bc8fac9487700fa5ca9cb3b56ef9747c8886de3052355e486d60eede269cbebd5a7818e910427d3427ade56634b04b948c1944d9790613fe76da02c3fbba9a5ca55c75fda7fb8675539f4faeeaf400ae9f1718bcc4ddfcb36058208ab93b69c93321b02cd4ecb11a393e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b8555a4e51619ee7c5271a79c695efd82fe9a7bb1bbd563c5093f30b0fe9653e16dd08062b1ce71faab6f7a21a62b6cb71a88b275e7f36fad087d29fd7e0f121d13d971609daa9932c2f0e826de13adcdbaa781480568fdfd1d54bd4210cb021395176afe622fa2ab9e66f67ff50f9e3d9af768587fc9a04f367e370450e8faae0f9e1fa3269417ef83475c62ed5fd9477da3a3f0518b699b35ad6edfb8044ef4f46fff3b43ee849b3fafa25c955c2a41a117a40f1be695c422454a63d34c733f69a8be106a29ae1b25d53472d0462ed303f2371d9ad0f4454176d6e03aafc48fb436669d66bfcc2aaa964253460196d90e17244d1ca474a7e46ffb3ce986afc3efeb76cc49f30816e6ec08a4bf3f48cab11f3c0c159624e8c3abe52b52f5e6816f0fb1bb1ce512ca5acb0a9503c2c79727397d5dd78ca9af8f301d60e380bda56548a65be07f02462f2662aa12ee06c66b2ef258b55c1e5f67d3d941d5d80b93e57a8d3e1dfff461432348068aab0ccde6d7828b2feb4d9eb5e3b2c6574823032133929be0ce570743da564f9f81c3d6057414a49ec472c1d5c28358ab180182ee1e4ec1d54e40350cf9259f0b2748f93dbb3c788313e5c3db0d059169f73314674eb80ca2251eb053f58a8c2e06fad328746b1fa8b17041d017fc57ff2949bb8dedb7a42138adbfc8d02f049e9b76055ff2b53e777253d5c13eecc746d0182a8e68ea4f8f6c4ba87ef70c525d4ca0df9ba4b0ece20cb8df147a667e0edbd0949c39c1deed896bdc0d0a9bed051729e06c75296cfe6249095f4067cc78f0a2a2d434762fa117dfad29fd5fbd5e51c562e237f9538204ffd1cc717e77c14e5dd6a283134c3ffb0028bf9b8e7137b49944ca8168f69485a3e457f80096bcb81d79f26e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b8552ff2b0781a1c48c48e1a8b0bfa06d6081e1e8ef0551f668b52a71119735ea1a3f5e6cee970c29382cdf1dd9a3dcd8fad2e3f5bd0ece8cacf6a6f95db1916152e02deec1f66de343d85ef80a325125f0e0f1dad2e55b81f82062f18e6ab4872051c3c8cd4d0b3e34d64e32f195e3425c1281078701cb33af80f25ab47d2b5a67aefba5d87025ccfec9c0d095f1408e7cea88e9137dfd7fd29bf41a80abbf114f5467cdc8cae5c6933537f50103017d1cc5b850a27f2f66ccc3f51952bc3066ce56007cb6231b1edca1bf63fa2796b5ea4900c6f2fecba4c01cfe80060beacebf31223e0bad90a10ffc1ee0cf2e4b3749509d1fc92f4bfa1df27065ebfa44d2a5e../selinux-policy-migrate-local-changes@.service@@@@@@rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootselinux-policy-3.13.1-166.el7.src.rpmconfig(selinux-policy-mls)selinux-policy-baseselinux-policy-mls@     /bin/bash/bin/sh/bin/shconfig(selinux-policy-mls)coreutilspolicycoreutilspolicycoreutils-newrolerpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)selinux-policyselinux-policysetransdrpmlib(PayloadIsXz)3.13.1-166.el72.52.53.0.4-14.6.0-14.0-13.13.1-166.el73.13.1-166.el75.2-1seedit4.11.3Ycl@YP@YJ_YI@YBvY9<@Y6@Y5GY1S@Y0Y.@Y-^Y, @Y, @Y%uYYY@Y@Y@Y.YXQ@XXX@X@X@XXX@XۡXP@XXg@Xg@X~@X@XƉXCXCXX @XXXBXXXs{@XY@XWXRXRXOXJXAb@X@X)@X#X!@XWWSW_@W_@Wv@W;W@WίWW:WQW@WW@W@WW~W@WW~D@W{@Ws@WrfWj}WbW^@WYZ@WYZ@WUeWM|WBW9@W9@W1@W(W V@V@V@V޾V2V@V_VVCV@VZV @VqV }@V }@VBUUU@U@UpUUUUoUoU5@UUȒ@UĝUUWUU@UUK@UUU'Ua@U~@UzUv@UT@U@Tr@T@T@T7TTTC@T@TTT}Tto@TsTk4T`T[bTWn@T?@T>aT6xT6xT@S@SSDSg}@SB@S>S;S:@S9XS5d@S4S2@S0@S,)S*@S)S)S&S&S"@S!S L@SSS@SSc@SSnS @S SK@RRR@RRJ@Ra@RRR&R&RRR=RʚRR@R@R@Rv@Rv@R@RR@R R@R@R|@Rz/@Rz/@RsRpRnQRi RfhR_@R_@R[R[RSRNRNRL RIgRB@RB@R:@R1R-@R-@R(r@R' R%@R7RRNRR@Q@QQdQQ@QQޞ@Q@QکQکQ@QzQQ4Q@@Q@QKQQ@Q@Q@Q@QQ@QQQQ@Q@QQQ@Qzl@Qw@QvwQo@Qo@QnQm=@QkQfQb@Q`@Q^QZ@QQQIQGQ@j@Q9Q8@Q4Q0@Q-@Q& @Q$QQ@QQ@Q @Qh@QsPP@P@PP@P[PP!@P8@PO@P @Pf@PPqP @PP7@P@PPPYP@P@PPPM@PPd@P@PoP{@P{@P@PP5@P@P~P}L@Px@PvPvPuc@Puc@Pr@Pmz@Pmz@Pmz@Pj@Pd?Pd?Pb@PaPaP[@PXb@PWPS@PQPO'PM@PIP@@P>@P8@P7lP2&P2&P,P,P*=P(@P#@P#@P!@P!@P@PkPw@Pw@PP

@NNU@NNl@N@N@NåN@NNNN@NNN@N@NGNGNGN@N@NNS@NS@N^N^N @N @NNj@Nj@NN$@NN@N/N@N@NFNFN@NNN@N@N@N]Ni@Ni@Ni@N|tNyNx@Ns:@NoENoENiNf @N^"@N\N[@NTNS@NS@NC@NBrN:N98@N7N6@N2N.@N*N)f@N(N%qN$ @N@N7@N e@NpNpM@M@Md@Md@MM{@M@M۝M@M@M‘@M@M@M@My@My@M3@M@M@MMM@MMMMTMx@Mx@Mv@MlMbSM[@MRMQ0@MQ0@MJMGMGMA^@M>@M9u@M6@M5M4/@M4/@M0:M,F@M$]@M@M9MMMMM\@M M M@L!L!L@LL@L@L@LOLOL[@L@L@Lr@L L,@L,@Lډ@L7LLLNL@LΫLeL|L@LB@LB@LB@L@LMLL@LdLL{L*@L@L5LLA@LLLL@LcL@L@L@LzL)@L|L|L|L{@LvW@LvW@Ls@Ls@LrbLrbLmLk@LjyLe3Lc@La?@LZLYV@LXLN@LN@LMxLMxLI@LH2LF@LEL=L=L=L;L7@L LT@L@LL@L@L0LLGL@K^K^KKKj@K$@KKK@K@KK@K]K޺K@KtK#@KKՀ@K:@KK͗@KŮ@K\K\K @KKKKK9@KK@KK@K@KKKKrKK~@K,K,K,K@KK8@KKK@KK@KqKqK}+K{@K{@KuBKs@KqN@KjKie@Kf@Ka|@K`*K]KXAKTM@KPXKEKEKEKD{@KC)KA@K;@K2@K0K/c@K+nK*@K(K"4@KK>K>K>JJęJH@JH@JJJ_@J@JjJjJ@Jv@Jv@Jv@Jv@J$J@JJ0@J@J@JG@JG@J@JJ@J@J@JJJ#J@JJJ@J:J@JJQJ@J J J|@JzJyt@Jyt@Jx"JrJrJq@Jn@Jn@JmJhPJeJ\s@JW-@JT@JS8JKOJI@JCfJCfJB@J@J@J?r@J<@J;}J:,@J7@J67J2C@J0J/@J,@J%@JJB@JJMJ J dJ@J@JJ@J*@J*@II@IIA@IIII@I@IIIX@IX@IX@II@I@IcIIo@Io@IzI)@I@IܑI@@II@I@I@IԨIд@I̿In@I3I3I@II@I@IV@IIaIIm@I@I'@II2III@IIIIIIII@III@I1I@III~@I}Iy@Ix_Iw@IuItk@Itk@Io%@Ik0IeIcGIa@I`IVIO@IJ;@IHIAI>]I= @I7@I6tI3I-I@III9@I9@II IP@I@IIg@Ig@HHH@HrH~@H,H@HCHHH @H @Hf@Hf@H@H+H@H׈H׈H7@HBH@HǶH@HH|@HHH@H{@H)HHL@H@H@H@HnH}H|@Ht@HsVHr@Hl@HkmHgy@HcH`H_@H^>HRa@HQHQHO@HFHFH$@DX@DU@DN@DN@DLDH@DGwDGwDDD@@D?D?D;@D;@D:HD:HD2_D1@D1@D-D+@D+@D'D!<@D!<@D!<@DDD@D@D@DDDDDD@D@D@D@D uD $@D D @D @DDDFC@C@C@C@CCCCCR@CCCCC@Ci@CC@C@CtC@C@CC:@CECCC @C @CعCعCعCعCC@C-C-C-C@C@CCǖ@C@CáCáCP@CP@C[C @C @CCg@Cg@CCC!@C~@C,C@CCCCC@CC@C@C@CZCZC @C @CCCf@Cf@Cf@CC@CqCqC @C @C @CCC}@C7@C7@C7@CBCBCYC@C@CC}@CqCqLukas Vrabec - 3.13.1-166Lukas Vrabec - 3.13.1-165Lukas Vrabec - 3.13.1-164Lukas Vrabec - 3.13.1-163Lukas Vrabec - 3.13.1-162Lukas Vrabec - 3.13.1-161Lukas Vrabec - 3.13.1-160Lukas Vrabec - 3.13.1-159Lukas Vrabec - 3.13.1-158Lukas Vrabec - 3.13.1-157Lukas Vrabec - 3.13.1-156Lukas Vrabec - 3.13.1-155Lukas Vrabec - 3.13.1-154Lukas Vrabec - 3.13.1-153Lukas Vrabec - 3.13.1-152Lukas Vrabec - 3.13.1-151Lukas Vrabec - 3.13.1-150Lukas Vrabec - 3.13.1-149Lukas Vrabec - 3.13.1-148Lukas Vrabec - 3.13.1-147Lukas Vrabec - 3.13.1-146Lukas Vrabec - 3.13.1-145Lukas Vrabec - 3.13.1-144Lukas Vrabec - 3.13.1-143Lukas Vrabec - 3.13.1-142Lukas Vrabec - 3.13.1-141Lukas Vrabec - 3.13.1-140Lukas Vrabec - 3.13.1-139Lukas Vrabec - 3.13.1-138Lukas Vrabec - 3.13.1-137Lukas Vrabec - 3.13.1-136Lukas Vrabec - 3.13.1-135Lukas Vrabec - 3.13.1-134Lukas Vrabec - 3.13.1-133Lukas Vrabec - 3.13.1-132Lukas Vrabec - 3.13.1-131Lukas Vrabec - 3.13.1-130Lukas Vrabec - 3.13.1-129Lukas Vrabec - 3.13.1-128Lukas Vrabec - 3.13.1-127Lukas Vrabec - 3.13.1-126Lukas Vrabec - 3.13.1-125Lukas Vrabec - 3.13.1-124Lukas Vrabec - 3.13.1-123Lukas Vrabec - 3.13.1-122Lukas Vrabec - 3.13.1-120Lukas Vrabec - 3.13.1-119Lukas Vrabec - 3.13.1-118Lukas Vrabec - 3.13.1-117Lukas Vrabec - 3.13.1-116Lukas Vrabec - 3.13.1-115Lukas Vrabec - 3.13.1-114Lukas Vrabec - 3.13.1-113Lukas Vrabec - 3.13.1-112Lukas Vrabec - 3.13.1-111Lukas Vrabec - 3.13.1-110Lukas Vrabec - 3.13.1-109Lukas Vrabec - 3.13.1-108Lukas Vrabec - 3.13.1-107Lukas Vrabec - 3.13.1-106Miroslav Grepl - 3.13.1-105Lukas Vrabec - 3.13.1-104Lukas Vrabec - 3.13.1-103Dan Walsh - 3.13.1-102Lukas Vrabec - 3.13.1-101Lukas Vrabec - 3.13.1-100Lukas Vrabec - 3.13.1-99Lukas Vrabec - 3.13.1-98Lukas Vrabec - 3.13.1-97Lukas Vrabec - 3.13.1-96Lukas Vrabec - 3.13.1-95Lukas Vrabec - 3.13.1-94Lukas Vrabec - 3.13.1-93Lukas Vrabec - 3.13.1-92Lukas Vrabec - 3.13.1-91Lukas Vrabec - 3.13.1-90Lukas Vrabec - 3.13.1-89Lukas Vrabec - 3.13.1-88Lukas Vrabec - 3.13.1-87Lukas Vrabec - 3.13.1-86Lukas Vrabec - 3.13.1-85Lukas Vrabec - 3.13.1-84Lukas Vrabec - 3.13.1-83Lukas Vrabec - 3.13.1-82Lukas Vrabec - 3.13.1-81Lukas Vrabec - 3.13.1-80Petr Lautrbach - 3.13.1-79Lukas Vrabec - 3.13.1-78Lukas Vrabec - 3.13.1-77Lukas Vrabec - 3.13.1-76Lukas Vrabec - 3.13.1-75Lukas Vrabec - 3.13.1-74Lukas Vrabec - 3.13.1-73Lukas Vrabec - 3.13.1-72Lukas Vrabec - 3.13.1-71Lukas Vrabec - 3.13.1-70Lukas Vrabec - 3.13.1-69Lukas Vrabec - 3.13.1-68Lukas Vrabec - 3.13.1-67Petr Lautrbach - 3.13.1-66Lukas Vrabec 3.13.1-65Lukas Vrabec 3.13.1-64Lukas Vrabec 3.13.1-63Lukas Vrabec 3.13.1-62Lukas Vrabec 3.13.1-61Miroslav Grepl 3.13.1-60Miroslav Grepl 3.13.1-59Lukas Vrabec 3.13.1-58Lukas Vrabec 3.13.1-57Miroslav Grepl 3.13.1-56Lukas Vrabec 3.13.1-55Lukas Vrabec 3.13.1-54Lukas Vrabec 3.13.1-53Lukas Vrabec 3.13.1-52Miroslav Grepl 3.13.1-51Lukas Vrabec 3.13.1-50Lukas Vrabec 3.13.1-49Lukas Vrabec 3.13.1-48Lukas Vrabec 3.13.1-47Lukas Vrabec 3.13.1-46Lukas Vrabec 3.13.1-45Lukas Vrabec 3.13.1-44Lukas Vrabec 3.13.1-43Lukas Vrabec 3.13.1-42Lukas Vrabec 3.13.1-41Lukas Vrabec 3.13.1-40Miroslav Grepl 3.13.1-39Lukas Vrabec 3.13.1-38Lukas Vrabec 3.13.1-37Lukas Vrabec 3.13.1-36Lukas Vrabec 3.13.1-35Lukas Vrabec 3.13.1-34Lukas Vrabec 3.13.1-33Lukas Vrabec 3.13.1-32Miroslav Grepl 3.13.1-31Miroslav Grepl 3.13.1-30Miroslav Grepl 3.13.1-29Miroslav Grepl 3.13.1-28Miroslav Grepl 3.13.1-27Miroslav Grepl 3.13.1-26Miroslav Grepl 3.13.1-25Miroslav Grepl 3.13.1-24Miroslav Grepl 3.13.1-23Miroslav Grepl 3.13.1-22Miroslav Grepl 3.13.1-21Miroslav Grepl 3.13.1-20Miroslav Grepl 3.13.1-19Miroslav Grepl 3.13.1-18Miroslav Grepl 3.13.1-17Miroslav Grepl 3.13.1-16Miroslav Grepl 3.13.1-15Miroslav Grepl 3.13.1-14Miroslav Grepl 3.13.1-13Miroslav Grepl 3.13.1-12Miroslav Grepl 3.13.1-11Miroslav Grepl 3.13.1-10Miroslav Grepl 3.13.1-9Miroslav Grepl 3.13.1-8Miroslav Grepl 3.13.1-7Miroslav Grepl 3.13.1-6Miroslav Grepl 3.13.1-5Miroslav Grepl 3.13.1-4Miroslav Grepl 3.13.1-3Miroslav Grepl 3.13.1-2Miroslav Grepl 3.13.1-1Miroslav Grepl 3.12.1-156Miroslav Grepl 3.12.1-155Miroslav Grepl 3.12.1-154Miroslav Grepl 3.12.1-153Miroslav Grepl 3.12.1-152Miroslav Grepl 3.12.1-151Miroslav Grepl 3.12.1-149Miroslav Grepl 3.12.1-149Miroslav Grepl 3.12.1-148Miroslav Grepl 3.12.1-147Miroslav Grepl 3.12.1-146Miroslav Grepl 3.12.1-145Miroslav Grepl 3.12.1-144Lukas Vrabec 3.12.1-143Miroslav Grepl 3.12.1-142Miroslav Grepl 3.12.1-141Miroslav Grepl 3.12.1-140Miroslav Grepl 3.12.1-139Lukas Vrabec 3.12.1-138Miroslav Grepl 3.12.1-137Miroslav Grepl 3.12.1-136Miroslav Grepl 3.12.1-135Miroslav Grepl 3.12.1-134Miroslav Grepl 3.12.1-133Miroslav Grepl 3.12.1-132Miroslav Grepl 3.12.1-131Miroslav Grepl 3.12.1-130Miroslav Grepl 3.12.1-129Miroslav Grepl 3.12.1-128Miroslav Grepl 3.12.1-127Miroslav Grepl 3.12.1-126Miroslav Grepl 3.12.1-125Miroslav Grepl 3.12.1-124Miroslav Grepl 3.12.1-123Miroslav Grepl 3.12.1-122Miroslav Grepl 3.12.1-121Miroslav Grepl 3.12.1-120Miroslav Grepl 3.12.1-119Miroslav Grepl 3.12.1-118Miroslav Grepl 3.12.1-117Miroslav Grepl 3.12.1-116Miroslav Grepl 3.12.1-115Miroslav Grepl 3.12.1-114Miroslav Grepl 3.12.1-113Miroslav Grepl 3.12.1-112Miroslav Grepl 3.12.1-111Miroslav Grepl 3.12.1-110Miroslav Grepl 3.12.1-109Miroslav Grepl 3.12.1-108Miroslav Grepl 3.12.1-107Dan Walsh 3.12.1-106Miroslav Grepl 3.12.1-105Miroslav Grepl 3.12.1-104Miroslav Grepl 3.12.1-103Miroslav Grepl 3.12.1-102Miroslav Grepl 3.12.1-101Miroslav Grepl 3.12.1-100Miroslav Grepl 3.12.1-99Miroslav Grepl 3.12.1-98Miroslav Grepl 3.12.1-97Miroslav Grepl 3.12.1-96Miroslav Grepl 3.12.1-95Miroslav Grepl 3.12.1-94Miroslav Grepl 3.12.1-94Miroslav Grepl 3.12.1-93Miroslav Grepl 3.12.1-92Miroslav Grepl 3.12.1-91Miroslav Grepl 3.12.1-90Miroslav Grepl 3.12.1-89Miroslav Grepl 3.12.1-88Miroslav Grepl 3.12.1-87Miroslav Grepl 3.12.1-86Miroslav Grepl 3.12.1-85Miroslav Grepl 3.12.1-84Miroslav Grepl 3.12.1-83Miroslav Grepl 3.12.1-82Miroslav Grepl 3.12.1-81Miroslav Grepl 3.12.1-80Miroslav Grepl 3.12.1-79Miroslav Grepl 3.12.1-78Miroslav Grepl 3.12.1-77Miroslav Grepl 3.12.1-76Miroslav Grepl 3.12.1-75Miroslav Grepl 3.12.1-74Miroslav Grepl 3.12.1-73Miroslav Grepl 3.12.1-72Miroslav Grepl 3.12.1-71Miroslav Grepl 3.12.1-70Miroslav Grepl 3.12.1-69Miroslav Grepl 3.12.1-68Miroslav Grepl 3.12.1-67Miroslav Grepl 3.12.1-66Miroslav Grepl 3.12.1-65Miroslav Grepl 3.12.1-64Miroslav Grepl 3.12.1-63Miroslav Grepl 3.12.1-62Miroslav Grepl 3.12.1-61Miroslav Grepl 3.12.1-60Miroslav Grepl 3.12.1-59Miroslav Grepl 3.12.1-58Miroslav Grepl 3.12.1-57Miroslav Grepl 3.12.1-56Miroslav Grepl 3.12.1-55Miroslav Grepl 3.12.1-54Miroslav Grepl 3.12.1-53Miroslav Grepl 3.12.1-52Miroslav Grepl 3.12.1-51Miroslav Grepl 3.12.1-50Miroslav Grepl 3.12.1-49Miroslav Grepl 3.12.1-48Miroslav Grepl 3.12.1-47Miroslav Grepl 3.12.1-46Miroslav Grepl 3.12.1-45Miroslav Grepl 3.12.1-44Miroslav Grepl 3.12.1-43Miroslav Grepl 3.12.1-42Miroslav Grepl 3.12.1-41Miroslav Grepl 3.12.1-40Miroslav Grepl 3.12.1-39Miroslav Grepl 3.12.1-38Miroslav Grepl 3.12.1-37Miroslav Grepl 3.12.1-36Miroslav Grepl 3.12.1-35Miroslav Grepl 3.12.1-34Miroslav Grepl 3.12.1-33Miroslav Grepl 3.12.1-32Miroslav Grepl 3.12.1-31Miroslav Grepl 3.12.1-30Miroslav Grepl 3.12.1-29Dan Walsh 3.12.1-28Dan Walsh 3.12.1-27Miroslav Grepl 3.12.1-26Miroslav Grepl 3.12.1-25Miroslav Grepl 3.12.1-24Miroslav Grepl 3.12.1-23Miroslav Grepl 3.12.1-22Miroslav Grepl 3.12.1-21Miroslav Grepl 3.12.1-20Miroslav Grepl 3.12.1-19Miroslav Grepl 3.12.1-18Miroslav Grepl 3.12.1-17Miroslav Grepl 3.12.1-16Miroslav Grepl 3.12.1-15Miroslav Grepl 3.12.1-14Miroslav Grepl 3.12.1-13Miroslav Grepl 3.12.1-12Miroslav Grepl 3.12.1-11Miroslav Grepl 3.12.1-10Miroslav Grepl 3.12.1-9Miroslav Grepl 3.12.1-8Miroslav Grepl 3.12.1-7Miroslav Grepl 3.12.1-6Miroslav Grepl 3.12.1-5Miroslav Grepl 3.12.1-4Miroslav Grepl 3.12.1-3Miroslav Grepl 3.12.1-2Miroslav Grepl 3.12.1-1Dan Walsh 3.11.1-69.1Miroslav Grepl 3.11.1-69Miroslav Grepl 3.11.1-68Miroslav Grepl 3.11.1-67Miroslav Grepl 3.11.1-66Miroslav Grepl 3.11.1-65Miroslav Grepl 3.11.1-64Miroslav Grepl 3.11.1-63Miroslav Grepl 3.11.1-62Miroslav Grepl 3.11.1-61Miroslav Grepl 3.11.1-60Miroslav Grepl 3.11.1-59Miroslav Grepl 3.11.1-58Miroslav Grepl 3.11.1-57Miroslav Grepl 3.11.1-56Miroslav Grepl 3.11.1-55Miroslav Grepl 3.11.1-54Miroslav Grepl 3.11.1-53Miroslav Grepl 3.11.1-52Miroslav Grepl 3.11.1-51Miroslav Grepl 3.11.1-50Miroslav Grepl 3.11.1-49Miroslav Grepl 3.11.1-48Miroslav Grepl 3.11.1-47Miroslav Grepl 3.11.1-46Miroslav Grepl 3.11.1-45Miroslav Grepl 3.11.1-44Miroslav Grepl 3.11.1-43Miroslav Grepl 3.11.1-42Miroslav Grepl 3.11.1-41Miroslav Grepl 3.11.1-40Miroslav Grepl 3.11.1-39Miroslav Grepl 3.11.1-38Miroslav Grepl 3.11.1-37Miroslav Grepl 3.11.1-36Miroslav Grepl 3.11.1-35Miroslav Grepl 3.11.1-34Miroslav Grepl 3.11.1-33Miroslav Grepl 3.11.1-32Miroslav Grepl 3.11.1-31Miroslav Grepl 3.11.1-30Miroslav Grepl 3.11.1-29Miroslav Grepl 3.11.1-28Miroslav Grepl 3.11.1-27Miroslav Grepl 3.11.1-26Miroslav Grepl 3.11.1-25Miroslav Grepl 3.11.1-24Miroslav Grepl 3.11.1-23Miroslav Grepl 3.11.1-22Miroslav Grepl 3.11.1-21Miroslav Grepl 3.11.1-20Miroslav Grepl 3.11.1-19Miroslav Grepl 3.11.1-18Miroslav Grepl 3.11.1-17Miroslav Grepl 3.11.1-16Dan Walsh 3.11.1-15Miroslav Grepl 3.11.1-14Dan Walsh 3.11.1-13Miroslav Grepl 3.11.1-12Miroslav Grepl 3.11.1-11Miroslav Grepl 3.11.1-10Dan Walsh 3.11.1-9Dan Walsh 3.11.1-8Dan Walsh 3.11.1-7Dan Walsh 3.11.1-6Miroslav Grepl 3.11.1-5Miroslav Grepl 3.11.1-4Miroslav Grepl 3.11.1-3Miroslav Grepl 3.11.1-2Miroslav Grepl 3.11.1-1Miroslav Grepl 3.11.1-0Miroslav Grepl 3.11.0-15Miroslav Grepl 3.11.0-14Miroslav Grepl 3.11.0-13Miroslav Grepl 3.11.0-12Fedora Release Engineering - 3.11.0-11Miroslav Grepl 3.11.0-10Miroslav Grepl 3.11.0-9Miroslav Grepl 3.11.0-8Miroslav Grepl 3.11.0-7Miroslav Grepl 3.11.0-6Miroslav Grepl 3.11.0-5Miroslav Grepl 3.11.0-4Miroslav Grepl 3.11.0-3Miroslav Grepl 3.11.0-2Miroslav Grepl 3.11.0-1Miroslav Grepl 3.10.0-128Miroslav Grepl 3.10.0-127Miroslav Grepl 3.10.0-126Miroslav Grepl 3.10.0-125Miroslav Grepl 3.10.0-124Miroslav Grepl 3.10.0-123Miroslav Grepl 3.10.0-122Miroslav Grepl 3.10.0-121Miroslav Grepl 3.10.0-120Miroslav Grepl 3.10.0-119Miroslav Grepl 3.10.0-118Miroslav Grepl 3.10.0-117Miroslav Grepl 3.10.0-116Miroslav Grepl 3.10.0-115Miroslav Grepl 3.10.0-114Miroslav Grepl 3.10.0-113Miroslav Grepl 3.10.0-112Miroslav Grepl 3.10.0-111Miroslav Grepl 3.10.0-110Miroslav Grepl 3.10.0-109Miroslav Grepl 3.10.0-108Miroslav Grepl 3.10.0-107Miroslav Grepl 3.10.0-106Miroslav Grepl 3.10.0-105Miroslav Grepl 3.10.0-104Miroslav Grepl 3.10.0-103Miroslav Grepl 3.10.0-102Miroslav Grepl 3.10.0-101Miroslav Grepl 3.10.0-100Miroslav Grepl 3.10.0-99Miroslav Grepl 3.10.0-98Miroslav Grepl 3.10.0-97Miroslav Grepl 3.10.0-96Miroslav Grepl 3.10.0-95Miroslav Grepl 3.10.0-94Miroslav Grepl 3.10.0-93Miroslav Grepl 3.10.0-92Miroslav Grepl 3.10.0-91Miroslav Grepl 3.10.0-90Miroslav Grepl 3.10.0-89Miroslav Grepl 3.10.0-88Miroslav Grepl 3.10.0-87Miroslav Grepl 3.10.0-86Miroslav Grepl 3.10.0-85Miroslav Grepl 3.10.0-84Miroslav Grepl 3.10.0-83Miroslav Grepl 3.10.0-82Dan Walsh 3.10.0-81.2Miroslav Grepl 3.10.0-81Miroslav Grepl 3.10.0-80Miroslav Grepl 3.10.0-79Miroslav Grepl 3.10.0-78Miroslav Grepl 3.10.0-77Miroslav Grepl 3.10.0-76Miroslav Grepl 3.10.0-75Dan Walsh 3.10.0-74.2Miroslav Grepl 3.10.0-74Miroslav Grepl 3.10.0-73Miroslav Grepl 3.10.0-72Miroslav Grepl 3.10.0-71Miroslav Grepl 3.10.0-70Miroslav Grepl 3.10.0-69Miroslav Grepl 3.10.0-68Miroslav Grepl 3.10.0-67Miroslav Grepl 3.10.0-66Miroslav Grepl 3.10.0-65Miroslav Grepl 3.10.0-64Miroslav Grepl 3.10.0-63Miroslav Grepl 3.10.0-59Miroslav Grepl 3.10.0-58Dan Walsh 3.10.0-57Dan Walsh 3.10.0-56Dan Walsh 3.10.0-55.2Dan Walsh 3.10.0-55.1Miroslav Grepl 3.10.0-55Dan Walsh 3.10.0-54.1Miroslav Grepl 3.10.0-54Dan Walsh 3.10.0-53.1Miroslav Grepl 3.10.0-53Miroslav Grepl 3.10.0-52Miroslav Grepl 3.10.0-51Dan Walsh 3.10.0-50.2Dan Walsh 3.10.0-50.1Miroslav Grepl 3.10.0-50Miroslav Grepl 3.10.0-49Miroslav Grepl 3.10.0-48Miroslav Grepl 3.10.0-47Dan Walsh 3.10.0-46.1Miroslav Grepl 3.10.0-46Dan Walsh 3.10.0-45.1Miroslav Grepl 3.10.0-45Miroslav Grepl 3.10.0-43Miroslav Grepl 3.10.0-42Miroslav Grepl 3.10.0-41Dan Walsh 3.10.0-40.2Miroslav Grepl 3.10.0-40Dan Walsh 3.10.0-39.3Dan Walsh 3.10.0-39.2Dan Walsh 3.10.0-39.1Miroslav Grepl 3.10.0-39Dan Walsh 3.10.0-38.1Miroslav Grepl 3.10.0-38Miroslav Grepl 3.10.0-37Dan Walsh 3.10.0-36.1Miroslav Grepl 3.10.0-36Dan Walsh 3.10.0-35Dan Walsh 3.10.0-34.7Dan Walsh 3.10.0-34.6Dan Walsh 3.10.0-34.4Miroslav Grepl 3.10.0-34.3Dan Walsh 3.10.0-34.2Dan Walsh 3.10.0-34.1Miroslav Grepl 3.10.0-34Miroslav Grepl 3.10.0-33Dan Walsh 3.10.0-31.1Miroslav Grepl 3.10.0-31Miroslav Grepl 3.10.0-29Miroslav Grepl 3.10.0-28Miroslav Grepl 3.10.0-27Miroslav Grepl 3.10.0-26Miroslav Grepl 3.10.0-25Miroslav Grepl 3.10.0-24Miroslav Grepl 3.10.0-23Miroslav Grepl 3.10.0-22Miroslav Grepl 3.10.0-21Dan Walsh 3.10.0-20Miroslav Grepl 3.10.0-19Miroslav Grepl 3.10.0-18Miroslav Grepl 3.10.0-17Miroslav Grepl 3.10.0-16Miroslav Grepl 3.10.0-14Miroslav Grepl 3.10.0-13Miroslav Grepl 3.10.0-12Miroslav Grepl 3.10.0-11Miroslav Grepl 3.10.0-10Miroslav Grepl 3.10.0-9Miroslav Grepl 3.10.0-8Miroslav Grepl 3.10.0-7Miroslav Grepl 3.10.0-6Miroslav Grepl 3.10.0-5Miroslav Grepl 3.10.0-4Miroslav Grepl 3.10.0-3Miroslav Grepl 3.10.0-2Miroslav Grepl 3.10.0-1Miroslav Grepl 3.9.16-30Dan Walsh 3.9.16-29.1Miroslav Grepl 3.9.16-29Dan Walsh 3.9.16-28.1Miroslav Grepl 3.9.16-27Miroslav Grepl 3.9.16-26Miroslav Grepl 3.9.16-25Miroslav Grepl 3.9.16-24Miroslav Grepl 3.9.16-23Miroslav Grepl 3.9.16-22Miroslav Grepl 3.9.16-21Miroslav Grepl 3.9.16-20Miroslav Grepl 3.9.16-19Miroslav Grepl 3.9.16-18Miroslav Grepl 3.9.16-17Dan Walsh 3.9.16-16.1Miroslav Grepl 3.9.16-16Miroslav Grepl 3.9.16-15Miroslav Grepl 3.9.16-14Miroslav Grepl 3.9.16-13Miroslav Grepl 3.9.16-12Miroslav Grepl 3.9.16-11Miroslav Grepl 3.9.16-10Miroslav Grepl 3.9.16-7Miroslav Grepl 3.9.16-6Miroslav Grepl 3.9.16-5Miroslav Grepl 3.9.16-4Miroslav Grepl 3.9.16-3Miroslav Grepl 3.9.16-2Miroslav Grepl 3.9.16-1Miroslav Grepl 3.9.15-5Miroslav Grepl 3.9.15-2Miroslav Grepl 3.9.15-1Fedora Release Engineering - 3.9.14-2Dan Walsh 3.9.14-1Miroslav Grepl 3.9.13-10Miroslav Grepl 3.9.13-9Dan Walsh 3.9.13-8Miroslav Grepl 3.9.13-7Miroslav Grepl 3.9.13-6Miroslav Grepl 3.9.13-5Miroslav Grepl 3.9.13-4Miroslav Grepl 3.9.13-3Miroslav Grepl 3.9.13-2Miroslav Grepl 3.9.13-1Miroslav Grepl 3.9.12-8Miroslav Grepl 3.9.12-7Miroslav Grepl 3.9.12-6Miroslav Grepl 3.9.12-5Dan Walsh 3.9.12-4Dan Walsh 3.9.12-3Dan Walsh 3.9.12-2Miroslav Grepl 3.9.12-1Dan Walsh 3.9.11-2Miroslav Grepl 3.9.11-1Miroslav Grepl 3.9.10-13Dan Walsh 3.9.10-12Miroslav Grepl 3.9.10-11Miroslav Grepl 3.9.10-10Miroslav Grepl 3.9.10-9Miroslav Grepl 3.9.10-8Miroslav Grepl 3.9.10-7Miroslav Grepl 3.9.10-6Miroslav Grepl 3.9.10-5Dan Walsh 3.9.10-4Miroslav Grepl 3.9.10-3Miroslav Grepl 3.9.10-2Miroslav Grepl 3.9.10-1Miroslav Grepl 3.9.9-4Dan Walsh 3.9.9-3Miroslav Grepl 3.9.9-2Miroslav Grepl 3.9.9-1Miroslav Grepl 3.9.8-7Dan Walsh 3.9.8-6Miroslav Grepl 3.9.8-5Miroslav Grepl 3.9.8-4Dan Walsh 3.9.8-3Dan Walsh 3.9.8-2Dan Walsh 3.9.8-1Dan Walsh 3.9.7-10Dan Walsh 3.9.7-9Dan Walsh 3.9.7-8Dan Walsh 3.9.7-7Dan Walsh 3.9.7-6Dan Walsh 3.9.7-5Dan Walsh 3.9.7-4Dan Walsh 3.9.7-3Dan Walsh 3.9.7-2Dan Walsh 3.9.7-1Dan Walsh 3.9.6-3Dan Walsh 3.9.6-2Dan Walsh 3.9.6-1Dan Walsh 3.9.5-11Dan Walsh 3.9.5-10Dan Walsh 3.9.5-9Dan Walsh 3.9.5-8Dan Walsh 3.9.5-7Dan Walsh 3.9.5-6Dan Walsh 3.9.5-5Dan Walsh 3.9.5-4Dan Walsh 3.9.5-3Dan Walsh 3.9.5-2Dan Walsh 3.9.5-1Dan Walsh 3.9.4-3Dan Walsh 3.9.4-2Dan Walsh 3.9.4-1Dan Walsh 3.9.3-4Dan Walsh 3.9.3-3Dan Walsh 3.9.3-2Dan Walsh 3.9.3-1Dan Walsh 3.9.2-1Dan Walsh 3.9.1-3Dan Walsh 3.9.1-2Dan Walsh 3.9.1-1Dan Walsh 3.9.0-2Dan Walsh 3.9.0-1Dan Walsh 3.8.8-21Dan Walsh 3.8.8-20Dan Walsh 3.8.8-19Dan Walsh 3.8.8-18Dan Walsh 3.8.8-17Dan Walsh 3.8.8-16Dan Walsh 3.8.8-15Dan Walsh 3.8.8-14Dan Walsh 3.8.8-13Dan Walsh 3.8.8-12Dan Walsh 3.8.8-11Dan Walsh 3.8.8-10Dan Walsh 3.8.8-9Dan Walsh 3.8.8-8Dan Walsh 3.8.8-7Dan Walsh 3.8.8-6Dan Walsh 3.8.8-5Dan Walsh 3.8.8-4Dan Walsh 3.8.8-3Dan Walsh 3.8.8-2Dan Walsh 3.8.8-1Dan Walsh 3.8.7-3Dan Walsh 3.8.7-2Dan Walsh 3.8.7-1Dan Walsh 3.8.6-3Miroslav Grepl 3.8.6-2Dan Walsh 3.8.6-1Dan Walsh 3.8.5-1Dan Walsh 3.8.4-1Dan Walsh 3.8.3-4Dan Walsh 3.8.3-3Dan Walsh 3.8.3-2Dan Walsh 3.8.3-1Dan Walsh 3.8.2-1Dan Walsh 3.8.1-5Dan Walsh 3.8.1-4Dan Walsh 3.8.1-3Dan Walsh 3.8.1-2Dan Walsh 3.8.1-1Dan Walsh 3.7.19-22Dan Walsh 3.7.19-21Dan Walsh 3.7.19-20Dan Walsh 3.7.19-19Dan Walsh 3.7.19-17Dan Walsh 3.7.19-16Dan Walsh 3.7.19-15Dan Walsh 3.7.19-14Dan Walsh 3.7.19-13Dan Walsh 3.7.19-12Dan Walsh 3.7.19-11Dan Walsh 3.7.19-10Dan Walsh 3.7.19-9Dan Walsh 3.7.19-8Dan Walsh 3.7.19-7Dan Walsh 3.7.19-6Dan Walsh 3.7.19-5Dan Walsh 3.7.19-4Dan Walsh 3.7.19-3Dan Walsh 3.7.19-2Dan Walsh 3.7.19-1Dan Walsh 3.7.18-3Dan Walsh 3.7.18-2Dan Walsh 3.7.18-1Dan Walsh 3.7.17-6Dan Walsh 3.7.17-5Dan Walsh 3.7.17-4Dan Walsh 3.7.17-3Dan Walsh 3.7.17-2Dan Walsh 3.7.17-1Dan Walsh 3.7.16-2Dan Walsh 3.7.16-1Dan Walsh 3.7.15-4Dan Walsh 3.7.15-3Dan Walsh 3.7.15-2Dan Walsh 3.7.15-1Dan Walsh 3.7.14-5Dan Walsh 3.7.14-4Dan Walsh 3.7.14-3Dan Walsh 3.7.14-2Dan Walsh 3.7.14-1Dan Walsh 3.7.13-4Dan Walsh 3.7.13-3Dan Walsh 3.7.13-2Dan Walsh 3.7.13-1Dan Walsh 3.7.12-1Dan Walsh 3.7.11-1Dan Walsh 3.7.10-5Dan Walsh 3.7.10-4Dan Walsh 3.7.10-3Dan Walsh 3.7.10-2Dan Walsh 3.7.10-1Dan Walsh 3.7.9-4Dan Walsh 3.7.9-3Dan Walsh 3.7.9-2Dan Walsh 3.7.9-1Dan Walsh 3.7.8-11Dan Walsh 3.7.8-9Dan Walsh 3.7.8-8Dan Walsh 3.7.8-7Dan Walsh 3.7.8-6Dan Walsh 3.7.8-5Dan Walsh 3.7.8-4Dan Walsh 3.7.8-3Dan Walsh 3.7.8-2Dan Walsh 3.7.8-1Dan Walsh 3.7.7-3Dan Walsh 3.7.7-2Dan Walsh 3.7.7-1Dan Walsh 3.7.6-1Dan Walsh 3.7.5-8Dan Walsh 3.7.5-7Dan Walsh 3.7.5-6Dan Walsh 3.7.5-5Dan Walsh 3.7.5-4Dan Walsh 3.7.5-3Dan Walsh 3.7.5-2Dan Walsh 3.7.5-1Dan Walsh 3.7.4-4Dan Walsh 3.7.4-3Dan Walsh 3.7.4-2Dan Walsh 3.7.4-1Dan Walsh 3.7.3-1Dan Walsh 3.7.1-1Dan Walsh 3.6.33-2Dan Walsh 3.6.33-1Dan Walsh 3.6.32-17Dan Walsh 3.6.32-16Dan Walsh 3.6.32-15Dan Walsh 3.6.32-13Dan Walsh 3.6.32-12Dan Walsh 3.6.32-11Dan Walsh 3.6.32-10Dan Walsh 3.6.32-9Dan Walsh 3.6.32-8Dan Walsh 3.6.32-7Dan Walsh 3.6.32-6Dan Walsh 3.6.32-5Dan Walsh 3.6.32-4Dan Walsh 3.6.32-3Dan Walsh 3.6.32-2Dan Walsh 3.6.32-1Dan Walsh 3.6.31-5Dan Walsh 3.6.31-4Dan Walsh 3.6.31-3Dan Walsh 3.6.31-2Dan Walsh 3.6.30-6Dan Walsh 3.6.30-5Dan Walsh 3.6.30-4Dan Walsh 3.6.30-3Dan Walsh 3.6.30-2Dan Walsh 3.6.30-1Dan Walsh 3.6.29-2Dan Walsh 3.6.29-1Dan Walsh 3.6.28-9Dan Walsh 3.6.28-8Dan Walsh 3.6.28-7Dan Walsh 3.6.28-6Dan Walsh 3.6.28-5Dan Walsh 3.6.28-4Dan Walsh 3.6.28-3Dan Walsh 3.6.28-2Dan Walsh 3.6.28-1Dan Walsh 3.6.27-1Dan Walsh 3.6.26-11Dan Walsh 3.6.26-10Dan Walsh 3.6.26-9Bill Nottingham 3.6.26-8Dan Walsh 3.6.26-7Dan Walsh 3.6.26-6Dan Walsh 3.6.26-5Dan Walsh 3.6.26-4Dan Walsh 3.6.26-3Dan Walsh 3.6.26-2Dan Walsh 3.6.26-1Dan Walsh 3.6.25-1Dan Walsh 3.6.24-1Dan Walsh 3.6.23-2Dan Walsh 3.6.23-1Dan Walsh 3.6.22-3Dan Walsh 3.6.22-1Dan Walsh 3.6.21-4Dan Walsh 3.6.21-3Tom "spot" Callaway 3.6.21-2Dan Walsh 3.6.21-1Dan Walsh 3.6.20-2Dan Walsh 3.6.20-1Dan Walsh 3.6.19-5Dan Walsh 3.6.19-4Dan Walsh 3.6.19-3Dan Walsh 3.6.19-2Dan Walsh 3.6.19-1Dan Walsh 3.6.18-1Dan Walsh 3.6.17-1Dan Walsh 3.6.16-4Dan Walsh 3.6.16-3Dan Walsh 3.6.16-2Dan Walsh 3.6.16-1Dan Walsh 3.6.14-3Dan Walsh 3.6.14-2Dan Walsh 3.6.14-1Dan Walsh 3.6.13-3Dan Walsh 3.6.13-2Dan Walsh 3.6.13-1Dan Walsh 3.6.12-39Dan Walsh 3.6.12-38Dan Walsh 3.6.12-37Dan Walsh 3.6.12-36Dan Walsh 3.6.12-35Dan Walsh 3.6.12-34Dan Walsh 3.6.12-33Dan Walsh 3.6.12-31Dan Walsh 3.6.12-30Dan Walsh 3.6.12-29Dan Walsh 3.6.12-28Dan Walsh 3.6.12-27Dan Walsh 3.6.12-26Dan Walsh 3.6.12-25Dan Walsh 3.6.12-24Dan Walsh 3.6.12-23Dan Walsh 3.6.12-22Dan Walsh 3.6.12-21Dan Walsh 3.6.12-20Dan Walsh 3.6.12-19Dan Walsh 3.6.12-16Dan Walsh 3.6.12-15Dan Walsh 3.6.12-14Dan Walsh 3.6.12-13Dan Walsh 3.6.12-12Dan Walsh 3.6.12-11Dan Walsh 3.6.12-10Dan Walsh 3.6.12-9Dan Walsh 3.6.12-8Dan Walsh 3.6.12-7Dan Walsh 3.6.12-6Dan Walsh 3.6.12-5Dan Walsh 3.6.12-4Dan Walsh 3.6.12-3Dan Walsh 3.6.12-2Dan Walsh 3.6.12-1Dan Walsh 3.6.11-1Dan Walsh 3.6.10-9Dan Walsh 3.6.10-8Dan Walsh 3.6.10-7Dan Walsh 3.6.10-6Dan Walsh 3.6.10-5Dan Walsh 3.6.10-4Dan Walsh 3.6.10-3Dan Walsh 3.6.10-2Dan Walsh 3.6.10-1Dan Walsh 3.6.9-4Dan Walsh 3.6.9-3Dan Walsh 3.6.9-2Dan Walsh 3.6.9-1Dan Walsh 3.6.8-4Dan Walsh 3.6.8-3Dan Walsh 3.6.8-2Dan Walsh 3.6.8-1Dan Walsh 3.6.7-2Dan Walsh 3.6.7-1Dan Walsh 3.6.6-9Dan Walsh 3.6.6-8Fedora Release Engineering - 3.6.6-7Dan Walsh 3.6.6-6Dan Walsh 3.6.6-5Dan Walsh 3.6.6-4Dan Walsh 3.6.6-3Dan Walsh 3.6.6-2Dan Walsh 3.6.6-1Dan Walsh 3.6.5-3Dan Walsh 3.6.5-1Dan Walsh 3.6.4-6Dan Walsh 3.6.4-5Dan Walsh 3.6.4-4Dan Walsh 3.6.4-3Dan Walsh 3.6.4-2Dan Walsh 3.6.4-1Dan Walsh 3.6.3-13Dan Walsh 3.6.3-12Dan Walsh 3.6.3-11Dan Walsh 3.6.3-10Dan Walsh 3.6.3-9Dan Walsh 3.6.3-8Dan Walsh 3.6.3-7Dan Walsh 3.6.3-6Dan Walsh 3.6.3-3Dan Walsh 3.6.3-2Dan Walsh 3.6.3-1Dan Walsh 3.6.2-5Dan Walsh 3.6.2-4Dan Walsh 3.6.2-3Dan Walsh 3.6.2-2Dan Walsh 3.6.2-1Dan Walsh 3.6.1-15Dan Walsh 3.6.1-14Dan Walsh 3.6.1-13Dan Walsh 3.6.1-12Dan Walsh 3.6.1-11Dan Walsh 3.6.1-10Dan Walsh 3.6.1-9Dan Walsh 3.6.1-8Dan Walsh 3.6.1-7Dan Walsh 3.6.1-4Ignacio Vazquez-Abrams - 3.6.1-2Dan Walsh 3.5.13-19Dan Walsh 3.5.13-18Dan Walsh 3.5.13-17Dan Walsh 3.5.13-16Dan Walsh 3.5.13-15Dan Walsh 3.5.13-14Dan Walsh 3.5.13-13Dan Walsh 3.5.13-12Dan Walsh 3.5.13-11Dan Walsh 3.5.13-9Dan Walsh 3.5.13-8Dan Walsh 3.5.13-7Dan Walsh 3.5.13-6Dan Walsh 3.5.13-5Dan Walsh 3.5.13-4Dan Walsh 3.5.13-3Dan Walsh 3.5.13-2Dan Walsh 3.5.13-1Dan Walsh 3.5.12-3Dan Walsh 3.5.12-2Dan Walsh 3.5.12-1Dan Walsh 3.5.11-1Dan Walsh 3.5.10-3Dan Walsh 3.5.10-2Dan Walsh 3.5.10-1Dan Walsh 3.5.9-4Dan Walsh 3.5.9-3Dan Walsh 3.5.9-2Dan Walsh 3.5.9-1Dan Walsh 3.5.8-7Dan Walsh 3.5.8-6Dan Walsh 3.5.8-5Dan Walsh 3.5.8-4Dan Walsh 3.5.8-3Dan Walsh 3.5.8-1Dan Walsh 3.5.7-2Dan Walsh 3.5.7-1Dan Walsh 3.5.6-2Dan Walsh 3.5.6-1Dan Walsh 3.5.5-4Dan Walsh 3.5.5-3Dan Walsh 3.5.5-2Dan Walsh 3.5.4-2Dan Walsh 3.5.4-1Dan Walsh 3.5.3-1Dan Walsh 3.5.2-2Dan Walsh 3.5.1-5Dan Walsh 3.5.1-4Dan Walsh 3.5.1-3Dan Walsh 3.5.1-2Dan Walsh 3.5.1-1Dan Walsh 3.5.0-1Dan Walsh 3.4.2-14Dan Walsh 3.4.2-13Dan Walsh 3.4.2-12Dan Walsh 3.4.2-11Dan Walsh 3.4.2-10Dan Walsh 3.4.2-9Dan Walsh 3.4.2-8Dan Walsh 3.4.2-7Dan Walsh 3.4.2-6Dan Walsh 3.4.2-5Dan Walsh 3.4.2-4Dan Walsh 3.4.2-3Dan Walsh 3.4.2-2Dan Walsh 3.4.2-1Dan Walsh 3.4.1-5Dan Walsh 3.4.1-3Dan Walsh 3.4.1-2Dan Walsh 3.4.1-1Dan Walsh 3.3.1-48Dan Walsh 3.3.1-47Dan Walsh 3.3.1-46Dan Walsh 3.3.1-45Dan Walsh 3.3.1-44Dan Walsh 3.3.1-43Dan Walsh 3.3.1-42Dan Walsh 3.3.1-41Dan Walsh 3.3.1-39Dan Walsh 3.3.1-37Dan Walsh 3.3.1-36Dan Walsh 3.3.1-33Dan Walsh 3.3.1-32Dan Walsh 3.3.1-31Dan Walsh 3.3.1-30Dan Walsh 3.3.1-29Dan Walsh 3.3.1-28Dan Walsh 3.3.1-27Dan Walsh 3.3.1-26Dan Walsh 3.3.1-25Dan Walsh 3.3.1-24Dan Walsh 3.3.1-23Dan Walsh 3.3.1-22Dan Walsh 3.3.1-21Dan Walsh 3.3.1-20Dan Walsh 3.3.1-19Dan Walsh 3.3.1-18Dan Walsh 3.3.1-17Dan Walsh 3.3.1-16Dan Walsh 3.3.1-15Bill Nottingham 3.3.1-14Dan Walsh 3.3.1-13Dan Walsh 3.3.1-12Dan Walsh 3.3.1-11Dan Walsh 3.3.1-10Dan Walsh 3.3.1-9Dan Walsh 3.3.1-8Dan Walsh 3.3.1-6Dan Walsh 3.3.1-5Dan Walsh 3.3.1-4Dan Walsh 3.3.1-2Dan Walsh 3.3.1-1Dan Walsh 3.3.0-2Dan Walsh 3.3.0-1Dan Walsh 3.2.9-2Dan Walsh 3.2.9-1Dan Walsh 3.2.8-2Dan Walsh 3.2.8-1Dan Walsh 3.2.7-6Dan Walsh 3.2.7-5Dan Walsh 3.2.7-3Dan Walsh 3.2.7-2Dan Walsh 3.2.7-1Dan Walsh 3.2.6-7Dan Walsh 3.2.6-6Dan Walsh 3.2.6-5Dan Walsh 3.2.6-4Dan Walsh 3.2.6-3Dan Walsh 3.2.6-2Dan Walsh 3.2.6-1Dan Walsh 3.2.5-25Dan Walsh 3.2.5-24Dan Walsh 3.2.5-22Dan Walsh 3.2.5-21Dan Walsh 3.2.5-20Dan Walsh 3.2.5-19Dan Walsh 3.2.5-18Dan Walsh 3.2.5-17Dan Walsh 3.2.5-16Dan Walsh 3.2.5-15Dan Walsh 3.2.5-14Dan Walsh 3.2.5-13Dan Walsh 3.2.5-12Dan Walsh 3.2.5-11Dan Walsh 3.2.5-10Dan Walsh 3.2.5-9Dan Walsh 3.2.5-8Dan Walsh 3.2.5-7Dan Walsh 3.2.5-6Dan Walsh 3.2.5-5Dan Walsh 3.2.5-4Dan Walsh 3.2.5-3Dan Walsh 3.2.5-2Dan Walsh 3.2.5-1Dan Walsh 3.2.4-5Dan Walsh 3.2.4-4Dan Walsh 3.2.4-3Dan Walsh 3.2.4-1Dan Walsh 3.2.4-1Dan Walsh 3.2.3-2Dan Walsh 3.2.3-1Dan Walsh 3.2.2-1Dan Walsh 3.2.1-3Dan Walsh 3.2.1-1Dan Walsh 3.1.2-2Dan Walsh 3.1.2-1Dan Walsh 3.1.1-1Dan Walsh 3.1.0-1Dan Walsh 3.0.8-30Dan Walsh 3.0.8-28Dan Walsh 3.0.8-27Dan Walsh 3.0.8-26Dan Walsh 3.0.8-25Dan Walsh 3.0.8-24Dan Walsh 3.0.8-23Dan Walsh 3.0.8-22Dan Walsh 3.0.8-21Dan Walsh 3.0.8-20Dan Walsh 3.0.8-19Dan Walsh 3.0.8-18Dan Walsh 3.0.8-17Dan Walsh 3.0.8-16Dan Walsh 3.0.8-15Dan Walsh 3.0.8-14Dan Walsh 3.0.8-13Dan Walsh 3.0.8-12Dan Walsh 3.0.8-11Dan Walsh 3.0.8-10Dan Walsh 3.0.8-9Dan Walsh 3.0.8-8Dan Walsh 3.0.8-7Dan Walsh 3.0.8-5Dan Walsh 3.0.8-4Dan Walsh 3.0.8-3Dan Walsh 3.0.8-2Dan Walsh 3.0.8-1Dan Walsh 3.0.7-10Dan Walsh 3.0.7-9Dan Walsh 3.0.7-8Dan Walsh 3.0.7-7Dan Walsh 3.0.7-6Dan Walsh 3.0.7-5Dan Walsh 3.0.7-4Dan Walsh 3.0.7-3Dan Walsh 3.0.7-2Dan Walsh 3.0.7-1Dan Walsh 3.0.6-3Dan Walsh 3.0.6-2Dan Walsh 3.0.6-1Dan Walsh 3.0.5-11Dan Walsh 3.0.5-10Dan Walsh 3.0.5-9Dan Walsh 3.0.5-8Dan Walsh 3.0.5-7Dan Walsh 3.0.5-6Dan Walsh 3.0.5-5Dan Walsh 3.0.5-4Dan Walsh 3.0.5-3Dan Walsh 3.0.5-2Dan Walsh 3.0.5-1Dan Walsh 3.0.4-6Dan Walsh 3.0.4-5Dan Walsh 3.0.4-4Dan Walsh 3.0.4-3Dan Walsh 3.0.4-2Dan Walsh 3.0.4-1Dan Walsh 3.0.3-6Dan Walsh 3.0.3-5Dan Walsh 3.0.3-4Dan Walsh 3.0.3-3Dan Walsh 3.0.3-2Dan Walsh 3.0.3-1Dan Walsh 3.0.2-9Dan Walsh 3.0.2-8Dan Walsh 3.0.2-7Dan Walsh 3.0.2-5Dan Walsh 3.0.2-4Dan Walsh 3.0.2-3Dan Walsh 3.0.2-2Dan Walsh 3.0.1-5Dan Walsh 3.0.1-4Dan Walsh 3.0.1-3Dan Walsh 3.0.1-2Dan Walsh 3.0.1-1Dan Walsh 2.6.5-3Dan Walsh 2.6.5-2Dan Walsh 2.6.4-7Dan Walsh 2.6.4-6Dan Walsh 2.6.4-5Dan Walsh 2.6.4-2Dan Walsh 2.6.4-1Dan Walsh 2.6.3-1Dan Walsh 2.6.2-1Dan Walsh 2.6.1-4Dan Walsh 2.6.1-2Dan Walsh 2.6.1-1Dan Walsh 2.5.12-12Dan Walsh 2.5.12-11Dan Walsh 2.5.12-10Dan Walsh 2.5.12-8Dan Walsh 2.5.12-5Dan Walsh 2.5.12-4Dan Walsh 2.5.12-3Dan Walsh 2.5.12-2Dan Walsh 2.5.12-1Dan Walsh 2.5.11-8Dan Walsh 2.5.11-7Dan Walsh 2.5.11-6Dan Walsh 2.5.11-5Dan Walsh 2.5.11-4Dan Walsh 2.5.11-3Dan Walsh 2.5.11-2Dan Walsh 2.5.11-1Dan Walsh 2.5.10-2Dan Walsh 2.5.10-1Dan Walsh 2.5.9-6Dan Walsh 2.5.9-5Dan Walsh 2.5.9-4Dan Walsh 2.5.9-3Dan Walsh 2.5.9-2Dan Walsh 2.5.8-8Dan Walsh 2.5.8-7Dan Walsh 2.5.8-6Dan Walsh 2.5.8-5Dan Walsh 2.5.8-4Dan Walsh 2.5.8-3Dan Walsh 2.5.8-2Dan Walsh 2.5.8-1Dan Walsh 2.5.7-1Dan Walsh 2.5.6-1Dan Walsh 2.5.5-2Dan Walsh 2.5.5-1Dan Walsh 2.5.4-2Dan Walsh 2.5.4-1Dan Walsh 2.5.3-3Dan Walsh 2.5.3-2Dan Walsh 2.5.3-1Dan Walsh 2.5.2-6Dan Walsh 2.5.2-5Dan Walsh 2.5.2-4Dan Walsh 2.5.2-3Dan Walsh 2.5.2-2Dan Walsh 2.5.2-1Dan Walsh 2.5.1-5Dan Walsh 2.5.1-4Dan Walsh 2.5.1-2Dan Walsh 2.5.1-1Dan Walsh 2.4.6-20Dan Walsh 2.4.6-19Dan Walsh 2.4.6-18Dan Walsh 2.4.6-17Dan Walsh 2.4.6-16Dan Walsh 2.4.6-15Dan Walsh 2.4.6-14Dan Walsh 2.4.6-13Dan Walsh 2.4.6-12Dan Walsh 2.4.6-11Dan Walsh 2.4.6-10Dan Walsh 2.4.6-9Dan Walsh 2.4.6-8Dan Walsh 2.4.6-7Dan Walsh 2.4.6-6Dan Walsh 2.4.6-5Dan Walsh 2.4.6-4Dan Walsh 2.4.6-3Dan Walsh 2.4.6-1Dan Walsh 2.4.5-4Dan Walsh 2.4.5-3Dan Walsh 2.4.5-2Dan Walsh 2.4.5-1Dan Walsh 2.4.4-2Dan Walsh 2.4.4-2Dan Walsh 2.4.4-1Dan Walsh 2.4.3-13Dan Walsh 2.4.3-12Dan Walsh 2.4.3-11Dan Walsh 2.4.3-10Dan Walsh 2.4.3-9Dan Walsh 2.4.3-8Dan Walsh 2.4.3-7Dan Walsh 2.4.3-6Dan Walsh 2.4.3-5Dan Walsh 2.4.3-4Dan Walsh 2.4.3-3Dan Walsh 2.4.3-2Dan Walsh 2.4.3-1Dan Walsh 2.4.2-8Dan Walsh 2.4.2-7James Antill 2.4.2-6Dan Walsh 2.4.2-5Dan Walsh 2.4.2-4Dan Walsh 2.4.2-3Dan Walsh 2.4.2-2Dan Walsh 2.4.2-1Dan Walsh 2.4.1-5Dan Walsh 2.4.1-4Dan Walsh 2.4.1-3Dan Walsh 2.4.1-2Dan Walsh 2.4-4Dan Walsh 2.4-3Dan Walsh 2.4-2Dan Walsh 2.4-1Dan Walsh 2.3.19-4Dan Walsh 2.3.19-3Dan Walsh 2.3.19-2Dan Walsh 2.3.19-1James Antill 2.3.18-10James Antill 2.3.18-9Dan Walsh 2.3.18-8Dan Walsh 2.3.18-7Dan Walsh 2.3.18-6Dan Walsh 2.3.18-5Dan Walsh 2.3.18-4Dan Walsh 2.3.18-3Dan Walsh 2.3.18-2Dan Walsh 2.3.18-1Dan Walsh 2.3.17-2Dan Walsh 2.3.17-1Dan Walsh 2.3.16-9Dan Walsh 2.3.16-8Dan Walsh 2.3.16-7Dan Walsh 2.3.16-6Dan Walsh 2.3.16-5Dan Walsh 2.3.16-4Dan Walsh 2.3.16-2Dan Walsh 2.3.16-1Dan Walsh 2.3.15-2Dan Walsh 2.3.15-1Dan Walsh 2.3.14-8Dan Walsh 2.3.14-7Dan Walsh 2.3.14-6Dan Walsh 2.3.14-4Dan Walsh 2.3.14-3Dan Walsh 2.3.14-2Dan Walsh 2.3.14-1Dan Walsh 2.3.13-6Dan Walsh 2.3.13-5Dan Walsh 2.3.13-4Dan Walsh 2.3.13-3Dan Walsh 2.3.13-2Dan Walsh 2.3.13-1Dan Walsh 2.3.12-2Dan Walsh 2.3.12-1Dan Walsh 2.3.11-1Dan Walsh 2.3.10-7Dan Walsh 2.3.10-6Dan Walsh 2.3.10-3Dan Walsh 2.3.10-1Dan Walsh 2.3.9-6Dan Walsh 2.3.9-5Dan Walsh 2.3.9-4Dan Walsh 2.3.9-3Dan Walsh 2.3.9-2Dan Walsh 2.3.9-1Dan Walsh 2.3.8-2Dan Walsh 2.3.7-1Dan Walsh 2.3.6-4Dan Walsh 2.3.6-3Dan Walsh 2.3.6-2Dan Walsh 2.3.6-1Dan Walsh 2.3.5-1Dan Walsh 2.3.4-1Dan Walsh 2.3.3-20Dan Walsh 2.3.3-19Dan Walsh 2.3.3-18Dan Walsh 2.3.3-17Dan Walsh 2.3.3-16Dan Walsh 2.3.3-15Dan Walsh 2.3.3-14Dan Walsh 2.3.3-13Dan Walsh 2.3.3-12Dan Walsh 2.3.3-11Dan Walsh 2.3.3-10Dan Walsh 2.3.3-9Dan Walsh 2.3.3-8Dan Walsh 2.3.3-7Dan Walsh 2.3.3-6Dan Walsh 2.3.3-5Dan Walsh 2.3.3-4Dan Walsh 2.3.3-3Dan Walsh 2.3.3-2Dan Walsh 2.3.3-1Dan Walsh 2.3.2-4Dan Walsh 2.3.2-3Dan Walsh 2.3.2-2Dan Walsh 2.3.2-1Dan Walsh 2.3.1-1Dan Walsh 2.2.49-1Dan Walsh 2.2.48-1Dan Walsh 2.2.47-5Dan Walsh 2.2.47-4Dan Walsh 2.2.47-3Dan Walsh 2.2.47-1Dan Walsh 2.2.46-2Dan Walsh 2.2.46-1Dan Walsh 2.2.45-3Dan Walsh 2.2.45-2Dan Walsh 2.2.45-1Dan Walsh 2.2.44-1Dan Walsh 2.2.43-4Dan Walsh 2.2.43-3Dan Walsh 2.2.43-2Dan Walsh 2.2.43-1Dan Walsh 2.2.42-4Dan Walsh 2.2.42-3Dan Walsh 2.2.42-2Dan Walsh 2.2.42-1Dan Walsh 2.2.41-1Dan Walsh 2.2.40-2Dan Walsh 2.2.40-1Dan Walsh 2.2.39-2Dan Walsh 2.2.39-1Dan Walsh 2.2.38-6Dan Walsh 2.2.38-5Dan Walsh 2.2.38-4Dan Walsh 2.2.38-3Dan Walsh 2.2.38-2Dan Walsh 2.2.38-1Dan Walsh 2.2.37-1Dan Walsh 2.2.36-2Dan Walsh 2.2.36-1James Antill 2.2.35-2Dan Walsh 2.2.35-1Dan Walsh 2.2.34-3Dan Walsh 2.2.34-2Dan Walsh 2.2.34-1Dan Walsh 2.2.33-1Dan Walsh 2.2.32-2Dan Walsh 2.2.32-1Dan Walsh 2.2.31-1Dan Walsh 2.2.30-2Dan Walsh 2.2.30-1Dan Walsh 2.2.29-6Russell Coker 2.2.29-5Dan Walsh 2.2.29-4Dan Walsh 2.2.29-3Dan Walsh 2.2.29-2Dan Walsh 2.2.29-1Dan Walsh 2.2.28-3Dan Walsh 2.2.28-2Dan Walsh 2.2.28-1Dan Walsh 2.2.27-1Dan Walsh 2.2.25-3Dan Walsh 2.2.25-2Dan Walsh 2.2.24-1Dan Walsh 2.2.23-19Dan Walsh 2.2.23-18Dan Walsh 2.2.23-17Karsten Hopp 2.2.23-16Dan Walsh 2.2.23-15Dan Walsh 2.2.23-14Dan Walsh 2.2.23-13Dan Walsh 2.2.23-12Jeremy Katz - 2.2.23-11Jeremy Katz - 2.2.23-10Dan Walsh 2.2.23-9Dan Walsh 2.2.23-8Dan Walsh 2.2.23-7Dan Walsh 2.2.23-5Dan Walsh 2.2.23-4Dan Walsh 2.2.23-3Dan Walsh 2.2.23-2Dan Walsh 2.2.23-1Dan Walsh 2.2.22-2Dan Walsh 2.2.22-1Dan Walsh 2.2.21-9Dan Walsh 2.2.21-8Dan Walsh 2.2.21-7Dan Walsh 2.2.21-6Dan Walsh 2.2.21-5Dan Walsh 2.2.21-4Dan Walsh 2.2.21-3Dan Walsh 2.2.21-2Dan Walsh 2.2.21-1Dan Walsh 2.2.20-1Dan Walsh 2.2.19-2Dan Walsh 2.2.19-1Dan Walsh 2.2.18-2Dan Walsh 2.2.18-1Dan Walsh 2.2.17-2Dan Walsh 2.2.16-1Dan Walsh 2.2.15-4Dan Walsh 2.2.15-3Dan Walsh 2.2.15-1Dan Walsh 2.2.14-2Dan Walsh 2.2.14-1Dan Walsh 2.2.13-1Dan Walsh 2.2.12-1Dan Walsh 2.2.11-2Dan Walsh 2.2.11-1Dan Walsh 2.2.10-1Dan Walsh 2.2.9-2Dan Walsh 2.2.9-1Dan Walsh 2.2.8-2Dan Walsh 2.2.7-1Dan Walsh 2.2.6-3Dan Walsh 2.2.6-2Dan Walsh 2.2.6-1Dan Walsh 2.2.5-1Dan Walsh 2.2.4-1Dan Walsh 2.2.3-1Dan Walsh 2.2.2-1Dan Walsh 2.2.1-1Dan Walsh 2.1.13-1Dan Walsh 2.1.12-3Dan Walsh 2.1.11-1Dan Walsh 2.1.10-1Jeremy Katz - 2.1.9-2Dan Walsh 2.1.9-1Dan Walsh 2.1.8-3Dan Walsh 2.1.8-2Dan Walsh 2.1.8-1Dan Walsh 2.1.7-4Dan Walsh 2.1.7-3Dan Walsh 2.1.7-2Dan Walsh 2.1.7-1Dan Walsh 2.1.6-24Dan Walsh 2.1.6-23Dan Walsh 2.1.6-22Dan Walsh 2.1.6-21Dan Walsh 2.1.6-20Dan Walsh 2.1.6-18Dan Walsh 2.1.6-17Dan Walsh 2.1.6-16Dan Walsh 2.1.6-15Dan Walsh 2.1.6-14Dan Walsh 2.1.6-13Dan Walsh 2.1.6-11Dan Walsh 2.1.6-10Dan Walsh 2.1.6-9Dan Walsh 2.1.6-8Dan Walsh 2.1.6-5Dan Walsh 2.1.6-4Dan Walsh 2.1.6-3Dan Walsh 2.1.6-2Dan Walsh 2.1.6-1Dan Walsh 2.1.4-2Dan Walsh 2.1.4-1Dan Walsh 2.1.3-1Jeremy Katz - 2.1.2-3Dan Walsh 2.1.2-2Dan Walsh 2.1.2-1Dan Walsh 2.1.1-3Dan Walsh 2.1.1-2Dan Walsh 2.1.1-1Dan Walsh 2.1.0-3Dan Walsh 2.1.0-2.Dan Walsh 2.1.0-1.Dan Walsh 2.0.11-2.Dan Walsh 2.0.11-1.Dan Walsh 2.0.9-1.Dan Walsh 2.0.8-1.Dan Walsh 2.0.7-3Dan Walsh 2.0.7-2Dan Walsh 2.0.6-2Dan Walsh 2.0.5-4Dan Walsh 2.0.5-1Dan Walsh 2.0.4-1Dan Walsh 2.0.2-2Dan Walsh 2.0.2-1Dan Walsh 2.0.1-2Dan Walsh 2.0.1-1- Add new boolean gluster_use_execmem Resolves: rhbz#1469027 - Allow cluster_t and glusterd_t domains to dbus chat with ganesha service Resolves: rhbz#1468581- Dontaudit staff_t user read admin_home_t files. Resolves: rhbz#1290633- Allow couple rules needed to start targetd daemon with SELinux in enforcing mode Resolves: rhbz#1424621 - Add interface lvm_manage_metadata Resolves: rhbz#1424621- Allow sssd_t to read realmd lib files. Resolves: rhbz#1436689 - Add permission open to files_read_inherited_tmp_files() interface Resolves: rhbz#1290633 Resolves: rhbz#1457106- Allow unconfined_t user all user namespace capabilties. Resolves: rhbz#1461488- Allow httpd_t to read realmd_var_lib_t files Resolves: rhbz#1436689- Allow named_t to bind on udp 4321 port Resolves: rhbz#1312972 - Allow systemd-sysctl cap. sys_ptrace Resolves: rhbz#1458999- Allow pki_tomcat_t execute ldconfig. Resolves: rhbz#1436689- Allow iscsi domain load kernel module. Resolves: rhbz#1457874 - Allow keepalived domain connect to squid tcp port Resolves: rhbz#1457455 - Allow krb5kdc_t domain read realmd lib files. Resolves: rhbz#1436689 - xdm_t should view kernel keys Resolves: rhbz#1432645- Allow tomcat to connect on all unreserved ports - Allow ganesha to connect to all rpc ports Resolves: rhbz#1448090 - Update ganesha with another fixes. Resolves: rhbz#1448090 - Update rpc_read_nfs_state_data() interface to allow read also lnk_files. Resolves: rhbz#1448090 - virt_use_glusterd boolean should be in optional block Update ganesha module to allow create tmp files Resolves: rhbz#1448090 - Hide broken symptoms when machine is configured with network bounding.- Add new boolean virt_use_glusterd Resolves: rhbz#1455994 - Add capability sys_boot for sbd_t domain - Allow sbd_t domain to create rpc sysctls. Resolves: rhbz#1455631 - Allow ganesha_t domain to manage glusterd_var_run_t pid files. Resolves: rhbz#1448090- Create new interface: glusterd_read_lib_files() - Allow ganesha read glusterd lib files. - Allow ganesha read network sysctls Resolves: rhbz#1448090- Add few allow rules to ganesha module Resolves: rhbz#1448090 - Allow condor_master_t to read sysctls. Resolves: rhbz#1277506 - Add dac_override cap to ctdbd_t domain Resolves: rhbz#1435708 - Label 8750 tcp/udp port as dey_keyneg_port_t Resolves: rhbz#1448090- Add ganesha_use_fusefs boolean. Resolves: rhbz#1448090- Allow httpd_t reading kerberos kdc config files Resolves: rhbz#1452215 - Allow tomcat_t domain connect to ibm_dt_2 tcp port. Resolves: rhbz#1447436 - Allow stream connect to initrc_t domains Resolves: rhbz#1447436 - Allow dnsmasq_t domain to read systemd-resolved pid files. Resolves: rhbz#1453114 - Allow tomcat domain name_bind on tcp bctp_port_t Resolves: rhbz#1451757 - Allow smbd_t domain generate debugging files under /var/run/gluster. These files are created through the libgfapi.so library that provides integration of a GlusterFS client in the Samba (vfs_glusterfs) process. Resolves: rhbz#1447669 - Allow condor_master_t write to sysctl_net_t Resolves: rhbz#1277506 - Allow nagios check disk plugin read /sys/kernel/config/ Resolves: rhbz#1277718 - Allow pcp_pmie_t domain execute systemctl binary Resolves: rhbz#1271998 - Allow nagios to connect to stream sockets. Allow nagios start httpd via systemctl Resolves: rhbz#1247635 - Label tcp/udp port 1792 as ibm_dt_2_port_t Resolves: rhbz#1447436 - Add interface fs_read_configfs_dirs() - Add interface fs_read_configfs_files() - Fix systemd_resolved_read_pid interface - Add interface systemd_resolved_read_pid() Resolves: rhbz#1453114 - Allow sshd_net_t domain read/write into crypto devices Resolves: rhbz#1452759 - Label 8999 tcp/udp as bctp_port_t Resolves: rhbz#1451757- nmbd_t needs net_admin capability like smbd Resolves: rhbz#1431859 - Dontaudit net_admin capability for domains postfix_master_t and postfix_qmgr_t Resolves: rhbz#1431859 - Allow rngd domain read sysfs_t Resolves: rhbz#1451735 - Add interface pki_manage_common_files() Resolves: rhbz#1447436 - Allow tomcat_t domain to manage pki_common_t files and dirs Resolves: rhbz#1447436 - Use stricter fc rules for sssd sockets in /var/run Resolves: rhbz#1448060 - Allow certmonger reads httpd_config_t files Resolves: rhbz#1436689 - Allow keepalived_t domain creating netlink_netfilter_socket. Resolves: rhbz#1451684 - Allow tomcat domain read rpm_var_lib_t files Allow tomcat domain exec rpm_exec_t files Allow tomcat domain name connect on oracle_port_t Allow tomcat domain read cobbler_var_lib_t files. Resolves: rhbz#1451318 - Make able deply overcloud via neutron_t to label nsfs as fs_t Resolves: rhbz#1373321- Allow tomcat domain read rpm_var_lib_t files Allow tomcat domain exec rpm_exec_t files Allow tomcat domain name connect on oracle_port_t Allow tomcat domain read cobbler_var_lib_t files. Resolves: rhbz#1451318 - Allow sssd_t domain creating sock files labeled as sssd_var_run_t in /var/run/ Resolves: rhbz#1448056 Resolves: rhbz#1448060 - Allow tomcat_domain connect to * postgresql_port_t * amqp_port_t Allow tomcat_domain read network sysctls Resolves: rhbz#1450819 - Make able deply overcloud via neutron_t to label nsfs as fs_t Resolves: rhbz#1373321 - Allow netutils setpcap capability Resolves:1444438- Update targetd policy to accommodate changes in the service Resolves: rhbz#1424621 - Allow tomcat_domain connect to * postgresql_port_t * amqp_port_t Allow tomcat_domain read network sysctls Resolves: rhbz#1450819 - Update virt_rw_stream_sockets_svirt() interface to allow confined users set socket options. Resolves: rhbz#1415841 - Allow radius domain stream connec to postgresql Resolves: rhbz#1446145 - Allow virt_domain to read raw fixed_disk_device_t to make working blockcommit Resolves: rhbz#1449977 - Allow glusterd_t domain start ganesha service Resolves: rhbz#1448090 - Made few cosmetic changes in sssd SELinux module Resolves: rhbz#1448060 - sssd-kcm should not run as unconfined_service_t BZ(1447411) Resolves: rhbz#1448060 - Add sssd_secrets labeling Also add named_filetrans interface to make sure all labels are correct Resolves: rhbz#1448056 - Allow keepalived_t domain read usermodehelper_t Resolves: rhbz#1449769 - Allow tomcat_t domain read pki_common_t files Resolves: rhbz#1447436 - Add interface pki_read_common_files() Resolves: rhbz#1447436- Allow hypervkvp_t domain execute hostname Resolves: rhbz#1449064 - Dontaudit sssd_selinux_manager_t use of net_admin capability Resolves: rhbz#1444955 - Allow tomcat_t stream connect to pki_common_t Resolves: rhbz#1447436 - Dontaudit xguest_t's attempts to listen to its tcp_socket - Allow sssd_selinux_manager_t to ioctl init_t sockets Resolves: rhbz#1436689 - Allow _su_t to create netlink_selinux_socket Resolves rhbz#1146987 - Allow unconfined_t to module_load any file Resolves rhbz#1442994- Improve ipa_cert_filetrans_named_content() interface to also allow caller domain manage ipa_cert_t type. Resolves: rhbz#1436689- Allow pki_tomcat_t domain read /etc/passwd. Resolves: rhbz#1436689 - Allow tomcat_t domain read ipa_tmp_t files Resolves: rhbz#1436689 - Label new path for ipa-otpd Resolves: rhbz#1446353 - Allow radiusd_t domain stream connect to postgresql_t Resolves: rhbz#1446145 - Allow rhsmcertd_t to execute hostname_exec_t binaries. Resolves: rhbz#1445494 - Allow virtlogd to append nfs_t files when virt_use_nfs=1 Resolves: rhbz#1402561- Update tomcat policy to adjust for removing unconfined_domain attr. Resolves: rhbz#1432083 - Allow httpd_t domain read also httpd_user_content_type lnk_files. Resolves: rhbz#1383621 - Allow httpd_t domain create /etc/httpd/alias/ipaseesion.key with label ipa_cert_t Resolves: rhbz#1436689 - Dontaudit _gkeyringd_t stream connect to system_dbusd_t Resolves: rhbz#1052880 - Label /var/www/html/nextcloud/data as httpd_sys_rw_content_t Resolves: rhbz#1425530 - Add interface ipa_filetrans_named_content() Resolves: rhbz#1432115 - Allow tomcat use nsswitch Resolves: rhbz#1436689 - Allow certmonger_t start/status generic services Resolves: rhbz#1436689 - Allow dirsrv read cgroup files. Resolves: rhbz#1436689 - Allow ganesha_t domain read/write infiniband devices. Resolves: rhbz#1383784 - Allow sendmail_t domain sysctl_net_t files Resolves: rhbz#1369376 - Allow targetd_t domain read network state and getattr on loop_control_device_t Resolves: rhbz#1373860 - Allow condor_schedd_t domain send mails. Resolves: rhbz#1277506 - Alow certmonger to create own systemd unit files. Resolves: rhbz#1436689 - Allow staff to systemctl virt server when staff_use_svirt=1 Resolves: rhbz#1415841 - Allow unconfined_t create /tmp/ca.p12 file with ipa_tmp_t context Resolves: rhbz#1432115 - Label /sysroot/ostree/deploy/rhel-atomic-host/* as root_t Resolves: rhbz#1428112- Alow certmonger to create own systemd unit files. Resolves: rhbz#1436689- Hide broken symptoms when using kernel 3.10.0-514+ with network bonding. Postfix_picup_t domain requires NET_ADMIN capability which is not really needed. Resolves: rhbz#1431859 - Fix policy to reflect all changes in new IPA release Resolves: rhbz#1432115 Resolves: rhbz#1436689- Allow sbd_t to read/write fixed disk devices Resolves: rhbz#1440165 - Add sys_ptrace capability to radiusd_t domain Resolves: rhbz#1426641 - Allow cockpit_session_t domain connects to ssh tcp ports. Resolves: rhbz#1413509- Update tomcat policy to make working ipa install process Resolves: rhbz#1436689- Allow pcp_pmcd_t net_admin capability. - Allow pcp_pmcd_t read net sysctls - Allow system_cronjob_t create /var/run/pcp with pcp_var_run_t Resolves: rhbz#1336211- Fix all AVC denials during pkispawn of CA Resolves: rhbz#1436383 - Update pki interfaces and tomcat module Resolves: rhbz#1436689- Update pki interfaces and tomcat module Resolves: rhbz#1436689- Dontaudit firewalld wants write to /root Resolves: rhbz#1438708 - Dontaudit firewalld to create dirs in /root/ Resolves: rhbz#1438708 - Allow sendmail to search network sysctls Resolves: rhbz#1369376 - Add interface gssd_noatsecure() Resolves: rhbz#1438036 - Add interface gssproxy_noatsecure() Resolves: rhbz#1438036 - Dontaudit pcp_pmlogger_t search for xserver logs. Allow pcp_pmlogger_t to send signals to unconfined doamins Allow pcp_pmlogger_t to send logs to journals Resolves: rhbz#1379371 - Allow chronyd_t net_admin capability to allow support HW timestamping. Resolves: rhbz#1416015 - Update tomcat policy Resolves: rhbz#1436689 Resolves: rhbz#1436383 - Allow certmonger to start haproxy service Resolves: rhbz#1349394 - Allow init noatsecure for gssd and gssproxy Resolves: rhbz#1438036- geoclue wants to dbus chat with avahi Resolves: rhbz#1434286 - Allow iptables get list of kernel modules Resolves: rhbz#1367520 - Allow unconfined_domain_type to enable/disable transient unit Resolves: rhbz#1337041 - Add interfaces init_enable_transient_unit() and init_disable_transient_unit - Revert "Allow sshd setcap capability. This is needed due to latest changes in sshd" Resolves: rhbz#1435264 - Label sysroot dir under ostree as root_t Resolves: rhbz#1428112- Remove ganesha_t domain from permissive domains. Resolves: rhbz#1436988- Allow named_t domain bind on several udp ports Resolves: rhbz#1312972 - Update nscd_use() interface Resolves: rhbz#1281716 - Allow radius_t domain ptrace Resolves: rhbz#1426641 - Update nagios to allos exec systemctl Resolves: rhbz#1247635 - Update pcp SELinux module to reflect all pcp changes Resolves: rhbz#1271998 - Label /var/lib/ssl_db as squid_cache_t Label /etc/squid/ssl_db as squid_cache_t Resolves: rhbz#1325527 - Allow pcp_pmcd_t domain search for network sysctl Allow pcp_pmcd_t domain sys_ptrace capability Resolves: rhbz#1336211- Allow drbd load modules Resolves: rhbz#1134883 - Revert "Add sys_module capability for drbd Resolves: rhbz#1134883" - Allow stapserver list kernel modules Resolves: rhbz#1325976 - Update targetd policy Resolves: rhbz#1373860 - Add sys_admin capability to amanda Resolves: rhbz#1371561 - Allow hypervvssd_t to read all dirs. Resolves: rhbz#1331309 - Label /run/haproxy.sock socket as haproxy_var_run_t Resolves: rhbz#1386233 - Allow oddjob_mkhomedir_t to mamange autofs_t dirs. Resolves: rhbz#1408819 - Allow tomcat to connect on http_cache_port_t Resolves: rhbz#1432083 - Allow geoclue to send msgs to syslog. Resolves: rhbz#1434286 - Allow condor_master_t domain capability chown. Resolves: rhbz#1277506 - Update mta_filetrans_named_content() interface to allow calling domain create files labeled as etc_aliases_t in dir labeled as etc_mail_t. Resolves: rhbz#1167468 - Allow nova domain search for httpd configuration. Resolves: rhbz#1190761 - Add sys_module capability for drbd Resolves: rhbz#1134883 - Allow user_u users stream connect to dirsrv, Allow sysadm_u and staff_u users to manage dirsrv files Resolves: rhbz#1286474 - Allow systemd_networkd_t communicate with systemd_networkd_t via dbus Resolves: rhbz#1278010- Add haproxy_t domain fowner capability Resolves: rhbz#1386233 - Allow domain transition from ntpd_t to hwclock_t domains Resolves: rhbz#1375624 - Allow cockpit_session_t setrlimit and sys_resource Resolves: rhbz#1402316 - Dontaudit svirt_t read state of libvirtd domain Resolves: rhbz#1426106 - Update httpd and gssproxy modules to reflects latest changes in freeipa Resolves: rhbz#1432115 - Allow iptables read modules_conf_t Resolves: rhbz#1367520- Remove tomcat_t domain from unconfined domains Resolves: rhbz#1432083 - Create new boolean: sanlock_enable_home_dirs() Resolves: rhbz#1432783 - Allow mdadm_t domain to read/write nvme_device_t Resolves: rhbz#1431617 - Remove httpd_user_*_content_t domains from user_home_type attribute. This tighten httpd policy and acces to user data will be more strinct, and also fix mutual influente between httpd_enable_homedirs and httpd_read_user_content Resolves: rhbz#1383621 - Dontaudit domain to create any file in /proc. This is kernel bug. Resolves: rhbz#1412679 - Add interface dev_rw_nvme Resolves: rhbz#1431617- Allow gssproxy to get attributes on all filesystem object types. Resolves: rhbz#1430295 - Allow ganesha to chat with unconfined domains via dbus Resolves: rhbz#1426554 - add the policy required for nextcloud Resolves: rhbz#1425530 - Add nmbd_t capability2 block_suspend Resolves: rhbz#1425357 - Label /var/run/chrony as chronyd_var_run_t Resolves: rhbz#1416015 - Add domain transition from sosreport_t to iptables_t Resolves: rhbz#1359789 - Fix path to /usr/lib64/erlang/erts-5.10.4/bin/epmd Resolves: rhbz:#1332803- Update rpm macros Resolves: rhbz#1380854- Add handling booleans via selinux-policy macros in custom policy spec files. Resolves: rhbz#1380854- Allow openvswitch to load kernel modules Resolves: rhbz#1405479- Allow openvswitch read script state. Resolves: rhbz#1405479- Update ganesha policy Resolves: rhbz#1426554 Resolves: rhbz#1383784 - Allow chronyd to read adjtime Resolves: rhbz#1416015 - Fixes for chrony version 2.2 Resolves: rhbz#1416015 - Add interface virt_rw_stream_sockets_svirt() Resolves: rhbz#1415841 - Label /dev/ss0 as gpfs_device_t Resolves: rhbz#1383784 - Allow staff to rw svirt unix stream sockets. Resolves: rhbz#1415841 - Label /rhev/data-center/mnt as mnt_t Resolves: rhbz#1408275 - Associate sysctl_rpc_t with proc filesystems Resolves: rhbz#1350927 - Add new boolean: domain_can_write_kmsg Resolves: rhbz#1415715- Allow rhsmcertd_t dbus chat with system_cronjob_t Resolves: rhbz#1405341 - Allow openvswitch exec hostname and readinitrc_t files Resolves: rhbz#1405479 - Improve SELinux context for mysql_db_t objects. Resolves: rhbz#1391521 - Allow postfix_postdrop to communicate with postfix_master via pipe. Resolves: rhbz#1379736 - Add radius_use_jit boolean Resolves: rhbz#1426205 - Label /var/lock/subsys/iptables as iptables_lock_t Resolves: rhbz#1405441 - Label /usr/lib64/erlang/erts-5.10.4/bin/epmd as lib_t Resolves: rhbz#1332803 - Allow can_load_kernmodule to load kernel modules. Resolves: rhbz#1423427 Resolves: rhbz#1424621- Allow nfsd_t domain to create sysctls_rpc_t files Resolves: rhbz#1405304 - Allow openvswitch to create netlink generic sockets. Resolves: rhbz#1397974 - Create kernel_create_rpc_sysctls() interface Resolves: rhbz#1405304- Allow nfsd_t domain rw sysctl_rpc_t dirs Resolves: rhbz#1405304 - Allow cgdcbxd_t to manage cgroup files. Resolves: rhbz#1358493 - Allow cmirrord_t domain to create netlink_connector sockets Resolves: rhbz#1412670 - Allow fcoemon to create netlink scsitransport sockets Resolves: rhbz#1362496 - Allow quota_nld_t create netlink_generic sockets Resolves: rhbz#1358679 - Allow cgred_t create netlink_connector sockets Resolves: rhbz#1376357 - Add dhcpd_t domain fowner capability Resolves: rhbz#1358485 - Allow acpid to attempt to connect to the Linux kernel via generic netlink socket. Resolves: rhbz#1358478 - Rename docker module to container module Resolves: rhbz#1386916 - Allow setflies to mount tracefs Resolves: rhbz#1376357 - Allow iptables to read nsfs files. Resolves: rhbz#1411316 - Allow systemd_bootchart_t domain create dgram sockets. Resolves: rhbz#1365953 - Rename docker interfaces to container Resolves: rhbz#1386916- Allow initrc_t domain to run rhel-autorelabel script properly during boot process Resolves: rhbz#1379722 - Allow systemd_initctl_t to create and connect unix_dgram sockets Resolves: rhbz#1365947 - Allow ifconfig_t to mount/unmount nsfs_t filesystem Resolves: rhbz#1349814 - Add interfaces allowing mount/unmount nsfs_t filesystem Resolves: rhbz#1349814- Add interface init_stream_connectto() Resolves:rhbz#1365947 - Allow rhsmcertd domain signull kernel. Resolves: rhbz#1379781 - Allow kdumpgui domain to read nvme device - Allow insmod_t to load kernel modules Resolves: rhbz#1421598 - Add interface files_load_kernel_modules() Resolves: rhbz#1421598 - Add SELinux support for systemd-initctl daemon Resolves:rhbz#1365947 - Add SELinux support for systemd-bootchart Resolves: rhbz#1365953- Allow firewalld to getattr open search read modules_object_t:dir Resolves: rhbz#1418391 - Fix label for nagios plugins in nagios file conxtext file Resolves: rhbz#1277718 - Add sys_ptrace capability to pegasus domain Resolves: rhbz#1381238 - Allow sssd_t domain setpgid Resolves:rhbz#1416780 - After the latest changes in nfsd. We should allow nfsd_t to read raw fixed disk. Resolves: rhbz#1350927 - Allow kdumpgui domain to read nvme device Resolves: rhbz#1415084 - su using libselinux and creating netlink_selinux socket is needed to allow libselinux initialization. Resolves: rhbz#1146987 - Add user namespace capability object classes. Resolves: rhbz#1368057 - Add module_load permission to class system Resolves:rhbz#1368057 - Add the validate_trans access vector to the security class Resolves: rhbz#1368057 - Add "binder" security class and access vectors Resolves: rhbz#1368057 - Allow ifconfig_t domain read nsfs_t Resolves: rhbz#1349814 - Allow ping_t domain to load kernel modules. Resolves: rhbz#1388363- Allow systemd container to read/write usermodehelperstate Resolves: rhbz#1403254 - Label udp ports in range 24007-24027 as gluster_port_t Resolves: rhbz#1404152- Allow glusterd_t to bind on glusterd_port_t udp ports. Resolves: rhbz#1404152 - Revert: Allow glusterd_t to bind on med_tlp port.- Allow glusterd_t to bind on med_tlp port. Resolves: rhbz#1404152 - Update ctdbd_t policy to reflect all changes. Resolves: rhbz#1402451 - Label tcp port 24009 as med_tlp_port_t Resolves: rhbz#1404152 - Issue appears during update directly from RHEL-7.0 to RHEL-7.3 or above. Modules pkcsslotd and vbetools missing in selinux-policy package for RHEL-7.3 which causing warnings during SELinux policy store migration process. Following patch fixes issue by skipping pkcsslotd and vbetools modules migration.- Allow ctdbd_t domain transition to rpcd_t Resolves:rhbz#1402451- Fixes for containers Allow containers to attempt to write to unix_sysctls. Allow cotainers to use the FD's leaked to them from parent processes. Resolves: rhbz#1403254- Allow glusterd_t send signals to userdomain. Label new glusterd binaries as glusterd_exec_t Resolves: rhbz#1404152 - Allow systemd to stop glusterd_t domains. Resolves: rhbz#1400493- Make working CTDB:NFS: CTDB failover from selinux-policy POV Resolves: rhbz#1402451- Add kdump_t domain sys_admin capability Resolves: rhbz#1375963- Allow puppetagent_t to access timedated dbus. Use the systemd_dbus_chat_timedated interface to allow puppetagent_t the access. Resolves: rhbz#1399250- Update systemd on RHEL-7.2 box to version from RHEL-7.3 and then as a separate yum command update the selinux policy systemd will start generating USER_AVC denials and will start returning "Access Denied" errors to DBus clients Resolves: rhbz#1393505- Allow cluster_t communicate to fprintd_t via dbus Resolves: rhbz#1349798- Fix error message during update from RHEL-7.2 to RHEL-7.3, when /usr/sbin/semanage command is not installed and selinux-policy-migrate-local-changes.sh script is executed in %post install phase of selinux-policy package Resolves: rhbz#1392010- Allow GlusterFS with RDMA transport to be started correctly. It requires ipc_lock capability together with rw permission on rdma_cm device. Resolves: rhbz#1384488 - Allow glusterd to get attributes on /sys/kernel/config directory. Resolves: rhbz#1384483- Use selinux-policy-migrate-local-changes.sh instead of migrateStore* macros - Add selinux-policy-migrate-local-changes service Resolves: rhbz#1381588- Allow sssd_selinux_manager_t to manage also dir class. Resolves: rhbz#1368097 - Add interface seutil_manage_default_contexts_dirs() Resolves: rhbz#1368097- Add virt_sandbox_use_nfs -> virt_use_nfs boolean substitution. Resolves: rhbz#1355783- Allow pcp_pmcd_t domain transition to lvm_t Add capability kill and sys_ptrace to pcp_pmlogger_t Resolves: rhbz#1309883- Allow ftp daemon to manage apache_user_content Resolves: rhbz#1097775 - Label /etc/sysconfig/oracleasm as oracleasm_conf_t Resolves: rhbz#1331383 - Allow oracleasm to rw inherited fixed disk device Resolves: rhbz#1331383 - Allow collectd to connect on unix_stream_socket Resolves: rhbz#1377259- Allow iscsid create netlink iscsid sockets. Resolves: rhbz#1358266 - Improve regexp for power_unit_file_t files. To catch just systemd power unit files. Resolves: rhbz#1375462- Update oracleasm SELinux module that can manage oracleasmfs_t blk files. Add dac_override cap to oracleasm_t domain. Resolves: rhbz#1331383 - Add few rules to pcp SELinux module to make ti able to start pcp_pmlogger service Resolves: rhbz#1206525- Add oracleasm_conf_t type and allow oracleasm_t to create /dev/oracleasm Resolves: rhbz#1331383 - Label /usr/share/pcp/lib/pmie as pmie_exec_t and /usr/share/pcp/lib/pmlogger as pmlogger_exec_t Resolves: rhbz#1206525 - Allow mdadm_t to getattr all device nodes Resolves: rhbz#1365171 - Add interface dbus_dontaudit_stream_connect_system_dbusd() Resolves:rhbz#1052880 - Add virt_stub_* interfaces for docker policy which is no longer a part of our base policy. Resolves: rhbz#1372705 - Allow guest-set-user-passwd to set users password. Resolves: rhbz#1369693 - Allow samdbox domains to use msg class Resolves: rhbz#1372677 - Allow domains using kerberos to read also kerberos config dirs Resolves: rhbz#1368492 - Allow svirt_sandbox_domains to r/w onload sockets Resolves: rhbz#1342930 - Add interface fs_manage_oracleasm() Resolves: rhbz#1331383 - Label /dev/kfd as hsa_device_t Resolves: rhbz#1373488 - Update seutil_manage_file_contexts() interface that caller domain can also manage file_context_t dirs Resolves: rhbz#1368097 - Add interface to write to nsfs inodes Resolves: rhbz#1372705 - Allow systemd services to use PrivateNetwork feature Resolves: rhbz#1372705 - Add a type and genfscon for nsfs. Resolves: rhbz#1372705 - Allow run sulogin_t in range mls_systemlow-mls_systemhigh. Resolves: rhbz#1290400- Allow arpwatch to create netlink netfilter sockets. Resolves: rhbz#1358261 - Fix file context for /etc/pki/pki-tomcat/ca/ - new interface oddjob_mkhomedir_entrypoint() - Move label for /var/lib/docker/vfs/ to proper SELinux module - Allow mdadm to get attributes from all devices. - Label /etc/puppetlabs as puppet_etc_t. - Allow systemd-machined to communicate to lxc container using dbus - Allow systemd_resolved to send dbus msgs to userdomains Resolves: rhbz#1236579 - Allow systemd-resolved to read network sysctls Resolves: rhbz#1236579 - Allow systemd_resolved to connect on system bus. Resolves: rhbz#1236579 - Make entrypoint oddjob_mkhomedir_exec_t for unconfined_t - Label all files in /dev/oracleasmfs/ as oracleasmfs_t Resolves: rhbz#1331383- Label /etc/pki/pki-tomcat/ca/ as pki_tomcat_cert_t Resolves:rhbz#1366915 - Allow certmonger to manage all systemd unit files Resolves:rhbz#1366915 - Grant certmonger "chown" capability Resolves:rhbz#1366915 - Allow ipa_helper_t stream connect to dirsrv_t domain Resolves: rhbz#1368418 - Update oracleasm SELinux module Resolves: rhbz#1331383 - label /var/lib/kubelet as svirt_sandbox_file_t Resolves: rhbz#1369159 - Add few interfaces to cloudform.if file Resolves: rhbz#1367834 - Label /var/run/corosync-qnetd and /var/run/corosync-qdevice as cluster_var_run_t. Note: corosync policy is now par of rhcs module Resolves: rhbz#1347514 - Allow krb5kdc_t to read krb4kdc_conf_t dirs. Resolves: rhbz#1368492 - Update networkmanager_filetrans_named_content() interface to allow source domain to create also temad dir in /var/run. Resolves: rhbz#1365653 - Allow teamd running as NetworkManager_t to access netlink_generic_socket to allow multiple network interfaces to be teamed together. Resolves: rhbz#1365653 - Label /dev/oracleasmfs as oracleasmfs_t. Add few interfaces related to oracleasmfs_t type Resolves: rhbz#1331383 - A new version of cloud-init that supports the effort to provision RHEL Atomic on Microsoft Azure requires some a new rules that allows dhclient/dhclient hooks to call cloud-init. Resolves: rhbz#1367834 - Allow iptables to creating netlink generic sockets. Resolves: rhbz#1364359- Allow ipmievd domain to create lock files in /var/lock/subsys/ Resolves:rhbz#1349058 - Update policy for ipmievd daemon. Resolves:rhbz#1349058 - Dontaudit hyperkvp to getattr on non security files. Resolves: rhbz#1349356 - Label /run/corosync-qdevice and /run/corosync-qnetd as corosync_var_run_t Resolves: rhbz#1347514 - Fixed lsm SELinux module - Add sys_admin capability to sbd domain Resolves: rhbz#1322725 - Allow vdagent to comunnicate with systemd-logind via dbus Resolves: rhbz#1366731 - Allow lsmd_plugin_t domain to create fixed_disk device. Resolves: rhbz#1238066 - Allow opendnssec domain to create and manage own tmp dirs/files Resolves: rhbz#1366649 - Allow opendnssec domain to read system state Resolves: rhbz#1366649 - Update opendnssec_manage_config() interface to allow caller domain also manage opendnssec_conf_t dirs Resolves: rhbz#1366649 - Allow rasdaemon to mount/unmount tracefs filesystem. Resolves: rhbz#1364380 - Label /usr/libexec/iptables/iptables.init as iptables_exec_t Allow iptables creating lock file in /var/lock/subsys/ Resolves: rhbz#1367520 - Modify interface den_read_nvme() to allow also read nvme_device_t block files. Resolves: rhbz#1362564 - Label /var/run/storaged as lvm_var_run_t. Resolves: rhbz#1264390 - Allow unconfineduser to run ipa_helper_t. Resolves: rhbz#1361636- Dontaudit mock to write to generic certs. Resolves: rhbz#1271209 - Add labeling for corosync-qdevice and corosync-qnetd daemons, to run as cluster_t Resolves: rhbz#1347514 - Revert "Label corosync-qnetd and corosync-qdevice as corosync_t domain" - Allow modemmanager to write to systemd inhibit pipes Resolves: rhbz#1365214 - Label corosync-qnetd and corosync-qdevice as corosync_t domain Resolves: rhbz#1347514 - Allow ipa_helper to read network state Resolves: rhbz#1361636 - Label oddjob_reqiest as oddjob_exec_t Resolves: rhbz#1361636 - Add interface oddjob_run() Resolves: rhbz#1361636 - Allow modemmanager chat with systemd_logind via dbus Resolves: rhbz#1362273 - Allow NetworkManager chat with puppetagent via dbus Resolves: rhbz#1363989 - Allow NetworkManager chat with kdumpctl via dbus Resolves: rhbz#1363977 - Allow sbd send msgs to syslog Allow sbd create dgram sockets. Allow sbd to communicate with kernel via dgram socket Allow sbd r/w kernel sysctls. Resolves: rhbz#1322725 - Allow ipmievd_t domain to re-create ipmi devices Label /usr/libexec/openipmi-helper as ipmievd_exec_t Resolves: rhbz#1349058 - Allow rasdaemon to use tracefs filesystem. Resolves: rhbz#1364380 - Fix typo bug in dirsrv policy - Some logrotate scripts run su and then su runs unix_chkpwd. Allow logrotate_t domain to check passwd. Resolves: rhbz#1283134 - Add ipc_lock capability to sssd domain. Allow sssd connect to http_cache_t Resolves: rhbz#1362688 - Allow dirsrv to read dirsrv_share_t content Resolves: rhbz#1363662 - Allow virtlogd_t to append svirt_image_t files. Resolves: rhbz#1358140 - Allow hypervkvp domain to read hugetlbfs dir/files. Resolves: rhbz#1349356 - Allow mdadm daemon to read nvme_device_t blk files Resolves: rhbz#1362564 - Allow selinuxusers and unconfineduser to run oddjob_request Resolves: rhbz#1361636 - Allow sshd server to acces to Crypto Express 4 (CEX4) devices. Resolves: rhbz#1362539 - Fix labeling issue in init.fc file. Path /usr/lib/systemd/fedora-* changed to /usr/lib/systemd/rhel-*. Resolves: rhbz#1363769 - Fix typo in device interfaces Resolves: rhbz#1349058 - Add interfaces for managing ipmi devices Resolves: rhbz#1349058 - Add interfaces to allow mounting/umounting tracefs filesystem Resolves: rhbz#1364380 - Add interfaces to allow rw tracefs filesystem Resolves: rhbz#1364380 - Add interface dev_read_nvme() to allow reading Non-Volatile Memory Host Controller devices. Resolves: rhbz#1362564 - Label /sys/kernel/debug/tracing filesystem Resolves: rhbz#1364380 - Allow sshd setcap capability. This is needed due to latest changes in sshd Resolves: rhbz#1357857- Dontaudit mock_build_t can list all ptys. Resolves: rhbz#1271209 - Allow ftpd_t to mamange userhome data without any boolean. Resolves: rhbz#1097775 - Add logrotate permissions for creating netlink selinux sockets. Resolves: rhbz#1283134 - Allow lsmd_plugin_t to exec ldconfig. Resolves: rhbz#1238066 - Allow vnstatd domain to read /sys/class/net/ files Resolves: rhbz#1358243 - Remove duplicate allow rules in spamassassin SELinux module Resolves:rhbz#1358175 - Allow spamc_t and spamd_t domains create .spamassassin file in user homedirs Resolves:rhbz#1358175 - Allow sshd setcap capability. This is needed due to latest changes in sshd Resolves: rhbz#1357857 - Add new MLS attribute to allow relabeling objects higher than system low. This exception is needed for package managers when processing sensitive data. Resolves: rhbz#1330464 - Allow gnome-keyring also manage user_tmp_t sockets. Resolves: rhbz#1257057 - corecmd: Remove fcontext for /etc/sysconfig/libvirtd Resolves:rhbz#1351382- Allow ipa_dnskey domain to search cache dirs Resolves: rhbz#1350957- Allow ipa-dnskey read system state. Reasolves: rhbz#1350957 - Allow dogtag-ipa-ca-renew-agent-submit labeled as certmonger_t to create /var/log/ipa/renew.log file Resolves: rhbz#1350957- Allow firewalld to manage net_conf_t files. Resolves:rhbz#1304723 - Allow logrotate read logs inside containers. Resolves: rhbz#1303514 - Allow sssd to getattr on fs_t Resolves: rhbz#1356082 - Allow opendnssec domain to manage bind chace files Resolves: rhbz#1350957 - Fix typo in rhsmcertd policy module Resolves: rhbz#1329475 - Allow systemd to get status of systemd-logind daemon Resolves: rhbz#1356141 - Label more ndctl devices not just ndctl0 Resolves: rhbz#1355809- Allow rhsmcertd to copy certs into /etc/docker/cert.d - Add interface docker_rw_config() Resolves: rhbz#1344500 - Fix logrotate fc file to label also /var/lib/logrotate/ dir as logrotate_var_lib_t Resolves: rhbz#1355632 - Allow rhsmcertd to read network sysctls Resolves: rhbz#1329475 - Label /var/log/graphite-web dir as httpd_log_t Resolves: rhbz#1310898 - Allow mock to use generic ptys Resolves: rhbz#1271209 - Allow adcli running as sssd_t to write krb5.keytab file. Resolves: rhbz#1356082 - Allow openvswitch connect to openvswitch_port_t type. Resolves: rhbz#1335024 - Add SELinux policy for opendnssec service. Resolves: rhbz#1350957 - Create new SELinux type for /usr/libexec/ipa/ipa-dnskeysyncd Resolves: rhbz#1350957 - label /dev/ndctl0 device as nvram_device_t Resolves: rhbz#1355809- Allow lttng tools to block suspending Resolves: rhbz#1256374 - Allow creation of vpnaas in openstack Resolves: rhbz#1352710 - virt: add strict policy for virtlogd daemon Resolves:rhbz#1311606 - Update makefile to support snapperd_contexts file Resolves: rhbz#1352681- Allow udev to manage systemd-hwdb files - Add interface systemd_hwdb_manage_config() Resolves: rhbz#1350756 - Fix paths to infiniband devices. This allows use more then two infiniband interfaces. Resolves: rhbz#1210263- Allow virtual machines to rw infiniband devices. Resolves: rhbz#1210263 - Allow opensm daemon to rw infiniband_mgmt_device_t Resolves: rhbz#1210263 - Allow systemd_hwdb_t to relabel /etc/udev/hwdb.bin file. Resolves: rhbz#1350756 - Make label for new infiniband_mgmt deivices Resolves: rhbz#1210263- Fix typo in brltty SELinux module - Add new SELinux module sbd Resolves: rhbz#1322725 - Allow pcp dmcache metrics collection Resolves: rhbz#1309883 - Allow pkcs_slotd_t to create dir in /var/lock Add label pkcs_slotd_log_t Resolves: rhbz#1350782 - Allow openvpn to create sock files labeled as openvpn_var_run_t Resolves: rhbz#1328246 - Allow hypervkvp daemon to getattr on all filesystem types. Resolves: rhbz#1349356 - Allow firewalld to create net_conf_t files Resolves: rhbz#1304723 - Allow mock to use lvm Resolves: rhbz#1271209 - Allow keepalived to create netlink generic sockets. Resolves: rhbz#1349809 - Allow mirromanager creating log files in /tmp Resolves:rhbz#1328818 - Rename few modules to make it consistent with source files Resolves: rhbz#1351445 - Allow vmtools_t to transition to rpm_script domain Resolves: rhbz#1342119 - Allow nsd daemon to manage nsd_conf_t dirs and files Resolves: rhbz#1349791 - Allow cluster to create dirs in /var/run labeled as cluster_var_run_t Resolves: rhbz#1346900 - Allow sssd read also sssd_conf_t dirs Resolves: rhbz#1350535 - Dontaudit su_role_template interface to getattr /proc/kcore Dontaudit su_role_template interface to getattr /dev/initctl Resolves: rhbz#1086240 - Add interface lvm_getattr_exec_files() Resolves: rhbz#1271209 - Fix typo Compliling vs. Compiling Resolves: rhbz#1351445- Allow krb5kdc_t to communicate with sssd Resolves: rhbz#1319933 - Allow prosody to bind on prosody ports Resolves: rhbz#1304664 - Add dac_override caps for fail2ban-client Resolves: rhbz#1316678 - dontaudit read access for svirt_t on the file /var/db/nscd/group Resolves: rhbz#1301637 - Allow inetd child process to communicate via dbus with systemd-logind Resolves: rhbz#1333726 - Add label for brltty log file Resolves: rhbz#1328818 - Allow dspam to read the passwd file Resolves: rhbz#1286020 - Allow snort_t to communicate with sssd Resolves: rhbz#1284908 - svirt_sandbox_domains need to be able to execmod for badly built libraries. Resolves: rhbz#1206339 - Add policy for lttng-tools package. Resolves: rhbz#1256374 - Make mirrormanager as application domain. Resolves: rhbz#1328234 - Add support for the default lttng-sessiond port - tcp/5345. This port is used by LTTng 2.x central tracing registry session daemon. - Add prosody ports Resolves: rhbz#1304664 - Allow sssd read also sssd_conf_t dirs Resolves: rhbz#1350535- Label /var/lib/softhsm as named_cache_t. Allow named_t to manage named_cache_t dirs. Resolves:rhbz#1331315 - Label named-pkcs11 binary as named_exec_t. Resolves: rhbz#1331315 - Allow glusterd daemon to get systemd status Resolves: rhbz#1321785 - Allow logrotate dbus-chat with system_logind daemon Resolves: rhbz#1283134 - Allow pcp_pmlogger to read kernel network state Allow pcp_pmcd to read cron pid files Resolves: rhbz#1336211 - Add interface cron_read_pid_files() Resolves: rhbz#1336211 - Allow pcp_pmlogger to create unix dgram sockets Resolves: rhbz#1336211 - Add hwloc-dump-hwdata SELinux policy Resolves: rhbz#1344054 - Remove non-existing jabberd_spool_t() interface and add new jabbertd_var_spool_t. Resolves: rhbz#1121171 - Remove non-existing interface salk_resetd_systemctl() and replace it with sanlock_systemctl_sanlk_resetd() Resolves: rhbz#1259764 - Create label for openhpid log files. esolves: rhbz#1259764 - Label /var/lib/ganglia as httpd_var_lib_t Resolves: rhbz#1260536 - Allow firewalld_t to create entries in net_conf_t dirs. Resolves: rhbz#1304723 - Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journals Resolves: rhbz#1288255 - Include patch from distgit repo: policy-RHEL-7.1-flask.patch. Resolves: rhbz#1329560 - Update refpolicy to handle hwloc Resolves: rhbz#1344054 - Label /etc/dhcp/scripts dir as bin_t - Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals. Resolves: rhbz#1288255- Allow firewalld_t to create entries in net_conf_t dirs. Resolves: rhbz#1304723 - Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journals Resolves: rhbz#1288255 - Allow mongod log to syslog. Resolves: rhbz#1306995 - Allow rhsmcertd connect to port tcp 9090 Resolves: rhbz#1337319 - Label for /bin/mail(x) was removed but /usr/bin/mail(x) not. This path is also needed to remove. Resolves: rhbz#1262483 Resolves: rhbz#1277506 - Label /usr/libexec/mimedefang-wrapper as spamd_exec_t. Resolves: rhbz#1301516 - Add new boolean spamd_update_can_network. Resolves: rhbz#1305469 - Allow rhsmcertd connect to tcp netport_port_t Resolves: rhbz#1329475 - Fix SELinux context for /usr/share/mirrormanager/server/mirrormanager to Label all binaries under dir as mirrormanager_exec_t. Resolves: rhbz#1328234 - Allow prosody to bind to fac_restore tcp port. Resolves: rhbz#1321787 - Allow ninfod to read raw packets Resolves: rhbz#1317964 - Allow pegasus get attributes from qemu binary files. Resolves: rhbz#1260835 - Allow pegasus get attributes from qemu binary files. Resolves: rhbz#1271159 - Allow tuned to use policykit. This change is required by cockpit. Resolves: rhbz#1346464 - Allow conman_t to read dir with conman_unconfined_script_t binary files. Resolves: rhbz#1297323 - Allow pegasus to read /proc/sysinfo. Resolves: rhbz#1265883 - Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals. Resolves: rhbz#1288255 - Label tcp ports:16379, 26379 as redis_port_t Resolves: rhbz#1348471 - Allow systemd to relabel /var and /var/lib directories during boot. - Add files_relabel_var_dirs() and files_relabel_var_dirs() interfaces. - Add files_relabelto_var_lib_dirs() interface. - Label tcp port 2004 as mailbox_port_t. Resolves: rhbz#1332843 - Label tcp and udp port 5582 as fac_restore_port_t Resolves: rhbz#1321787 - Allow sysadm_t user to run postgresql-setup. Resolves: rhbz#1282543 - Allow sysadm_t user to dbus chat with oddjob_t. This allows confined admin run oddjob mkhomedirfor script. Resolves: rhbz#1297480 - Update netlink socket classes.- Allow conman to kill conman_unconfined_script. Resolves: rhbz#1297323 - Make conman_unconfined_script_t as init_system_domain. Resolves:rhbz#1297323 - Allow init dbus chat with apmd. Resolves:rhbz#995898 - Patch /var/lib/rpm is symlink to /usr/share/rpm on Atomic, due to this change we need to label also /usr/share/rpm as rpm_var_lib_t. Resolves: rhbz#1233252 - Dontaudit xguest_gkeyringd_t stream connect to system_dbusd_t Resolves: rhbz#1052880 - Add mediawiki rules to proper scope Resolves: rhbz#1301186 - Dontaudit xguest_gkeyringd_t stream connect to system_dbusd_t Resolves: rhbz#1052880 - Allow mysqld_safe to inherit rlimit information from mysqld Resolves: rhbz#1323673 - Allow collectd_t to stream connect to postgresql. Resolves: rhbz#1344056 - Allow mediawiki-script to read /etc/passwd file. Resolves: rhbz#1301186 - Add filetrans rule that NetworkManager_t can create net_conf_t files in /etc. Resolves: rhbz#1344505 - Add labels for mediawiki123 Resolves: rhbz#1293872 - Fix label for all fence_scsi_check scripts - Allow ip netns to mounton root fs and unmount proc_t fs. Resolves: rhbz#1343776 Resolves: rhbz#1286851 - Allow sysadm_t to run newaliases command. Resolves: rhbz#1344828 - Add interface sysnet_filetrans_named_net_conf() Resolves: rhbz#1344505- Fix several issues related to the SELinux Userspace changes- Allow glusterd domain read krb5_keytab_t files. Resolves: rhbz#1343929 - Fix typo in files_setattr_non_security_dirs. Resolves: rhbz#1115987- Allow tmpreaper_t to read/setattr all non_security_file_type dirs Resolves: rhbz#1115987 - Allow firewalld to create firewalld_var_run_t directory. Resolves: rhbz#1304723 - Add interface firewalld_read_pid_files() Resolves: rhbz#1304723 - Label /usr/libexec/rpm-ostreed as rpm_exec_t. Resolves: rhbz#1340542 - Allow sanlock service to read/write cephfs_t files. Resolves: rhbz#1315332 - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS) - Added missing docker interfaces: - docker_typebounds - docker_entrypoint Resolves: rhbz#1236580 - Add interface files_setattr_non_security_dirs() Resolves: rhbz#1115987 - Add support for onloadfs - Allow iptables to read firewalld pid files. Resolves: rhbz#1304723 - Add SELinux support for ceph filesystem. Resolves: rhbz#1315332 - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS) Resolves: rhbz#1236580- Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS) - Added missing docker interfaces: - docker_typebounds - docker_entrypoint Resolves: rhbz#1236580 - New interfaces needed for systemd-machinectl Resolves: rhbz#1236580 - New interfaces needed by systemd-machine Resolves: rhbz#1236580 - Add interface allowing sending and receiving messages from virt over dbus. Resolves: rhbz#1236580 - Backport docker policy from Fedora. Related: #1303123 Resolves: #1341257 - Allow NetworkManager_t and policykit_t read access to systemd-machined pid files. Resolves: rhbz#1236580 - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS) - Added interfaces needed by new docker policy. Related: rhbz#1303123 - Add support for systemd-machined daemon Resolves: rhbz#1236580 - Allow rpm-ostree domain transition to install_t domain from init_t. Resolves: rhbz#1340542- dnsmasq: allow NetworkManager to control dnsmasq via D-Bus Resolves: rhbz#1336722 - Directory Server (389-ds-base) has been updated to use systemd-ask-password. In order to function correctly we need the following added to dirsrv.te Resolves: rhbz#1333198 - sftpd_* booleans are functionless these days. Resolves: rhbz#1335656 - Label /var/log/ganesha.log as gluster_log_t Allow glusterd_t domain to create glusterd_log_t files. Label /var/run/ganesha.pid as gluster_var_run_t. Resolves: rhbz#1335828 - Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus. Resolves: rhbz#1336760 - Allow ganesha daemon labeled as glusterd_t create /var/lib/nfs/ganesha dir labeled as var_lib_nfs_t. Resolves: rhbz#1336737 - Label /usr/libexec/storaged/storaged as lvm_exec_t to run storaged daemon in lvm_t SELinux domain. Resolves: rhbz#1264390 - Allow systemd_hostanmed_t to read /proc/sysinfo labeled as sysctl_t. Resolves: rhbz#1337061 - Revert "Allow all domains some process flags." Resolves: rhbz#1303644 - Revert "Remove setrlimit to all domains." Resolves: rhbz#1303644 - Label /usr/sbin/xrdp* files as bin_t Resolves: rhbz#1276777 - Add mls support for some db classes Resolves: rhbz#1303651 - Allow systemd_resolved_t to check if ipv6 is disabled. Resolves: rhbz#1236579 - Allow systemd_resolved to read systemd_networkd run files. Resolves: rhbz#1236579- Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus. Resolves: rhbz#1336760 - Allow ganesha daemon labeled as glusterd_t create /var/lib/nfs/ganesha dir labeled as var_lib_nfs_t. Resolves: rhbz#1336737- Allow logwatch to domtrans to postqueue Resolves: rhbz#1331542 - Label /var/log/ganesha.log as gluster_log_t - Allow glusterd_t domain to create glusterd_log_t files. - Label /var/run/ganesha.pid as gluster_var_run_t. Resolves: rhbz#1335828 - Allow zabbix to connect to postgresql port Resolves: rhbz#1330479 - Add userdom_destroy_unpriv_user_shared_mem() interface. Related: rhbz#1306403 - systemd-logind remove all IPC objects owned by a user on a logout. This covers also SysV memory. This change allows to destroy unpriviledged user SysV shared memory segments. Resolves: rhbz#1306403- We need to restore contexts on /etc/passwd*,/etc/group*,/etc/*shadow* during install phase to get proper labeling for these files until selinux-policy pkgs are installed. Resolves: rhbz#1333952- Add interface glusterd_dontaudit_read_lib_dirs() Resolves: rhbz#1295680 - Dontaudit Occasionally observing AVC's while running geo-rep automation Resolves: rhbz#1295680 - Allow glusterd to manage socket files labeled as glusterd_brick_t. Resolves: rhbz#1331561 - Create new apache content template for files stored in user homedir. This change is needed to make working booleans: - httpd_enable_homedirs - httpd_read_user_content Resolves: rhbz#1246522 - Allow stunnel create log files. Resolves: rhbz#1296851 - Label tcp port 8181 as intermapper_port_t. Resolves: rhbz#1334783 - Label tcp/udp port 2024 as xinuexpansion4_port_t Resolves: rhbz#1334783 - Label tcp port 7002 as afs_pt_port_t Label tcp/udp port 2023 as xinuexpansion3_port_t Resolves: rhbz#1334783 - Dontaudit ldconfig read gluster lib files. Resolves: rhbz#1295680 - Add interface auth_use_nsswitch() to systemd_domain_template. Resolves: rhbz#1236579- Label /usr/bin/ganesha.nfsd as glusterd_exec_t to run ganesha as glusterd_t. Allow glusterd_t stream connect to rpbind_t. Allow cluster_t to create symlink /var/lib/nfs labeled as var_lib_nfs_t. Add interface rpc_filetrans_var_lib_nfs_content() Add new boolean: rpcd_use_fusefs to allow rpcd daemon use fusefs. Resolves: rhbz#1312809 Resolves: rhbz#1323947 - Allow dbus chat between httpd_t and oddjob_t. Resolves: rhbz#1324144 - Label /usr/libexec/ipa/oddjob/org.freeipa.server.conncheck as ipa_helper_exec_t. Resolves: rhbz#1324144 - Label /var/log/ipareplica-conncheck.log file as ipa_log_t Allow ipa_helper_t domain to manage logs labeledas ipa_log_t Allow ipa_helper_t to connect on http and kerberos_passwd ports. Resolves: rhbz#1324144 - Allow prosody to listen on port 5000 for mod_proxy65. Resolves: rhbz#1316918 - Allow pcp_pmcd_t domain to manage docker lib files. This rule is needed to allow pcp to collect container information when SELinux is enabled. Resolves: rhbz#1309454- Allow runnig php7 in fpm mode. From selinux-policy side, we need to allow httpd to read/write hugetlbfs. Resolves: rhbz#1319442 - Allow openvswitch daemons to run under openvswitch Linux user instead of root. This change needs allow set capabilities: chwon, setgid, setuid, setpcap. Resolves: rhbz#1296640 - Remove ftpd_home_dir() boolean from distro policy. Reason is that we cannot make this working due to m4 macro language limits. Resolves: rhbz#1097775 - /bin/mailx is labeled sendmail_exec_t, and enters the sendmail_t domain on execution. If /usr/sbin/sendmail does not have its own domain to transition to, and is not one of several products whose behavior is allowed by the sendmail_t policy, execution will fail. In this case we need to label /bin/mailx as bin_t. Resolves: rhbz#1262483 - Allow nsd daemon to create log file in /var/log as nsd_log_t Resolves: rhbz#1293140 - Sanlock policy update. - New sub-domain for sanlk-reset daemon Resolves: rhbz#1212324 - Label all run tgtd files, not just socket files Resolves: rhbz#1280280 - Label all run tgtd files, not just socket files. Resolves: rhbz#1280280 - Allow prosody to stream connect to sasl. This will allow using cyrus authentication in prosody. Resolves: rhbz#1321049 - unbound wants to use ephemeral ports as a default configuration. Allow to use also udp sockets. Resolves: rhbz#1318224 - Allow prosody to listen on port 5000 for mod_proxy65. Resolves: rhbz#1316918 - Allow targetd to read/write to /dev/mapper/control device. Resolves: rhbz#1063714 - Allow KDM to get status about power services. This change allow kdm to be able do shutdown. Resolves: rhbz#1316724 - Allow systemd-resolved daemon creating netlink_route sockets. Resolves:rhbz#1236579 - Allow systemd_resolved_t to read /etc/passwd file. Allow systemd_resolved_t to write to kmsg_device_t when 'systemd.log_target=kmsg' option is used Resolves: rhbz#1065362 - Label /etc/selinux/(minimum|mls|targeted)/active/ as semanage_store_t Resolves: rhbz#1321943 - Label all nvidia binaries as xserver_exec_t Resolves: rhbz#1322283- Create new permissivedomains CIL module and make it active. Resolves: rhbz#1320451 - Add support for new mock location - /usr/libexec/mock/mock. Resolves: rhbz#1271209 - Allow bitlee to create bitlee_var_t dirs. Resolves: rhbz#1268651 - Allow CIM provider to read sssd public files. Resolves: rhbz#1263339 - Fix some broken interfaces in distro policy. Resolves: rhbz#1121171 - Allow power button to shutdown the laptop. Resolves: rhbz#995898 - Allow lsm plugins to create named fixed disks. Resolves: rhbz#1238066 - Add default labeling for /etc/Pegasus/cimserver_current.conf. It is a correct patch instead of the current /etc/Pegasus/pegasus_current.confResolves: rhbz#1278777 - Allow hyperv domains to rw hyperv devices. Resolves: rhbz#1309361 - Label /var/www/html(/.*)?/wp_backups(/.*)? as httpd_sys_rw_content_t.Resolves: rhbz#1246780 - Create conman_unconfined_script_t type for conman script stored in /use/share/conman/exec/ Resolves: rhbz#1297323 - Fix rule definitions for httpd_can_sendmail boolean. We need to distinguish between base and contrib. - Add support for /dev/mptctl device used to check RAID status. Resolves: rhbz#1258029 - Create hyperv* devices and create rw interfaces for this devices. Resolves: rhbz#1309361 - Add fixes for selinux userspace moving the policy store to /var/lib/selinux. - Remove optional else block for dhcp ping- Allow rsync_export_all_ro boolean to read also non_auth_dirs/files/symlinks. Resolves: rhbz#1263770 - Fix context of "/usr/share/nginx/html". Resolves: rhbz#1261857 - Allow pmdaapache labeled as pcp_pmcd_t access to port 80 for apache diagnostics Resolves: rhbz#1270344 - Allow pmlogger to create pmlogger.primary.socket link file. Resolves: rhbz#1270344 - Label nagios scripts as httpd_sys_script_exec_t. Resolves: rhbz#1260306 - Add dontaudit interface for kdumpctl_tmp_t Resolves: rhbz#1156442 - Allow mdadm read files in EFI partition. Resolves: rhbz#1291801 - Allow nsd_t to bind on nsf_control tcp port. Allow nsd_crond_t to read nsd pid. Resolves: rhbz#1293140 - Label some new nsd binaries as nsd_exec_t Allow nsd domain net_admin cap. Create label nsd_tmp_t for nsd tmp files/dirs Resolves: rhbz#1293140 - Add filename transition that /etc/princap will be created with cupsd_rw_etc_t label in cups_filetrans_named_content() interface. Resolves: rhbz#1265102 - Add missing labeling for /usr/libexec/abrt-hook-ccpp. Resolves: rhbz#1213409 - Allow pcp_pmie and pcp_pmlogger to read all domains state. Resolves: rhbz#1206525 - Label /etc/redis-sentinel.conf as redis_conf_t. Allow redis_t write to redis_conf_t. Allow redis_t to connect on redis tcp port. Resolves: rhbz#1275246 - cockpit has grown content in /var/run directory Resolves: rhbz#1279429 - Allow collectd setgid capability Resolves:#1310898 - Remove declaration of empty booleans in virt policy. Resolves: rhbz#1103153 - Fix typo in drbd policy - Add new drbd file type: drbd_var_run_t. Allow drbd_t to manage drbd_var_run_t files/dirs. Allow drbd_t create drbd_tmp_t files in /tmp. Resolves: rhbz#1134883 - Label /etc/ctdb/events.d/* as ctdb_exec_t. Allow ctdbd_t to setattr on ctdbd_exec_t files. Resolves: rhbz#1293788 - Allow abrt-hook-ccpp to get attributes of all processes because of core_pattern. Resolves: rhbz#1254188 - Allow abrt_t to read sysctl_net_t files. Resolves: rhbz#1254188 - The ABRT coredump handler has code to emulate default core file creation The handler runs in a separate process with abrt_dump_oops_t SELinux process type. abrt-hook-ccpp also saves the core dump file in the very same way as kernel does and a user can specify CWD location for a coredump. abrt-hook-ccpp has been made as a SELinux aware apps to create this coredumps with correct labeling and with this commit the policy rules have been updated to allow access all non security files on a system. - Allow abrt-hook-ccpp to getattr on all executables. - Allow setuid/setgid capabilities for abrt-hook-ccpp. Resolves: rhbz#1254188 - abrt-hook-ccpp needs to have setfscreate access because it is SELinux aware and compute a target labeling. Resolves: rhbz#1254188 - Allow abrt-hook-ccpp to change SELinux user identity for created objects. Resolves: rhbz#1254188 - Dontaudit write access to inherited kdumpctl tmp files. Resolves: rbhz#1156442 - Add interface to allow reading files in efivarfs - contains Linux Kernel configuration options for UEFI systems (UEFI Runtime Variables) Resolves: rhbz#1291801 - Label 8952 tcp port as nsd_control. Resolves: rhbz#1293140 - Allow ipsec to use pam. Resolves: rhbz#1315700 - Allow to log out to gdm after screen was resized in session via vdagent. Resolves: rhbz#1249020 - Allow setrans daemon to read /proc/meminfo. Resolves: rhbz#1316804 - Allow systemd_networkd_t to write kmsg, when kernel was started with following params: systemd.debug systemd.log_level=debug systemd.log_target=kmsg Resolves: rhbz#1298151 - Label tcp port 5355 as llmnr-> Link-Local Multicast Name Resolution Resolves: rhbz#1236579 - Add new selinux policy for systemd-resolved dawmon. Resolves: rhbz#1236579 - Add interface ssh_getattr_server_keys() interface. Resolves: rhbz#1306197 - Allow run sshd-keygen on second boot if first boot fails after some reason and content is not syncedon the disk. These changes are reflecting this commit in sshd. http://pkgs.fedoraproject.org/cgit/rpms/openssh.git/commit/?id=af94f46861844cbd6ba4162115039bebcc8f78ba rhbz#1299106 Resolves: rhbz#1306197 - Allow systemd_notify_t to write to kmsg_device_t when 'systemd.log_target=kmsg' option is used. Resolves: rhbz#1309417 - Remove bin_t label for /etc/ctdb/events.d/. We need to label this scripts as ctdb_exec_t. Resolves: rhbz#1293788- Prepare selinux-policy package for userspace release 2016-02-23. Resolves: rhbz#1305982- Allow sending dbus msgs between firewalld and system_cronjob domains. Resolves: rhbz#1284902 - Allow zabbix-agentd to connect to following tcp sockets. One of zabbix-agentd functions is get service status of ftp,http,innd,pop,smtp protocols. Resolves: rhbz#1242506 - Add new boolean tmpreaper_use_cifs() to allow tmpreaper to run on local directories being shared with Samba. Resolves: rhbz#1284972 - Add support for systemd-hwdb daemon. Resolves: rhbz#1257940 - Add interface fs_setattr_cifs_dirs(). Resolves: rhbz#1284972- Add new SELinux policy fo targetd daemon. Resolves: rhbz#1063714 - Add new SELinux policy fo ipmievd daemon. Resolves: rhbz#1083031 - Add new SELinux policy fo hsqldb daemon. Resolves: rhbz#1083171 - Add new SELinux policy for blkmapd daemon. Resolves: rhbz#1072997 - Allow p11-child to connect to apache ports. - Label /usr/sbin/lvmlockd binary file as lvm_exec_t. Resolves: rhbz#1278028 - Add interface "lvm_manage_lock" to lvm policy. Resolves: rhbz#1063714- Allow openvswitch domain capability sys_rawio. Resolves: rhbz#1278495- Allow openvswitch to manage hugetlfs files and dirs. Resolves: rhbz#1278495 - Add fs_manage_hugetlbfs_files() interface. Resolves: rhbz#1278495- Allow smbcontrol domain to send sigchld to ctdbd domain. Resolves: #1293784 - Allow openvswitch read/write hugetlb filesystem. Resolves: #1278495Allow hypervvssd to list all mountpoints to have VSS live backup working correctly. Resolves:#1247880- Revert Add missing labeling for /usr/libexec/abrt-hook-ccpp patch Resolves: #1254188- Allow search dirs in sysfs types in kernel_read_security_state. Resolves: #1254188 - Fix kernel_read_security_state interface that source domain of this interface can search sysctl_fs_t dirs. Resolves: #1254188- Add missing labeling for /usr/libexec/abrt-hook-ccpp as a part of #1245477 and #1242467 bugs Resolves: #1254188 - We need allow connect to xserver for all sandbox_x domain because we have one type for all sandbox processes. Resolves:#1261938- Remove labeling for modules_dep_t file contexts to have labeled them as modules_object_t. - Update files_read_kernel_modules() to contain modutils_read_module_deps_files() calling because module deps labeling could remain and it allows to avoid regressions. Resolves:#1266928- We need to require sandbox_web_type attribute in sandbox_x_domain_template(). Resolves: #1261938 - ipsec: The NM helper needs to read the SAs Resolves: #1259786 - ipsec: Allow ipsec management to create ptys Resolves: #1259786- Add temporary fixes for sandbox related to #1103622. It allows to run everything under one sandbox type. Resolves:#1261938 - Allow abrt_t domain to write to kernel msg device. Resolves: #1257828 - Allow rpcbind_t domain to change file owner and group Resolves: #1265266- Allow smbcontrol to create a socket in /var/samba which uses for a communication with smbd, nmbd and winbind. Resolves: #1256459- Allow dirsrv-admin script to read passwd file. Allow dirsrv-admin script to read httpd pid files. Label dirsrv-admin unit file and allow dirsrv-admin domains to use it. Resolves: #1230300 - Allow qpid daemon to connect on amqp tcp port. Resolves: #1261805- Label /etc/ipa/nssdb dir as cert_t Resolves:#1262718 - Do not provide docker policy files which is shipped by docker-selinux.rpm Resolves:#1262812- Add labels for afs binaries: dafileserver, davolserver, salvageserver, dasalvager Resolves: #1192338 - Add lsmd_plugin_t sys_admin capability, Allow lsmd_plugin_t getattr from sysfs filesystem. Resolves: #1238079 - Allow rhsmcertd_t send signull to unconfined_service_t domains. Resolves: #1176078 - Remove file transition from snmp_manage_var_lib_dirs() interface which created snmp_var_lib_t dirs in var_lib_t. - Allow openhpid_t daemon to manage snmp files and dirs. Resolves: #1243902 - Allow mdadm_t domain read/write to general ptys and unallocated ttys. Resolves: #1073314 - Add interface unconfined_server_signull() to allow domains send signull to unconfined_service_t Resolves: #1176078- Allow systemd-udevd to access netlink_route_socket to change names for network interfaces without unconfined.pp module. It affects also MLS. Resolves:#1250456- Fix labeling for fence_scsi_check script Resolves: #1255020 - Allow openhpid to read system state Allow openhpid to connect to tcp http port. Resolves: #1244248 - Allow openhpid to read snmp var lib files. Resolves: #1243902 - Allow openvswitch_t domains read kernel dependencies due to openvswitch run modprobe - Allow unconfined_t domains to create /var/run/xtables.lock with iptables_var_run_t Resolves: #1243403 - Remove bin_t label for /usr/share/cluster/fence_scsi_check\.pl Resolves: #1255020- Fix regexp in chronyd.fc file Resolves: #1243764 - Allow passenger to getattr filesystem xattr Resolves: #1196555 - Label mdadm.conf.anackbak as mdadm_conf_t file. Resolves: #1088904 - Revert "Allow pegasus_openlmi_storage_t create mdadm.conf.anacbak file in /etc." - Allow watchdog execute fenced python script. Resolves: #1255020 - Added inferface watchdog_unconfined_exec_read_lnk_files() - Remove labeling for /var/db/.*\.db as etc_t to label db files as system_db_t. Resolves: #1230877- Allow watchdog execute fenced python script. Resolves: #1255020 - Added inferface watchdog_unconfined_exec_read_lnk_files() - Label /var/run/chrony-helper dir as chronyd_var_run_t. Resolves: #1243764 - Allow dhcpc_t domain transition to chronyd_t Resolves: #1243764- Fix postfix_spool_maildrop_t,postfix_spool_flush_t contexts in postfix.fc file. Resolves: #1252442- Allow exec pidof under hypervkvp domain. Resolves: #1254870 - Allow hypervkvp daemon create connection to the system DBUS Resolves: #1254870- Allow openhpid_t to read system state. Resolves: #1244248 - Added labels for files provided by rh-nginx18 collection Resolves: #1249945 - Dontaudit block_suspend capability for ipa_helper_t, this is kernel bug. Allow ipa_helper_t capability net_admin. Allow ipa_helper_t to list /tmp. Allow ipa_helper_t to read rpm db. Resolves: #1252968 - Allow rhsmcertd exec rhsmcertd_var_run_t files and rhsmcerd_tmp_t files. This rules are in hide_broken_sympthons until we find better solution. Resolves: #1243431 - Allow abrt_dump_oops_t to read proc_security_t files. - Allow abrt_dump_oops to signull all domains Allow abrt_dump_oops to read all domains state Allow abrt_dump_oops to ptrace all domains - Add interface abrt_dump_oops_domtrans() - Add mountpoint dontaudit access check in rhsmcertd policy. Resolves: #1243431 - Allow samba_net_t to manage samba_var_t sock files. Resolves: #1252937 - Allow chrome setcap to itself. Resolves: #1251996 - Allow httpd daemon to manage httpd_var_lib_t lnk_files. Resolves: #1253706 - Allow chronyd exec systemctl Resolves: #1243764 - Add inteface chronyd_signal Allow timemaster_t send generic signals to chronyd_t. Resolves: #1243764 - Added interface fs_dontaudit_write_configfs_dirs - Add label for kernel module dep files in /usr/lib/modules Resolves:#916635 - Allow kernel_t domtrans to abrt_dump_oops_t - Added to files_dontaudit_write_all_mountpoints intefface new dontaudit rule, that domain included this interface dontaudit capability dac_override. - Allow systemd-networkd to send logs to systemd-journald. Resolves: #1236616- Fix label on /var/tmp/kiprop_0 Resolves:#1220763 - Allow lldpad_t to getattr tmpfs_t. Resolves: #1246220 - Label /dev/shm/lldpad.* as lldapd_tmpfs_t Resolves: #1246220 - Allow audisp client to read system state.- Allow pcp_domain to manage pcp_var_lib_t lnk_files. Resolves: #1252341 - Label /var/run/xtables.* as iptables_var_run_t Resolves: #1243403- Add interface to read/write watchdog device - Add labels for /dev/memory_bandwith and /dev/vhci. Thanks ssekidde Resolves:#1210237 - Allow apcupsd_t to read /sys/devices Resolves:#1189185 - Allow logrotate to reload services. Resolves: #1242453 - Allow openhpid use libwatchdog plugin. (Allow openhpid_t rw watchdog device) Resolves: #1244260 - Allow openhpid liboa_soap plugin to read generic certs. Resolves: #1244248 - Allow openhpid liboa_soap plugin to read resolv.conf file. Resolves: #1244248 - Label /usr/libexec/chrony-helper as chronyd_exec_t - Allow chronyd_t to read dhcpc state. - Allow chronyd to execute mkdir command.- Allow mdadm to access /dev/random and add support to create own files/dirs as mdadm_tmpfs_t. Resolves:#1073314 - Allow udev, lvm and fsadm to access systemd-cat in /var/tmp/dracut if 'dracut -fv' is executed in MLS. - Allow admin SELinu users to communicate with kernel_t. It is needed to access /run/systemd/journal/stdout if 'dracut -vf' is executed. We allow it for other SELinux users. - Allow sysadm to execute systemd-sysctl in the sysadm_t domain. It is needed for ifup command in MLS mode. - Add fstools_filetrans_named_content_fsadm() and call it for named_filetrans_domain domains. We need to be sure that /run/blkid is created with correct labeling. Resolves:#1183503 - Add support for /etc/sanlock which is writable by sanlock daemon. Resolves:#1231377 - Allow useradd add homedir located in /var/lib/kdcproxy in ipa-server RPM scriplet. Resolves:#1243775 - Allow snapperd to pass data (one way only) via pipe negotiated over dbus Resolves:#1250550 - Allow lsmd also setuid capability. Some commands need to executed under root privs. Other commands are executed under unprivileged user.- Allow openhpid to use libsnmp_bc plugin (allow read snmp lib files). Resolves: #1243902 - Allow lsm_plugin_t to read sysfs, read hwdata, rw to scsi_generic_device Resolves: #1238079 - Allow lsm_plugin_t to rw raw_fixed_disk. Resolves:#1238079 - Allow rhsmcertd to send signull to unconfined_service.- Allow httpd_suexec_t to read and write Apache stream sockets Resolves: #1243569 - Allow qpid to create lnk_files in qpid_var_lib_t Resolves: #1247279- Allow drbd to get attributes from filesystems. - Allow redis to read kernel parameters. Resolves: #1209518 - Allow virt_qemu_ga_t domtrans to passwd_t - Allow audisp_remote_t to start power unit files domain to allow halt system. Resolves: #1186780 - Allow audisp_remote_t to read/write user domain pty. Resolves: #1186780 - Label /usr/sbin/chpasswd as passwd_exec_t. - Allow sysadm to administrate ldap environment and allow to bind ldap port to allow to setup an LDAP server (389ds). Resolves:#1221121- gnome_dontaudit_search_config() needs to be a part of optinal_policy in pegasus.te - Allow pcp_pmcd daemon to read postfix config files. - Allow pcp_pmcd daemon to search postfix spool dirs. Resolves: #1213740 - Added Booleans: pcp_read_generic_logs. Resolves: #1213740 - Allow drbd to read configuration options used when loading modules. Resolves: #1134883 - Allow glusterd to manage nfsd and rpcd services. - Allow glusterd to communicate with cluster domains over stream socket. - glusterd call pcs utility which calls find for cib.* files and runs pstree under glusterd. Dontaudit access to security files and update gluster boolean to reflect these changes.- Allow glusterd to manage nfsd and rpcd services. - Allow networkmanager to communicate via dbus with systemd_hostanmed. Resolves: #1234954 - Allow stream connect logrotate to prosody. - Add prosody_stream_connect() interface. - httpd should be able to send signal/signull to httpd_suexec_t, instead of httpd_suexec_exec_t. - Allow prosody to create own tmp files/dirs. Resolves:#1212498- Allow networkmanager read rfcomm port. Resolves:#1212498 - Remove non exists label. - Fix *_admin intefaces where body is not consistent with header. - Label /usr/afs/ as afs_files_t, Allow afs_bosserver_t create afs_config_t and afs_dbdir_t dirs under afs_files_t, Allow afs_bosserver_t read kerberos config - Remove non exits nfsd_ro_t label. - Make all interfaces related to openshift_cache_t as deprecated. - Add rpm_var_run_t label to rpm_admin header - Add jabberd_lock_t label to jabberd_admin header. - Add samba_unconfined_script_exec_t to samba_admin header. - inn daemon should create innd_log_t objects in var_log_t instead of innd_var_run_t - Fix ctdb policy - Add samba_signull_winbind() - Add samba_signull_unconfined_net() - Allow ctdbd_t send signull to samba_unconfined_net_t. - Allow openshift_initrc_t to communicate with firewalld over dbus Resolves:#1221326- Allow gluster to connect to all ports. It is required by random services executed by gluster. - Add interfaces winbind_signull(), samba_unconfined_net_signull(). - Dontaudit smbd_t block_suspend capability. This is kernel bug. - Allow ctdbd sending signull to process winbind, samba_unconfined_net, to checking if processes exists. - Add tmpreaper booleans to use nfs_t and samba_share_t. - Fix path from /usr/sbin/redis-server to /usr/bin/redis-server - Allow connect ypserv to portmap_port_t - Fix paths in inn policy, Allow innd read innd_log_t dirs, Allow innd execute innd_etc_t files - Add support for openstack-nova-* packages - Allow NetworkManager_t send signull to dnssec_trigger_t. - Allow glusterd to execute showmount in the showmount domain. - Label swift-container-reconciler binary as swift_t. - Allow dnssec_trigger_t relabelfrom dnssec_trigger_var_run_t files. - Add cobbler_var_lib_t to "/var/lib/tftpboot/boot(/.*)?" Resolves:#1213540 - Merge all nova_* labels under one nova_t.- Add logging_syslogd_run_nagios_plugins boolean for rsyslog to allow transition to nagios unconfined plugins Resolves:#1233550 - Allow dnssec_trigger_t create dnssec_trigger_tmp_t files in /var/tmp/ - Add support for oddjob based helper in FreeIPA. - Add new boolean - httpd_run_ipa to allow httpd process to run IPA helper and dbus chat with oddjob. - Add nagios_domtrans_unconfined_plugins() interface. - Update mta_filetrans_named_content() interface to cover more db files. Resolves:#1167468 - Add back ftpd_use_passive_mode boolean with fixed description. - Allow pmcd daemon stream connect to mysqld. - Allow pcp domains to connect to own process using unix_stream_socket. Resolves:#1213709 - Allow abrt-upload-watch service to dbus chat with ABRT daemon and fsetid capability to allow run reporter-upload correctly. - Add new boolean - httpd_run_ipa to allow httpd process to run IPA helper and dbus chat with oddjob. - Add support for oddjob based helper in FreeIPA. - Allow dnssec_trigger_t create dnssec_trigger_tmp_t files in /var/tmp/- Allow iptables to read ctdbd lib files. Resolves:#1224879 - Add systemd_networkd_t to nsswitch domains. - Allow drbd_t write to fixed_disk_device. Reason: drbdmeta needs write to fixed_disk_device during initialization. Resolves:#1130675 - Allow NetworkManager write to sysfs. - Fix cron_system_cronjob_use_shares boolean to call fs interfaces which contain only entrypoint permission. - Add cron_system_cronjob_use_shares boolean to allow system cronjob to be executed from shares - NFS, CIFS, FUSE. It requires "entrypoint" permissios on nfs_t, cifs_t and fusefs_t SELinux types. - Allow NetworkManager write to sysfs. - Allow ctdb_t sending signull to smbd_t, for checking if smbd process exists. - Dontaudit apache to manage snmpd_var_lib_t files/dirs. - Add interface snmp_dontaudit_manage_snmp_var_lib_files(). - Dontaudit mozilla_plugin_t cap. sys_ptrace. - Rename xodbc-connect port to xodbc_connect - Allow ovsdb-server to connect on xodbc-connect and ovsdb tcp ports. - Allow iscsid write to fifo file kdumpctl_tmp_t. Appears when kdump generates the initramfs during the kernel boot. - Dontaudit chrome to read passwd file. - nrpe needs kill capability to make gluster moniterd nodes working. Resolves:#1235587- We allow can_exec() on ssh_keygen on gluster. But there is a transition defined by init_initrc_domain() because we need to allow execute unconfined services by glusterd. So ssh-keygen ends up with ssh_keygen_t and we need to allow to manage /var/lib/glusterd/geo-replication/secret.pem. - Allow sshd to execute gnome-keyring if there is configured pam_gnome_keyring.so. - Allow gnome-keyring executed by passwd to access /run/user/UID/keyring to change a password. - Label gluster python hooks also as bin_t. - Allow glusterd to interact with gluster tools running in a user domain - Add glusterd_manage_lib_files() interface. - ntop reads /var/lib/ntop/macPrefix.db and it needs dac_override. It has setuid/setgid. - Allow samba_t net_admin capability to make CIFS mount working. - S30samba-start gluster hooks wants to search audit logs. Dontaudit it. Resolves:#1224879- Allow glusterd to send generic signals to systemd_passwd_agent processes. - Allow glusterd to access init scripts/units without defined policy - Allow glusterd to run init scripts. - Allow glusterd to execute /usr/sbin/xfs_dbin glusterd_t domain. Resolves:#1224879- Calling cron_system_entry() in pcp_domain_template needs to be a part of optional_policy block. - Allow samba-net to access /var/lib/ctdbd dirs/files. - Allow glusterd to send a signal to smbd. - Make ctdbd as home manager to access also FUSE. - Allow glusterd to use geo-replication gluster tool. - Allow glusterd to execute ssh-keygen. - Allow glusterd to interact with cluster services. - Allow glusterd to connect to the system DBUS for service (acquire_svc). - Label /dev/log correctly. Resolves:#1230932- Back port the latest F22 changes to RHEL7. It should fix most of RHEL7.2 bugs - Add cgdcbxd policy Resolves:#1072493 - Fix ftp_homedir boolean Resolve:#1097775 - Dontaudit ifconfig writing inhertited /var/log/pluto.log. - Allow cluster domain to dbus chat with systemd-logind. Resolves:#1145215 - Dontaudit write access to inherited kdumpctl tmp files Resolves:#1156442 - Allow isnsd_t to communicate with sssd Resolves:#1167702 - Allow rwho_t to communicate with sssd Resolves:#1167718 - Allow sblim_gatherd_t to communicate with sssd Resolves:#1167732 - Allow pkcs_slotd_t to communicate with sssd Resolves:#1167737 - Allow openvswitch_t to communicate with sssd Resolves:#1167816 - Allow mysqld_safe_t to communicate with sssd Resolves:#1167832 - Allow sshd_keygen_t to communicate with sssd Resolves:#1167840 - Add support for iprdbg logging files in /var/log. Resolves:#1174363 - Allow tmpreaper_t to manage ntp log content Resolves:#1176965 - Allow gssd_t to manage ssh keyring Resolves:#1184791 - Allow httpd_sys_script_t to send system log messages Resolves:#1185231 - Allow apcupsd_t to read /sys/devices Resolves:#1189185 - Allow dovecot_t sys_resource capability Resolves:#1191143 - Add support for mongod/mongos systemd unit files. Resolves:#1197038 - Add bacula fixes - Added label mysqld_etc_t for /etc/my.cnf.d/ dir. Resolves:#1203991- Label /usr/libexec/postgresql-ctl as postgresql_exec_t. - Add more restriction on entrypoint for unconfined domains. - Only allow semanage_t to be able to setenforce 0, no all domains that use selinux_semanage interface - Allow all domains to read /dev/urandom. It is needed by all apps/services linked to libgcrypt. There is no harm to allow it by default. - Update policy/mls for sockets related to access perm. Rules were contradictory. - Add nagios_run_pnp4nagios and nagios_run_sudo booleans to allow r un sudo from NRPE utils scripts and allow run nagios in conjunction w ith PNP4Nagios. Resolves:#1201054 - Don't use deprecated userdom_manage_tmpfs_role() interface calliing and use userdom_manage_tmp_role() instead. - Update virt_read_pid_files() interface to allow read also symlinks with virt_var_run_t type - Label /var/lib/tftpboot/aarch64(/.*)? and /var/lib/tftpboot/images2(/.*)? - Add support for iprdbg logging files in /var/log. - Add fixes to rhsmcertd_t - Allow puppetagent_t to transfer firewalld messages over dbus - Add support for /usr/libexec/mongodb-scl-helper RHSCL helper script. - Added label mysqld_etc_t for /etc/my.cnf.d/ dir. - Add support for mongod/mongos systemd unit files. - cloudinit and rhsmcertd need to communicate with dbus - Allow dovecot_t sys_resource capability- ALlow mongod execmem by default. - Update policy/mls for sockets. Rules were contradictory. Resolves:#1207133 - Allow a user to login with different security level via ssh.- Update seutil_manage_config() interface. Resolves:#1185962 - Allow pki-tomcat relabel pki_tomcat_etc_rw_t. - Turn on docker_transition_unconfined by default- Allow virtd to list all mountpoints. Resolves:#1180713- pkcsslotd_lock_t should be an alias for pkcs_slotd_lock_t. - Allow fowner capability for sssd because of selinux_child handling. - ALlow bind to read/write inherited ipsec pipes - Allow hypervkvp to read /dev/urandom and read addition states/config files. - Allow gluster rpm scripletto create glusterd socket with correct labeling. This is a workaround until we get fix in glusterd. - Add glusterd_filetrans_named_pid() interface - Allow radiusd to connect to radsec ports. - Allow setuid/setgid for selinux_child - Allow lsmd plugin to connect to tcp/5988 by default. - Allow lsmd plugin to connect to tcp/5989 by default. - Update ipsec_manage_pid() interface. Resolves:#1184978- Update ipsec_manage_pid() interface. Resolves:#1184978- Allow ntlm_auth running in winbind_helper_t to access /dev/urandom.- Add auditing support for ipsec. Resolves:#1182524 - Label /ostree/deploy/rhel-atomic-host/deploy directory as system_conf_t - Allow netutils chown capability to make tcpdump working with -w- Allow ipsec to execute _updown.netkey script to run unbound-control. - Allow neutron to read rpm DB. - Add additional fixes for hyperkvp * creates new ifcfg-{name} file * Runs hv_set_ifconfig.sh, which does the following * Copies ifcfg-{name} to /etc/sysconfig/network-scripts - Allow svirt to read symbolic links in /sys/fs/cgroups labeled as tmpfs_t - Add labeling for pacemaker.log. - Allow radius to connect/bind radsec ports. - Allow pm-suspend running as virt_qemu_ga to read /var/log/pm-suspend.log - Allow virt_qemu_ga to dbus chat with rpm. - Update virt_read_content() interface to allow read also char devices. - Allow glance-registry to connect to keystone port. Resolves:#1181818- Allow sssd to send dbus all user domains. Resolves:#1172291 - Allow lsm plugin to read certificates. - Fix labeling for keystone CGI scripts. - Make snapperd back as unconfined domain.- Fix bugs in interfaces discovered by sepolicy. - Allow slapd to read /usr/share/cracklib/pw_dict.hwm. - Allow lsm plugins to connect to tcp/18700 by default. - Allow brltty mknod capability to allow create /var/run/brltty/vcsa. - Fix pcp_domain_template() interface. - Fix conman.te. - Allow mon_fsstatd to read /proc/sys/fs/binfmt_misc - Allow glance-scrubber to connect tcp/9191. - Add missing setuid capability for sblim-sfcbd. - Allow pegasus ioctl() on providers. - Add conman_can_network. - Allow chronyd to read chrony conf files located in /run/timemaster/. - Allow radius to bind on tcp/1813 port. - dontaudit block suspend access for openvpn_t - Allow conman to create files/dirs in /tmp. - Update xserver_rw_xdm_keys() interface to have 'setattr'. Resolves:#1172291 - Allow sulogin to read /dev/urandom and /dev/random. - Update radius port definition to have also tcp/18121 - Label prandom as random_device_t. - Allow charon to manage files in /etc/strongimcv labeled as ipsec_conf_t.- Allow virt_qemu_ga_t to execute kmod. - Add missing files_dontaudit_list_security_dirs() for smbd_t in samba_export_all_ro boolean. - Add additionnal MLS attribute for oddjob_mkhomedir to create homedirs. Resolves:#1113725 - Enable OpenStack cinder policy - Add support for /usr/share/vdsm/daemonAdapter - Add support for /var/run/gluster- Remove old pkcsslotd.pp from minimum package - Allow rlogind to use also rlogin ports. - Add support for /usr/libexec/ntpdate-wrapper. Label it as ntpdate_exec_t. - Allow bacula to connect also to postgresql. - Label /usr/libexec/tomcat/server as tomcat_exec_t - Add support for /usr/sbin/ctdbd_wrapper - Add support for /usr/libexec/ppc64-diag/rtas_errd - Allow rpm_script_roles to access system_mail_t - Allow brltty to create /var/run/brltty - Allow lsmd plugin to access netlink_route_socket - Allow smbcontrol to read passwd - Add support for /usr/libexec/sssd/selinux_child and create sssd_selinux_manager_t domain for it Resolves:#1140106 - Allow osad to execute rhn_check - Allow load_policy to rw inherited sssd pipes because of selinux_child - Allow admin SELinux users mounting / as private within a new mount namespace as root in MLS - Add additional fixes for su_restricted_domain_template to make moving to sysadm_r and trying to su working correctly - Add additional booleans substitions- Add seutil_dontaudit_access_check_semanage_module_store() interface Resolves:#1140106 - Update to have all _systemctl() interface also init_reload_services(). - Dontaudit access check on SELinux module store for sssd. - Add labeling for /sbin/iw. - Allow named_filetrans_domain to create ibus directory with correct labeling.- Allow radius to bind tcp/1812 radius port. - Dontaudit list user_tmp files for system_mail_t. - Label virt-who as virtd_exec_t. - Allow rhsmcertd to send a null signal to virt-who running as virtd_t. - Add missing alias for _content_rw_t. Resolves:#1089177 - Allow spamd to access razor-agent.log. - Add fixes for sfcb from libvirt-cim TestOnly bug. - Allow NetworkManager stream connect on openvpn. - Make /usr/bin/vncserver running as unconfined_service_t. - getty_t should be ranged in MLS. Then also local_login_t runs as ranged domain. - Label /etc/docker/certs.d as cert_t.- Label /etc/strongimcv as ipsec_conf_file_t. - Add support for /usr/bin/start-puppet-ca helper script Resolves:#1160727 - Allow rpm scripts to enable/disable transient systemd units. Resolves:#1154613 - Make kpropdas nsswitch domain Resolves:#1153561 - Make all glance domain as nsswitch domains Resolves:#1113281 - Allow selinux_child running as sssd access check on /etc/selinux/targeted/modules/active - Allow access checks on setfiles/load_policy/semanage_lock for selinux_child running as sssd_t Resolves:#1140106- Dontaudit access check on setfiles/load_policy for sssd_t. Resolves:#1140106 - Add kdump_rw_inherited_kdumpctl_tmp_pipes() Resolves:#1156442 - Make linuxptp services as unconfined. - Added new policy linuxptp. Resolves:#1149693 - Label keystone cgi files as keystone_cgi_script_exec_t. Resolves:#1138424 - Make tuned as unconfined domain- Allow guest to connect to libvirt using unix_stream_socket. - Allow all bus client domains to dbus chat with unconfined_service_t. - Allow inetd service without own policy to run in inetd_child_t which is unconfined domain. - Make opensm as nsswitch domain to make it working with sssd. - Allow brctl to read meminfo. - Allow winbind-helper to execute ntlm_auth in the caller domain. Resolves:#1160339 - Make plymouthd as nsswitch domain to make it working with sssd. Resolves:#1160196 - Make drbd as nsswitch domain to make it working with sssd. - Make conman as nsswitch domain to make ipmitool.exp runing as conman_t working. - Add support for /var/lib/sntp directory. - Add fixes to allow docker to create more content in tmpfs ,and donaudit reading /proc - Allow winbind to read usermodehelper - Allow telepathy domains to execute shells and bin_t - Allow gpgdomains to create netlink_kobject_uevent_sockets - Allow mongodb to bind to the mongo port and mongos to run as mongod_t - Allow abrt to read software raid state. - Allow nslcd to execute netstat. - Allow dovecot to create user's home directory when they log into IMAP. - Allow login domains to create kernel keyring with different level.- Allow modemmanger to connectto itself Resolves:#1120152 - Allow pki_tomcat to create link files in /var/lib/pki-ca. Resolves:#1121744 - varnishd needs to have fsetid capability Resolves:#1125165 - Allow snapperd to dbus chat with system cron jobs. Resolves:#1152447 - Allow dovecot to create user's home directory when they log into IMAP Resolves:#1152773 - Add labeling for /usr/sbin/haproxy-systemd-wrapper wrapper to make haproxy running haproxy_t. - ALlow listen and accept on tcp socket for init_t in MLS. Previously it was for xinetd_t. - Allow nslcd to execute netstat. - Add suppor for keepalived unconfined scripts and allow keepalived to read all domain state and kill capability. - Allow nslcd to read /dev/urandom.- Add back kill permisiion for system class Resolves:#1150011- Add back kill permisiion for service class Resolves:#1150011 - Make rhsmcertd_t also as dbus domain. - Allow named to create DNS_25 with correct labeling. - Add cloudform_dontaudit_write_cloud_log() - Call auth_use_nsswitch to apache to read/write cloud-init keys. - Allow cloud-init to dbus chat with certmonger. - Fix path to mon_statd_initrc_t script. - Allow all RHCS services to read system state. - Allow dnssec_trigger_t to execute unbound-control in own domain. - kernel_read_system_state needs to be called with type. Moved it to antivirus.if. - Added policy for mon_statd and mon_procd services. BZ (1077821) - Allow opensm_t to read/write /dev/infiniband/umad1. - Allow mongodb to manage own log files. - Allow neutron connections to system dbus. - Add support for /var/lib/swiftdirectory. - Allow nova-scheduler to read certs. - Allow openvpn to access /sys/fs/cgroup dir. - Allow openvpn to execute systemd-passwd-agent in systemd_passwd_agent_t to make openvpn working with systemd. - Fix samba_export_all_ro/samba_export_all_rw booleans to dontaudit search/read security files. - Add auth_use_nsswitch for portreserve to make it working with sssd. - automount policy is non-base module so it needs to be called in optional block. - ALlow sensord to getattr on sysfs. - Label /usr/share/corosync/corosync as cluster_exec_t. - Allow lmsd_plugin to read passwd file. BZ(1093733) - Allow read antivirus domain all kernel sysctls. - Allow mandb to getattr on file systems - Allow nova-console to connect to mem_cache port. - Make sosreport as unconfined domain. - Allow mondogdb to 'accept' accesses on the tcp_socket port. - ALlow sanlock to send a signal to virtd_t.- Build also MLS policy Resolves:#1138424- Add back kill permisiion for system class - Allow iptables read fail2ban logs. - Fix radius labeled ports - Add userdom_manage_user_tmpfs_files interface - Allow libreswan to connect to VPN via NM-libreswan. - Label 4101 tcp port as brlp port - fix dev_getattr_generic_usb_dev interface - Allow all domains to read fonts - Make sure /run/systemd/generator and system is labeled correctly on creation. - Dontaudit aicuu to search home config dir. - Make keystone_cgi_script_t domain. Resolves:#1138424 - Fix bug in drbd policy, - Added support for cpuplug. - ALlow sanlock_t to read sysfs_t. - Added sendmail_domtrans_unconfined interface - Fix broken interfaces - radiusd wants to write own log files. - Label /usr/libexec/rhsmd as rhsmcertd_exec_t - Allow rhsmcertd send signull to setroubleshoot. - Allow rhsmcertd manage rpm db. - Added policy for blrtty. - Fix keepalived policy - Allow rhev-agentd dbus chat with systemd-logind. - Allow keepalived manage snmp var lib sock files. - Add support for /var/lib/graphite-web - Allow NetworkManager to create Bluetooth SDP sockets - It's going to do the the discovery for DUN service for modems with Bluez 5. - Allow swift to connect to all ephemeral ports by default. - Allow sssd to read selinux config to add SELinux user mapping. - Allow lsmd to search own plguins. - Allow abrt to read /dev/memto generate an unique machine_id and uses sosuploader's algorithm based off dmidecode[1] fields. - ALlow zebra for user/group look-ups. - Allow nova domains to getattr on all filesystems. - Allow collectd sys_ptrace and dac_override caps because of reading of /proc/%i/io for several processes. - Allow pppd to connect to /run/sstpc/sstpc-nm-sstp-service-28025 over unix stream socket. - Allow rhnsd_t to manage also rhnsd config symlinks. - ALlow user mail domains to create dead.letter. - Allow rabbitmq_t read rabbitmq_var_lib_t lnk files. - Allow pki-tomcat to change SELinux object identity. - Allow radious to connect to apache ports to do OCSP check - Allow git cgi scripts to create content in /tmp - Allow cockpit-session to do GSSAPI logins. - Allow sensord read in /proc - Additional access required by usbmuxd- Allow locate to look at files/directories without labels, and chr_file and blk_file on non dev file systems - Label /usr/lib/erlang/erts.*/bin files as bin_t - Add files_dontaudit_access_check_home_dir() inteface. - Allow udev_t mounton udev_var_run_t dirs #(1128618) - Add systemd_networkd_var_run_t labeling for /var/run/systemd/netif and allow systemd-networkd to manage it. - Add init_dontaudit_read_state() interface. - Add label for ~/.local/share/fonts - Allow unconfined_r to access unconfined_service_t. - Allow init to read all config files - Add new interface to allow creation of file with lib_t type - Assign rabbitmq port. - Allow unconfined_service_t to dbus chat with all dbus domains - Add new interfaces to access users keys. - Allow domains to are allowed to mounton proc to mount on files as well as dirs - Fix labeling for HOME_DIR/tmp and HOME_DIR/.tmp directories. - Add a port definition for shellinaboxd - Label ~/tmp and ~/.tmp directories in user tmp dirs as user_tmp_t - Allow userdomains to stream connect to pcscd for smart cards - Allow programs to use pam to search through user_tmp_t dires (/tmp/.X11-unix) - Update to rawhide-contrib changes Resolves:#1123844- Rebase to 3.13.1 which we have in Fedora21 Resolves:#1128284- Back port fixes from Fedora. Mainly OpenStack and Docker fixes- Add policy-rhel-7.1-{base,contrib} patches- Add support for us_cli ports - Fix labeling for /var/run/user//gvfs - add support for tcp/9697 - Additional rules required by openstack, needs backport to F20 and RHEL7 - Additional access required by docker - ALlow motion to use tcp/8082 port - Allow init_t to setattr/relabelfrom dhcp state files - Dontaudit antivirus domains read access on all security files by default - Add missing alias for old amavis_etc_t type - Allow block_suspend cap for haproxy - Additional fixes for instack overcloud - Allow OpenStack to read mysqld_db links and connect to MySQL - Remove dup filename rules in gnome.te - Allow sys_chroot cap for httpd_t and setattr on httpd_log_t - Allow iscsid to handle own unit files - Add iscsi_systemctl() - Allow mongod to create also sock_files in /run with correct labeling - Allow httpd to send signull to apache script domains and don't audit leaks - Allow rabbitmq_beam to connect to httpd port - Allow aiccu stream connect to pcscd - Allow dmesg to read hwdata and memory dev - Allow all freeipmi domains to read/write ipmi devices - Allow sblim_sfcbd to use also pegasus-https port - Allow rabbitmq_epmd to manage rabbit_var_log_t files - Allow chronyd to read /sys/class/hwmon/hwmon1/device/temp2_input - Allow docker to status any unit file and allow it to start generic unit files- Change hsperfdata_root to have as user_tmp_t Resolves:#1076523- Fix Multiple same specifications for /var/named/chroot/dev/zero - Add labels for /var/named/chroot_sdb/dev devices - Add support for strongimcv - Use kerberos_keytab_domains in auth_use_nsswitch - Update auth_use_nsswitch to make all these types as kerberos_keytab_domain to - Allow net_raw cap for neutron_t and send sigkill to dnsmasq - Fix ntp_filetrans_named_content for sntp-kod file - Add httpd_dbus_sssd boolean - Dontaudit exec insmod in boinc policy - Rename kerberos_keytab_domain to kerberos_keytab_domains - Add kerberos_keytab_domain() - Fix kerberos_keytab_template() - Make all domains which use kerberos as kerberos_keytab_domain Resolves:#1083670 - Allow kill capability to winbind_t- varnishd wants chown capability - update ntp_filetrans_named_content() interface - Add additional fixes for neutron_t. #1083335 - Dontaudit getattr on proc_kcore_t - Allow pki_tomcat_t to read ipa lib files - Allow named_filetrans_domain to create /var/cache/ibus with correct labelign - Allow init_t run /sbin/augenrules - Add dev_unmount_sysfs_fs and sysnet_manage_ifconfig_run interfaces - Allow unpriv SELinux user to use sandbox - Add default label for /tmp/hsperfdata_root- Add file subs also for /var/home- Allow xauth_t to read user_home_dir_t lnk_file - Add labeling for lightdm-data - Allow certmonger to manage ipa lib files - Add support for /var/lib/ipa - Allow pegasus to getattr virt_content - Added some new rules to pcp policy - Allow chrome_sandbox to execute config_home_t - Add support for ABRT FAF- Allow kdm to send signull to remote_login_t process - Add gear policy - Turn on gear_port_t - Allow cgit to read gitosis lib files by default - Allow vdagent to read xdm state - Allow NM and fcoeadm to talk together over unix_dgram_socket- Back port fixes for pegasus_openlmi_admin_t from rawhide Resolves:#1080973 - Add labels for ostree - Add SELinux awareness for NM - Label /usr/sbin/pwhistory_helper as updpwd_exec_t- add gnome_append_home_config() - Allow thumb to append GNOME config home files - Allow rasdaemon to rw /dev/cpu//msr - fix /var/log/pki file spec - make bacula_t as auth_nsswitch domain - Identify pki_tomcat_cert_t as a cert_type - Define speech-dispater_exec_t as an application executable - Add a new file context for /var/named/chroot/run directory - update storage_filetrans_all_named_dev for sg* devices - Allow auditctl_t to getattr on all removeable devices - Allow nsswitch_domains to stream connect to nmbd - Allow unprivusers to connect to memcached - label /var/lib/dirsrv/scripts-INSTANCE as bin_t- Allow also unpriv user to run vmtools - Allow secadm to read /dev/urandom and meminfo Resolves:#1079250 - Add booleans to allow docker processes to use nfs and samba - Add mdadm_tmpfs support - Dontaudit net_amdin for /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.51-2.4.5.1.el7.x86_64/jre-abrt/bin/java running as pki_tomcat_t - Allow vmware-user-sui to use user ttys - Allow talk 2 users logged via console too - Allow ftp services to manage xferlog_t - Make all pcp domanis as unconfined for RHEL7.0 beucause of new policies - allow anaconda to dbus chat with systemd-localed- allow anaconda to dbus chat with systemd-localed - Add fixes for haproxy based on bperkins@redhat.com - Allow cmirrord to make dmsetup working - Allow NM to execute arping - Allow users to send messages through talk - Add userdom_tmp_role for secadm_t- Add additional fixes for rtas_errd - Fix transitions for tmp/tmpfs in rtas.te - Allow rtas_errd to readl all sysctls- Add support for /var/spool/rhsm/debug - Make virt_sandbox_use_audit as True by default - Allow svirt_sandbox_domains to ptrace themselves- Allow docker containers to manage /var/lib/docker content- Allow docker to read tmpfs_t symlinks - Allow sandbox svirt_lxc_net_t to talk to syslog and to sssd over stream sockets- Allow collectd to talk to libvirt - Allow chrome_sandbox to use leaked unix_stream_sockets - Dontaudit leaks of sockets into chrome_sandbox_t - If you create a cups directory in /var/cache then it should be labeled cups_rw_etc_t - Run vmtools as unconfined domains - Allow snort to manage its log files - Allow systemd_cronjob_t to be entered via bin_t - Allow procman to list doveconf_etc_t - allow keyring daemon to create content in tmpfs directories - Add proper labelling for icedtea-web - vpnc is creating content in networkmanager var run directory - Label sddm as xdm_exec_t to make KDE working again - Allow postgresql to read network state - Allow java running as pki_tomcat to read network sysctls - Fix cgroup.te to allow cgred to read cgconfig_etc_t - Allow beam.smp to use ephemeral ports - Allow winbind to use the nis to authenticate passwords- Make rtas_errd_t as unconfined domain for F20.It needs additional fixes. It runs rpm at least. - Allow net_admin cap for fence_virtd running as fenced_t - Make abrt-java-connector working - Make cimtest script 03_defineVS.py of ComputerSystem group working - Fix git_system_enable_homedirs boolean - Allow munin mail plugins to read network systcl- Allow vmtools_helper_t to execute bin_t - Add support for /usr/share/joomla - /var/lib/containers should be labeled as openshift content for now - Allow docker domains to talk to the login programs, to allow a process to login into the container - Allow install_t do dbus chat with NM - Fix interface names in anaconda.if - Add install_t for anaconda. A new type is a part of anaconda policy - sshd to read network sysctls- Allow zabbix to send system log msgs - Allow init_t to stream connect to ipsec Resolves:#1060775- Add docker_connect_any boolean- Allow unpriv SELinux users to dbus chat with firewalld - Add lvm_write_metadata() - Label /etc/yum.reposd dir as system_conf_t. Should be safe because system_conf_t is base_ro_file_type - Allow pegasus_openlmi_storage_t to write lvm metadata - Add hide_broken_symptoms for kdumpgui because of systemd bug - Make kdumpgui_t as unconfined domain Resolves:#1044299 - Allow docker to connect to tcp/5000- Allow numad to write scan_sleep_millisecs - Turn on entropyd_use_audio boolean by default - Allow cgred to read /etc/cgconfig.conf because it contains templates used together with rules from /etc/cgrules.conf. - Allow lscpu running as rhsmcertd_t to read /proc/sysinfo - Fix label on irclogs in the homedir - Allow kerberos_keytab_domain domains to manage keys until we get sssd fix - Allow postgresql to use ldap - Add missing syslog-conn port - Add support for /dev/vmcp and /dev/sclp Resolves:#1069310- Modify xdm_write_home to allow create files/links in /root with xdm_home_ - Allow virt domains to read network state Resolves:#1072019- Added pcp rules - dontaudit openshift_cron_t searching random directories, should be back ported to RHEL6 - clean up ctdb.te - Allow ctdbd to connect own ports - Fix samba_export_all_rw booleanto cover also non security dirs - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs - Allow neutron to create /run/netns with correct labeling - Allow certmonger to list home dirs- Change userdom_use_user_inherited_ttys to userdom_use_user_ttys for systemd-tty-ask - Add sysnet_filetrans_named_content_ifconfig() interface - Allow ctdbd to connect own ports - Fix samba_export_all_rw booleanto cover also non security dirs - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs - Allow neutron to create /run/netns with correct labeling - Allow kerberos keytab domains to manage sssd/userdomain keys" - Allow to run ip cmd in neutron_t domain- Allow block_suspend cap2 for systemd-logind and rw dri device - Add labeling for /usr/libexec/nm-libreswan-service - Allow locallogin to rw xdm key to make Virtual Terminal login providing smartcard pin working - Add xserver_rw_xdm_keys() - Allow rpm_script_t to dbus chat also with systemd-located - Fix ipa_stream_connect_otpd() - update lpd_manage_spool() interface - Allow krb5kdc to stream connect to ipa-otpd - Add ipa_stream_connect_otpd() interface - Allow vpnc to unlink NM pids - Add networkmanager_delete_pid_files() - Allow munin plugins to access unconfined plugins - update abrt_filetrans_named_content to cover /var/spool/debug - Label /var/spool/debug as abrt_var_cache_t - Allow rhsmcertd to connect to squid port - Make docker_transition_unconfined as optional boolean - Allow certmonger to list home dirs- Make snapperd as unconfined domain and add additional fixes for it - Remove nsplugin.pp module on upgrade- Add snapperd_home_t for HOME_DIR/.snapshots directory - Make sosreport as unconfined domain - Allow sosreport to execute grub2-probe - Allow NM to manage hostname config file - Allow systemd_timedated_t to dbus chat with rpm_script_t - Allow lsmd plugins to connect to http/ssh/http_cache ports by default - Add lsmd_plugin_connect_any boolean - Allow mozilla_plugin to attempt to set capabilities - Allow lsdm_plugins to use tcp_socket - Dontaudit mozilla plugin from getattr on /proc or /sys - Dontaudit use of the keyring by the services in a sandbox - Dontaudit attempts to sys_ptrace caused by running ps for mysqld_safe_t - Allow rabbitmq_beam to connect to jabber_interserver_port - Allow logwatch_mail_t to transition to qmail_inject and queueu - Added new rules to pcp policy - Allow vmtools_helper_t to change role to system_r - Allow NM to dbus chat with vmtools - Fix couchdb_manage_files() to allow manage couchdb conf files - Add support for /var/run/redis.sock - dontaudit gpg trying to use audit - Allow consolekit to create log directories and files - Fix vmtools policy to allow user roles to access vmtools_helper_t - Allow block_suspend cap2 for ipa-otpd - Allow pkcsslotd to read users state - Add ioctl to init_dontaudit_rw_stream_socket - Add systemd_hostnamed_manage_config() interface - Remove transition for temp dirs created by init_t - gdm-simple-slave uses use setsockopt - sddm-greater is a xdm type program- Add lvm_read_metadata() - Allow auditadm to search /var/log/audit dir - Add lvm_read_metadata() interface - Allow confined users to run vmtools helpers - Fix userdom_common_user_template() - Generic systemd unit scripts do write check on / - Allow init_t to create init_tmp_t in /tmp.This is for temporary content created by generic unit files - Add additional fixes needed for init_t and setup script running in generic unit files - Allow general users to create packet_sockets - added connlcli port - Add init_manage_transient_unit() interface - Allow init_t (generic unit files) to manage rpc state date as we had it for initrc_t - Fix userdomain.te to require passwd class - devicekit_power sends out a signal to all processes on the message bus when power is going down - Dontaudit rendom domains listing /proc and hittping system_map_t - Dontauit leaks of var_t into ifconfig_t - Allow domains that transition to ssh_t to manipulate its keyring - Define oracleasm_t as a device node - Change to handle /root as a symbolic link for os-tree - Allow sysadm_t to create packet_socket, also move some rules to attributes - Add label for openvswitch port - Remove general transition for files/dirs created in /etc/mail which got etc_aliases_t label. - Allow postfix_local to read .forward in pcp lib files - Allow pegasus_openlmi_storage_t to read lvm metadata - Add additional fixes for pegasus_openlmi_storage_t - Allow bumblebee to manage debugfs - Make bumblebee as unconfined domain - Allow snmp to read etc_aliases_t - Allow lscpu running in pegasus_openlmi_storage_t to read /dev/mem - Allow pegasus_openlmi_storage_t to read /proc/1/environ - Dontaudit read gconf files for cupsd_config_t - make vmtools as unconfined domain - Add vmtools_helper_t for helper scripts. Allow vmtools shutdonw a host and run ifconfig. - Allow collectd_t to use a mysql database - Allow ipa-otpd to perform DNS name resolution - Added new policy for keepalived - Allow openlmi-service provider to manage transitient units and allow stream connect to sssd - Add additional fixes new pscs-lite+polkit support - Add labeling for /run/krb5kdc - Change w3c_validator_tmp_t to httpd_w3c_validator_tmp_t in F20 - Allow pcscd to read users proc info - Dontaudit smbd_t sending out random signuls - Add boolean to allow openshift domains to use nfs - Allow w3c_validator to create content in /tmp - zabbix_agent uses nsswitch - Allow procmail and dovecot to work together to deliver mail - Allow spamd to execute files in homedir if boolean turned on - Allow openvswitch to listen on port 6634 - Add net_admin capability in collectd policy - Fixed snapperd policy - Fixed bugsfor pcp policy - Allow dbus_system_domains to be started by init - Fixed some interfaces - Add kerberos_keytab_domain attribute - Fix snapperd_conf_t def- Addopt corenet rules for unbound-anchor to rpm_script_t - Allow runuser to send send audit messages. - Allow postfix-local to search .forward in munin lib dirs - Allow udisks to connect to D-Bus - Allow spamd to connect to spamd port - Fix syntax error in snapper.te - Dontaudit osad to search gconf home files - Allow rhsmcertd to manage /etc/sysconf/rhn director - Fix pcp labeling to accept /usr/bin for all daemon binaries - Fix mcelog_read_log() interface - Allow iscsid to manage iscsi lib files - Allow snapper domtrans to lvm_t. Add support for /etc/snapper and allow snapperd to manage it. - Make tuned_t as unconfined domain for RHEL7.0 - Allow ABRT to read puppet certs - Add sys_time capability for virt-ga - Allow gemu-ga to domtrans to hwclock_t - Allow additional access for virt_qemu_ga_t processes to read system clock and send audit messages - Fix some AVCs in pcp policy - Add to bacula capability setgid and setuid and allow to bind to bacula ports - Changed label from rhnsd_rw_conf_t to rhnsd_conf_t - Add access rhnsd and osad to /etc/sysconfig/rhn - drbdadm executes drbdmeta - Fixes needed for docker - Allow epmd to manage /var/log/rabbitmq/startup_err file - Allow beam.smp connect to amqp port - Modify xdm_write_home to allow create also links as xdm_home_t if the boolean is on true - Allow init_t to manage pluto.ctl because of init_t instead of initrc_t - Allow systemd_tmpfiles_t to manage all non security files on the system - Added labels for bacula ports - Fix label on /dev/vfio/vfio - Add kernel_mounton_messages() interface - init wants to manage lock files for iscsi- Added osad policy - Allow postfix to deliver to procmail - Allow bumblebee to seng kill signal to xserver - Allow vmtools to execute /usr/bin/lsb_release - Allow docker to write system net ctrls - Add support for rhnsd unit file - Add dbus_chat_session_bus() interface - Add dbus_stream_connect_session_bus() interface - Fix pcp.te - Fix logrotate_use_nfs boolean - Add lot of pcp fixes found in RHEL7 - fix labeling for pmie for pcp pkg - Change thumb_t to be allowed to chat/connect with session bus type - Allow call renice in mlocate - Add logrotate_use_nfs boolean - Allow setroubleshootd to read rpc sysctl- Turn on bacula, rhnsd policy - Add support for rhnsd unit file - Add dbus_chat_session_bus() interface - Add dbus_stream_connect_session_bus() interface - Fix logrotate_use_nfs boolean - Add lot of pcp fixes found in RHEL7 - fix labeling for pmie for pcp pkg - Change thumb_t to be allowed to chat/connect with session bus type - Allow call renice in mlocate - Add logrotate_use_nfs boolean - Allow setroubleshootd to read rpc sysctl - Fixes for *_admin interfaces - Add pegasus_openlmi_storage_var_run_t type def - Add support for /var/run/openlmi-storage - Allow tuned to create syslog.conf with correct labeling - Add httpd_dontaudit_search_dirs boolean - Add support for winbind.service - ALlow also fail2ban-client to read apache logs - Allow vmtools to getattr on all fs - Add support for dey_sapi port - Add logging_filetrans_named_conf() - Allow passwd_t to use ipc_lock, so that it can change the password in gnome-keyring- Update snapper policy - Allow domains to append rkhunter lib files - Allow snapperd to getattr on all fs - Allow xdm to create /var/gdm with correct labeling - Add label for snapper.log - Allow fail2ban-client to read apache log files - Allow thumb_t to execute dbus-daemon in thumb_t- Allow gdm to create /var/gdm with correct labeling - Allow domains to append rkhunterl lib files. #1057982 - Allow systemd_tmpfiles_t net_admin to communicate with journald - Add interface to getattr on an isid_type for any type of file - Update libs_filetrans_named_content() to have support for /usr/lib/debug directory - Allow initrc_t domtrans to authconfig if unconfined is enabled - Allow docker and mount on devpts chr_file - Allow docker to transition to unconfined_t if boolean set - init calling needs to be optional in domain.te - Allow uncofined domain types to handle transient unit files - Fix labeling for vfio devices - Allow net_admin capability and send system log msgs - Allow lldpad send dgram to NM - Add networkmanager_dgram_send() - rkhunter_var_lib_t is correct type - Back port pcp policy from rawhide - Allow openlmi-storage to read removable devices - Allow system cron jobs to manage rkhunter lib files - Add rkhunter_manage_lib_files() - Fix ftpd_use_fusefs boolean to allow manage also symlinks - Allow smbcontrob block_suspend cap2 - Allow slpd to read network and system state info - Allow NM domtrans to iscsid_t if iscsiadm is executed - Allow slapd to send a signal itself - Allow sslget running as pki_ra_t to contact port 8443, the secure port of the CA. - Fix plymouthd_create_log() interface - Add rkhunter policy with files type definition for /var/lib/rkhunter until it is fixed in rkhunter package - Add mozilla_plugin_exec_t for /usr/lib/firefox/plugin-container - Allow postfix and cyrus-imapd to work out of box - Allow fcoemon to talk with unpriv user domain using unix_stream_socket - Dontaudit domains that are calling into journald to net_admin - Add rules to allow vmtools to do what it does - snapperd is D-Bus service - Allow OpenLMI PowerManagement to call 'systemctl --force reboot' - Add haproxy_connect_any boolean - Allow haproxy also to use http cache port by default Resolves:#1058248- Allow apache to write to the owncloud data directory in /var/www/html... - Allow consolekit to create log dir - Add support for icinga CGI scripts - Add support for icinga - Allow kdumpctl_t to create kdump lock file Resolves:#1055634 - Allow kdump to create lnk lock file - Allow nscd_t block_suspen capability - Allow unconfined domain types to manage own transient unit file - Allow systemd domains to handle transient init unit files - Add interfaces to handle transient- Add cron unconfined role support for uncofined SELinux user - Call corenet_udp_bind_all_ports() in milter.te - Allow fence_virtd to connect to zented port - Fix header for mirrormanager_admin() - Allow dkim-milter to bind udp ports - Allow milter domains to send signull itself - Allow block_suspend for yum running as mock_t - Allow beam.smp to manage couchdb files - Add couchdb_manage_files() - Add labeling for /var/log/php_errors.log - Allow bumblebee to stream connect to xserver - Allow bumblebee to send a signal to xserver - gnome-thumbnail to stream connect to bumblebee - Allow xkbcomp running as bumblebee_t to execute bin_t - Allow logrotate to read squid.conf - Additional rules to get docker and lxc to play well with SELinux - Allow bumbleed to connect to xserver port - Allow pegasus_openlmi_storage_t to read hwdata- Allow init_t to work on transitient and snapshot unit files - Add logging_manage_syslog_config() - Update sysnet_dns_name_resolve() to allow connect to dnssec por - Allow pegasus_openlmi_storage_t to read hwdata Resolves:#1031721 - Fix rhcs_rw_cluster_tmpfs() - Allow fenced_t to bind on zented udp port - Added policy for vmtools - Fix mirrormanager_read_lib_files() - Allow mirromanager scripts running as httpd_t to manage mirrormanager pid files - Allow ctdb to create sock files in /var/run/ctdb - Add sblim_filetrans_named_content() interface - Allow rpm scritplets to create /run/gather with correct labeling - Allow gnome keyring domains to create gnome config dirs - Dontaudit read/write to init stream socket for lsmd_plugin_t - Allow automount to read nfs link files - Allow lsm plugins to read/write lsmd stream socket - Allow certmonger to connect ldap port to make IPA CA certificate renewal working. - Add also labeling for /var/run/ctdb - Add missing labeling for /var/lib/ctdb - ALlow tuned to manage syslog.conf. Should be fixed in tuned. #1030446 - Dontaudit hypervkvp to search homedirs - Dontaudit hypervkvp to search admin homedirs - Allow hypervkvp to execute bin_t and ifconfig in the caller domain - Dontaudit xguest_t to read ABRT conf files - Add abrt_dontaudit_read_config() - Allow namespace-init to getattr on fs - Add thumb_role() also for xguest - Add filename transitions to create .spamassassin with correct labeling - Allow apache domain to read mirrormanager pid files - Allow domains to read/write shm and sem owned by mozilla_plugin_t - Allow alsactl to send a generic signal to kernel_t- Add back rpm_run() for unconfined user- Add missing files_create_var_lib_dirs() - Fix typo in ipsec.te - Allow passwd to create directory in /var/lib - Add filename trans also for event21 - Allow iptables command to read /dev/rand - Add sigkill capabilityfor ipsec_t - Add filename transitions for bcache devices - Add additional rules to create /var/log/cron by syslogd_t with correct labeling - Add give everyone full access to all key rings - Add default lvm_var_run_t label for /var/run/multipathd - Fix log labeling to have correct default label for them after logrotate - Labeled ~/.nv/GLCache as being gstreamer output - Allow nagios_system_plugin to read mrtg lib files - Add mrtg_read_lib_files() - Call rhcs_rw_cluster_tmpfs for dlm_controld - Make authconfing as named_filetrans domain - Allow virsh to connect to user process using stream socket - Allow rtas_errd to read rand/urand devices and add chown capability - Fix labeling from /var/run/net-snmpd to correct /var/run/net-snmp Resolves:#1051497 - Add also chown cap for abrt_upload_watch_t. It already has dac_override - Allow sosreport to manage rhsmcertd pid files - Add rhsmcertd_manage_pid_files() - Allow also setgid cap for rpc.gssd - Dontaudit access check for abrt on cert_t - Allow pegasus_openlmi_system providers to dbus chat with systemd-logind- Fix semanage import handling in spec file- Add default lvm_var_run_t label for /var/run/multipathd Resolves:#1051430 - Fix log labeling to have correct default label for them after logrotate - Add files_write_root_dirs - Add new openflow port label for 6653/tcp and 6633/tcp - Add xserver_manage_xkb_libs() - Label tcp/8891 as milter por - Allow gnome_manage_generic_cache_files also create cache_home_t files - Fix aide.log labeling - Fix log labeling to have correct default label for them after logrotate - Allow mysqld-safe write access on /root to make mysqld working - Allow sosreport domtrans to prelikn - Allow OpenvSwitch to connec to openflow ports - Allow NM send dgram to lldpad - Allow hyperv domains to execute shell - Allow lsmd plugins stream connect to lsmd/init - Allow sblim domains to create /run/gather with correct labeling - Allow httpd to read ldap certs - Allow cupsd to send dbus msgs to process with different MLS level - Allow bumblebee to stream connect to apmd - Allow bumblebee to run xkbcomp - Additional allow rules to get libvirt-lxc containers working with docker - Additional allow rules to get libvirt-lxc containers working with docker - Allow docker to getattr on itself - Additional rules needed for sandbox apps - Allow mozilla_plugin to set attributes on usb device if use_spice boolean enabled - httpd should be able to send signal/signull to httpd_suexec_t - Add more fixes for neturon. Domtrans to dnsmasq, iptables. Make neutron as filenamtrans domain.- Add neutron fixes- Allow sshd to write to all process levels in order to change passwd when running at a level - Allow updpwd_t to downgrade /etc/passwd file to s0, if it is not running with this range - Allow apcuspd_t to status and start the power unit file - Allow udev to manage kdump unit file - Added new interface modutils_dontaudit_exec_insmod - Allow cobbler to search dhcp_etc_t directory - systemd_systemctl needs sys_admin capability - Allow sytemd_tmpfiles_t to delete all directories - passwd to create gnome-keyring passwd socket - Add missing zabbix_var_lib_t type - Fix filename trans for zabbixsrv in zabbix.te - Allow fprintd_t to send syslog messages - Add zabbix_var_lib_t for /var/lib/zabbixsrv, also allow zabix to connect to smtp port - Allow mozilla plugin to chat with policykit, needed for spice - Allow gssprozy to change user and gid, as well as read user keyrings - Label upgrades directory under /var/www as httpd_sys_rw_content_t, add other filetrans rules to label content correctly - Allow polipo to connect to http_cache_ports - Allow cron jobs to manage apache var lib content - Allow yppassword to manage the passwd_file_t - Allow showall_t to send itself signals - Allow cobbler to restart dhcpc, dnsmasq and bind services - Allow certmonger to manage home cert files - Add userdom filename trans for user mail domains - Allow apcuspd_t to status and start the power unit file - Allow cgroupdrulesengd to create content in cgoups directories - Allow smbd_t to signull cluster - Allow gluster daemon to create fifo files in glusterd_brick_t and sock_file in glusterd_var_lib_t - Add label for /var/spool/cron.aquota.user - Allow sandbox_x domains to use work with the mozilla plugin semaphore - Added new policy for speech-dispatcher - Added dontaudit rule for insmod_exec_t in rasdaemon policy - Updated rasdaemon policy - Allow system_mail_t to transition to postfix_postdrop_t - Clean up mirrormanager policy - Allow virt_domains to read cert files, needs backport to RHEL7 - Allow sssd to read systemd_login_var_run_t - Allow irc_t to execute shell and bin-t files: - Add new access for mythtv - Allow rsync_t to manage all non auth files - allow modemmanger to read /dev/urand - Allow sandbox apps to attempt to set and get capabilties- Add labeling for /var/lib/servicelog/servicelog.db-journal - Add support for freeipmi port - Add sysadm_u_default_contexts - Make new type to texlive files in homedir - Allow subscription-manager running as sosreport_t to manage rhsmcertd - Additional fixes for docker.te - Remove ability to do mount/sys_admin by default in virt_sandbox domains - New rules required to run docker images within libivrt - Add label for ~/.cvsignore - Change mirrormanager to be run by cron - Add mirrormanager policy - Fixed bumblebee_admin() and mip6d_admin() - Add log support for sensord - Fix typo in docker.te - Allow amanda to do backups over UDP - Allow bumblebee to read /etc/group and clean up bumblebee.te - type transitions with a filename not allowed inside conditionals - Don't allow virt-sandbox tools to use netlink out of the box, needs back port to RHEL7 - Make new type to texlive files in homedir- Allow freeipmi_ipmidetectd_t to use freeipmi port - Update freeipmi_domain_template() - Allow journalctl running as ABRT to read /run/log/journal - Allow NM to read dispatcher.d directory - Update freeipmi policy - Type transitions with a filename not allowed inside conditionals - Allow tor to bind to hplip port - Make new type to texlive files in homedir - Allow zabbix_agent to transition to dmidecode - Add rules for docker - Allow sosreport to send signull to unconfined_t - Add virt_noatsecure and virt_rlimitinh interfaces - Fix labeling in thumb.fc to add support for /usr/lib64/tumbler-1/tumblerddd support for freeipmi port - Add sysadm_u_default_contexts - Add logging_read_syslog_pid() - Fix userdom_manage_home_texlive() interface - Make new type to texlive files in homedir - Add filename transitions for /run and /lock links - Allow virtd to inherit rlimit information Resolves:#975358- Change labeling for /usr/libexec/nm-dispatcher.action to NetworkManager_exec_t Resolves:#1039879 - Add labeling for /usr/lib/systemd/system/mariadb.service - Allow hyperv_domain to read sysfs - Fix ldap_read_certs() interface to allow acess also link files - Add support for /usr/libexec/pegasus/cmpiLMI_Journald-cimprovagt - Allow tuned to run modprobe - Allow portreserve to search /var/lib/sss dir - Add SELinux support for the teamd package contains team network device control daemon. - Dontaudit access check on /proc for bumblebee - Bumblebee wants to load nvidia modules - Fix rpm_named_filetrans_log_files and wine.te - Add conman policy for rawhide - DRM master and input event devices are used by the TakeDevice API - Clean up bumblebee policy - Update pegasus_openlmi_storage_t policy - Add freeipmi_stream_connect() interface - Allow logwatch read madm.conf to support RAID setup - Add raid_read_conf_files() interface - Allow up2date running as rpm_t create up2date log file with rpm_log_t labeling - add rpm_named_filetrans_log_files() interface - Allow dkim-milter to create files/dirs in /tmp - update freeipmi policy - Add policy for freeipmi services - Added rdisc_admin and rdisc_systemctl interfaces - opensm policy clean up - openwsman policy clean up - ninfod policy clean up - Added new policy for ninfod - Added new policy for openwsman - Added rdisc_admin and rdisc_systemctl interfaces - Fix kernel_dontaudit_access_check_proc() - Add support for /dev/uhid - Allow sulogin to get the attributes of initctl and sys_admin cap - Add kernel_dontaudit_access_check_proc() - Fix dev_rw_ipmi_dev() - Fix new interface in devices.if - DRM master and input event devices are used by the TakeDevice API - add dev_rw_inherited_dri() and dev_rw_inherited_input_dev() - Added support for default conman port - Add interfaces for ipmi devices- Allow sosreport to send a signal to ABRT - Add proper aliases for pegasus_openlmi_service_exec_t and pegasus_openlmi_service_t - Label /usr/sbin/htcacheclean as httpd_exec_t Resolves:#1037529 - Added support for rdisc unit file - Add antivirus_db_t labeling for /var/lib/clamav-unofficial-sigs - Allow runuser running as logrotate connections to system DBUS - Label bcache devices as fixed_disk_device_t - Allow systemctl running in ipsec_mgmt_t to access /usr/lib/systemd/system/ipsec.service - Label /usr/lib/systemd/system/ipsec.service as ipsec_mgmt_unit_file_t- Add back setpgid/setsched for sosreport_t- Added fix for clout_init to transition to rpm_script_t (dwalsh@redhat.com)- Dontaudit openshift domains trying to use rawip_sockets, this is caused by a bad check in the kernel. - Allow git_system_t to read git_user_content if the git_system_enable_homedirs boolean is turned on - Add lsmd_plugin_t for lsm plugins - Allow dovecot-deliver to search mountpoints - Add labeling for /etc/mdadm.conf - Allow opelmi admin providers to dbus chat with init_t - Allow sblim domain to read /dev/urandom and /dev/random - Allow apmd to request the kernel load modules - Add glusterd_brick_t type - label mate-keyring-daemon with gkeyringd_exec_t - Add plymouthd_create_log() - Dontaudit leaks from openshift domains into mail domains, needs back port to RHEL6 - Allow sssd to request the kernel loads modules - Allow gpg_agent to use ssh-add - Allow gpg_agent to use ssh-add - Dontaudit access check on /root for myslqd_safe_t - Allow ctdb to getattr on al filesystems - Allow abrt to stream connect to syslog - Allow dnsmasq to list dnsmasq.d directory - Watchdog opens the raw socket - Allow watchdog to read network state info - Dontaudit access check on lvm lock dir - Allow sosreport to send signull to setroubleshootd - Add setroubleshoot_signull() interface - Fix ldap_read_certs() interface - Allow sosreport all signal perms - Allow sosreport to run systemctl - Allow sosreport to dbus chat with rpm - Add glusterd_brick_t files type - Allow zabbix_agentd to read all domain state - Clean up rtas.if - Allow smoltclient to execute ldconfig - Allow sosreport to request the kernel to load a module - Fix userdom_confined_admin_template() - Add back exec_content boolean for secadm, logadm, auditadm - Fix files_filetrans_system_db_named_files() interface - Allow sulogin to getattr on /proc/kcore - Add filename transition also for servicelog.db-journal - Add files_dontaudit_access_check_root() - Add lvm_dontaudit_access_check_lock() interface- Allow watchdog to read /etc/passwd - Allow browser plugins to connect to bumblebee - New policy for bumblebee and freqset - Add new policy for mip6d daemon - Add new policy for opensm daemon - Allow condor domains to read/write condor_master udp_socket - Allow openshift_cron_t to append to openshift log files, label /var/log/openshift - Add back file_pid_filetrans for /var/run/dlm_controld - Allow smbd_t to use inherited tmpfs content - Allow mcelog to use the /dev/cpu device - sosreport runs rpcinfo - sosreport runs subscription-manager - Allow staff_t to run frequency command - Allow systemd_tmpfiles to relabel log directories - Allow staff_t to read xserver_log file - Label hsperfdata_root as tmp_t- More sosreport fixes to make ABRT working- Fix files_dontaudit_unmount_all_mountpoints() - Add support for 2608-2609 tcp/udp ports - Should allow domains to lock the terminal device - More fixes for user config files to make crond_t running in userdomain - Add back disable/reload/enable permissions for system class - Fix manage_service_perms macro - We need to require passwd rootok - Fix zebra.fc - Fix dnsmasq_filetrans_named_content() interface - Allow all sandbox domains create content in svirt_home_t - Allow zebra domains also create zebra_tmp_t files in /tmp - Add support for new zebra services:isisd,babeld. Add systemd support for zebra services. - Fix labeling on neutron and remove transition to iconfig_t - abrt needs to read mcelog log file - Fix labeling on dnsmasq content - Fix labeling on /etc/dnsmasq.d - Allow glusterd to relabel own lib files - Allow sandbox domains to use pam_rootok, and dontaudit attempts to unmount file systems, this is caused by a bug in systemd - Allow ipc_lock for abrt to run journalctl- Fix config.tgz- Fix passenger_stream_connect interface - setroubleshoot_fixit wants to read network state - Allow procmail_t to connect to dovecot stream sockets - Allow cimprovagt service providers to read network states - Add labeling for /var/run/mariadb - pwauth uses lastlog() to update system's lastlog - Allow account provider to read login records - Add support for texlive2013 - More fixes for user config files to make crond_t running in userdomain - Add back disable/reload/enable permissions for system class - Fix manage_service_perms macro - Allow passwd_t to connect to gnome keyring to change password - Update mls config files to have cronjobs in the user domains - Remove access checks that systemd does not actually do- Add support for yubikey in homedir - Add support for upd/3052 port - Allow apcupsd to use PowerChute Network Shutdown - Allow lsmd to execute various lsmplugins - Add labeling also for /etc/watchdog\.d where are watchdog scripts located too - Update gluster_export_all_rw boolean to allow relabel all base file types - Allow x86_energy_perf tool to modify the MSR - Fix /var/lib/dspam/data labeling- Add files_relabel_base_file_types() interface - Allow netlabel-config to read passwd - update gluster_export_all_rw boolean to allow relabel all base file types caused by lsetxattr() - Allow x86_energy_perf tool to modify the MSR - Fix /var/lib/dspam/data labeling - Allow pegasus to domtrans to mount_t - Add labeling for unconfined scripts in /usr/libexec/watchdog/scripts - Add support for unconfined watchdog scripts - Allow watchdog to manage own log files- Add label only for redhat.repo instead of /etc/yum.repos.d. But probably we will need to switch for the directory. - Label /etc/yum.repos.d as system_conf_t - Use sysnet_filetrans_named_content in udev.te instead of generic transition for net_conf_t - Allow dac_override for sysadm_screen_t - Allow init_t to read ipsec_conf_t as we had it for initrc_t. Needed by ipsec unit file. - Allow netlabel-config to read meminfo - Add interface to allow docker to mounton file_t - Add new interface to exec unlabeled files - Allow lvm to use docker semaphores - Setup transitons for .xsessions-errors.old - Change labels of files in /var/lib/*/.ssh to transition properly - Allow staff_t and user_t to look at logs using journalctl - pluto wants to manage own log file - Allow pluto running as ipsec_t to create pluto.log - Fix alias decl in corenetwork.te.in - Add support for fuse.glusterfs - Allow dmidecode to read/write /run/lock/subsys/rhsmcertd - Allow rhsmcertd to manage redhat.repo which is now labeled as system.conf. Allow rhsmcertd to manage all log files. - Additional access for docker - Added more rules to sblim policy - Fix kdumpgui_run_bootloader boolean - Allow dspam to connect to lmtp port - Included sfcbd service into sblim policy - rhsmcertd wants to manaage /etc/pki/consumer dir - Add kdumpgui_run_bootloader boolean - Add support for /var/cache/watchdog - Remove virt_domain attribute for virt_qemu_ga_unconfined_t - Fixes for handling libvirt containes - Dontaudit attempts by mysql_safe to write content into / - Dontaudit attempts by system_mail to modify network config - Allow dspam to bind to lmtp ports - Add new policy to allow staff_t and user_t to look at logs using journalctl - Allow apache cgi scripts to list sysfs - Dontaudit attempts to write/delete user_tmp_t files - Allow all antivirus domains to manage also own log dirs - Allow pegasus_openlmi_services_t to stream connect to sssd_t- Add missing permission checks for nscd- Fix alias decl in corenetwork.te.in - Add support for fuse.glusterfs - Add file transition rules for content created by f5link - Rename quantum_port information to neutron - Allow all antivirus domains to manage also own log dirs - Rename quantum_port information to neutron - Allow pegasus_openlmi_services_t to stream connect to sssd_t- Allow sysadm_t to read login information - Allow systemd_tmpfiles to setattr on var_log_t directories - Udpdate Makefile to include systemd_contexts - Add systemd_contexts - Add fs_exec_hugetlbfs_files() interface - Add daemons_enable_cluster_mode boolean - Fix rsync_filetrans_named_content() - Add rhcs_read_cluster_pid_files() interface - Update rhcs.if with additional interfaces from RHEL6 - Fix rhcs_domain_template() to not create run dirs with cluster_var_run_t - Allow glusterd_t to mounton glusterd_tmp_t - Allow glusterd to unmout al filesystems - Allow xenstored to read virt config - Add label for swift_server.lock and make add filetrans_named_content to make sure content gets created with the correct label - Allow mozilla_plugin_t to mmap hugepages as an executable- Add back userdom_security_admin_template() interface and use it for sysadm_t if sysadm_secadm.pp- Allow sshd_t to read openshift content, needs backport to RHEL6.5 - Label /usr/lib64/sasl2/libsasldb.so.3.0.0 as textrel_shlib_t - Make sur kdump lock is created with correct label if kdumpctl is executed - gnome interface calls should always be made within an optional_block - Allow syslogd_t to connect to the syslog_tls port - Add labeling for /var/run/charon.ctl socket - Add kdump_filetrans_named_content() - Allo setpgid for fenced_t - Allow setpgid and r/w cluster tmpfs for fenced_t - gnome calls should always be within optional blocks - wicd.pid should be labeled as networkmanager_var_run_t - Allow sys_resource for lldpad- Add rtas policy- Allow mailserver_domains to manage and transition to mailman data - Dontaudit attempts by mozilla plugin to relabel content, caused by using mv and cp commands - Allow mailserver_domains to manage and transition to mailman data - Allow svirt_domains to read sysctl_net_t - Allow thumb_t to use tmpfs inherited from the user - Allow mozilla_plugin to bind to the vnc port if running with spice - Add new attribute to discover confined_admins and assign confined admin to it - Fix zabbix to handle attributes in interfaces - Fix zabbix to read system states for all zabbix domains - Fix piranha_domain_template() - Allow ctdbd to create udp_socket. Allow ndmbd to access ctdbd var files. - Allow lldpad sys_rouserce cap due to #986870 - Allow dovecot-auth to read nologin - Allow openlmi-networking to read /proc/net/dev - Allow smsd_t to execute scripts created on the fly labeled as smsd_spool_t - Add zabbix_domain attribute for zabbix domains to treat them together - Add labels for zabbix-poxy-* (#1018221) - Update openlmi-storage policy to reflect #1015067 - Back port piranha tmpfs fixes from RHEL6 - Update httpd_can_sendmail boolean to allow read/write postfix spool maildrop - Add postfix_rw_spool_maildrop_files interface - Call new userdom_admin_user_templat() also for sysadm_secadm.pp - Fix typo in userdom_admin_user_template() - Allow SELinux users to create coolkeypk11sE-Gate in /var/cache/coolkey - Add new attribute to discover confined_admins - Fix labeling for /etc/strongswan/ipsec.d - systemd_logind seems to pass fd to anyone who dbus communicates with it - Dontaudit leaked write descriptor to dmesg- Activate motion policy- Fix gnome_read_generic_data_home_files() - allow openshift_cgroup_t to read/write inherited openshift file types - Remove httpd_cobbler_content * from cobbler_admin interface - Allow svirt sandbox domains to setattr on chr_file and blk_file svirt_sandbox_file_t, so sshd will work within a container - Allow httpd_t to read also git sys content symlinks - Allow init_t to read gnome home data - Dontaudit setroubleshoot_fixit_t execmem, since it does not seem to really need it. - Allow virsh to execute systemctl - Fix for nagios_services plugins - add type defintion for ctdbd_var_t - Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file - Allow net_admin/netlink_socket all hyperv_domain domains - Add labeling for zarafa-search.log and zarafa-search.pid - Fix hypervkvp.te - Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type - Fix logging policy - Allow syslog to bind to tls ports - Update labeling for /dev/cdc-wdm - Allow to su_domain to read init states - Allow init_t to read gnome home data - Make sure if systemd_logind creates nologin file with the correct label - Clean up ipsec.te- Add auth_exec_chkpwd interface - Fix port definition for ctdb ports - Allow systemd domains to read /dev/urand - Dontaudit attempts for mozilla_plugin to append to /dev/random - Add label for /var/run/charon.* - Add labeling for /usr/lib/systemd/system/lvm2.*dd policy for motion service - Fix for nagios_services plugins - Fix some bugs in zoneminder policy - add type defintion for ctdbd_var_t - Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file - Allow net_admin/netlink_socket all hyperv_domain domains - Add labeling for zarafa-search.log and zarafa-search.pid - glusterd binds to random unreserved ports - Additional allow rules found by testing glusterfs - apcupsd needs to send a message to all users on the system so needs to look them up - Fix the label on ~/.juniper_networks - Dontaudit attempts for mozilla_plugin to append to /dev/random - Allow polipo_daemon to connect to flash ports - Allow gssproxy_t to create replay caches - Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type- init reload from systemd_localed_t - Allow domains that communicate with systemd_logind_sessions to use systemd_logind_t fd - Allow systemd_localed_t to ask systemd to reload the locale. - Add systemd_runtime_unit_file_t type for unit files that systemd creates in memory - Allow readahead to read /dev/urand - Fix lots of avcs about tuned - Any file names xenstored in /var/log should be treated as xenstored_var_log_t - Allow tuned to inderact with hugepages - Allow condor domains to list etc rw dirs- Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type - Add additional fixes forpegasus_openlmi_account_t - Allow mdadm to read /dev/urand - Allow pegasus_openlmi_storage_t to create mdadm.conf and write it - Add label/rules for /etc/mdadm.conf - Allow pegasus_openlmi_storage_t to transition to fsadm_t - Fixes for interface definition problems - Dontaudit dovecot-deliver to gettatr on all fs dirs - Allow domains to search data_home_t directories - Allow cobblerd to connect to mysql - Allow mdadm to r/w kdump lock files - Add support for kdump lock files - Label zarafa-search as zarafa-indexer - Openshift cgroup wants to read /etc/passwd - Add new sandbox domains for kvm - Allow mpd to interact with pulseaudio if mpd_enable_homedirs is turned on - Fix labeling for /usr/lib/systemd/system/lvm2.* - Add labeling for /usr/lib/systemd/system/lvm2.* - Fix typos to get a new build. We should not cover filename trans rules to prevent duplicate rules - Add sshd_keygen_t policy for sshd-keygen - Fix alsa_home_filetrans interface name and definition - Allow chown for ssh_keygen_t - Add fs_dontaudit_getattr_all_dirs() - Allow init_t to manage etc_aliases_t and read xserver_var_lib_t and chrony keys - Fix up patch to allow systemd to manage home content - Allow domains to send/recv unlabeled traffic if unlabelednet.pp is enabled - Allow getty to exec hostname to get info - Add systemd_home_t for ~/.local/share/systemd directory- Fix lxc labels in config.tgz- Fix labeling for /usr/libexec/kde4/kcmdatetimehelper - Allow tuned to search all file system directories - Allow alsa_t to sys_nice, to get top performance for sound management - Add support for MySQL/PostgreSQL for amavis - Allow openvpn_t to manage openvpn_var_log_t files. - Allow dirsrv_t to create tmpfs_t directories - Allow dirsrv to create dirs in /dev/shm with dirsrv_tmpfs label - Dontaudit leaked unix_stream_sockets into gnome keyring - Allow telepathy domains to inhibit pipes on telepathy domains - Allow cloud-init to domtrans to rpm - Allow abrt daemon to manage abrt-watch tmp files - Allow abrt-upload-watcher to search /var/spool directory - Allow nsswitch domains to manage own process key - Fix labeling for mgetty.* logs - Allow systemd to dbus chat with upower - Allow ipsec to send signull to itself - Allow setgid cap for ipsec_t - Match upstream labeling- Do not build sanbox pkg on MLS- wine_tmp is no longer needed - Allow setroubleshoot to look at /proc - Allow telepathy domains to dbus with systemd logind - Fix handling of fifo files of rpm - Allow mozilla_plugin to transition to itself - Allow certwatch to write to cert_t directories - New abrt application - Allow NetworkManager to set the kernel scheduler - Make wine_domain shared by all wine domains - Allow mdadm_t to read images labeled svirt_image_t - Allow amanda to read /dev/urand - ALlow my_print_default to read /dev/urand - Allow mdadm to write to kdumpctl fifo files - Allow nslcd to send signull to itself - Allow yppasswd to read /dev/urandom - Fix zarafa_setrlimit - Add support for /var/lib/php/wsdlcache - Add zarafa_setrlimit boolean - Allow fetchmail to send mails - Add additional alias for user_tmp_t because wine_tmp_t is no longer used - More handling of ther kernel keyring required by kerberos - New privs needed for init_t when running without transition to initrc_t over bin_t, and without unconfined domain installed- Dontaudit attempts by sosreport to read shadow_t - Allow browser sandbox plugins to connect to cups to print - Add new label mpd_home_t - Label /srv/www/logs as httpd_log_t - Add support for /var/lib/php/wsdlcache - Add zarafa_setrlimit boolean - Allow fetchmail to send mails - Add labels for apache logs under miq package - Allow irc_t to use tcp sockets - fix labels in puppet.if - Allow tcsd to read utmp file - Allow openshift_cron_t to run ssh-keygen in ssh_keygen_t to access host keys - Define svirt_socket_t as a domain_type - Take away transition from init_t to initrc_t when executing bin_t, allow init_t to run chk_passwd_t - Fix label on pam_krb5 helper apps- Allow ldconfig to write to kdumpctl fifo files - allow neutron to connect to amqp ports - Allow kdump_manage_crash to list the kdump_crash_t directory - Allow glance-api to connect to amqp port - Allow virt_qemu_ga_t to read meminfo - Add antivirus_home_t type for antivirus date in HOMEDIRS - Allow mpd setcap which is needed by pulseaudio - Allow smbcontrol to create content in /var/lib/samba - Allow mozilla_exec_t to be used as a entrypoint to mozilla_domtrans_spec - Add additional labeling for qemu-ga/fsfreeze-hook.d scripts - amanda_exec_t needs to be executable file - Allow block_suspend cap for samba-net - Allow apps that read ipsec_mgmt_var_run_t to search ipsec_var_run_t - Allow init_t to run crash utility - Treat usr_t just like bin_t for transitions and executions - Add port definition of pka_ca to port 829 for openshift - Allow selinux_store to use symlinks- Allow block_suspend cap for samba-net - Allow t-mission-control to manage gabble cache files - Allow nslcd to read /sys/devices/system/cpu - Allow selinux_store to use symlinks- Allow xdm_t to transition to itself - Call neutron interfaces instead of quantum - Allow init to change targed role to make uncofined services (xrdp which now has own systemd unit file) working. We want them to have in unconfined_t - Make sure directories in /run get created with the correct label - Make sure /root/.pki gets created with the right label - try to remove labeling for motion from zoneminder_exec_t to bin_t - Allow inetd_t to execute shell scripts - Allow cloud-init to read all domainstate - Fix to use quantum port - Add interface netowrkmanager_initrc_domtrans - Fix boinc_execmem - Allow t-mission-control to read gabble cache home - Add labeling for ~/.cache/telepathy/avatars/gabble - Allow memcache to read sysfs data - Cleanup antivirus policy and add additional fixes - Add boolean boinc_enable_execstack - Add support for couchdb in rabbitmq policy - Add interface couchdb_search_pid_dirs - Allow firewalld to read NM state - Allow systemd running as git_systemd to bind git port - Fix mozilla_plugin_rw_tmpfs_files()- Split out rlogin ports from inetd - Treat files labeld as usr_t like bin_t when it comes to transitions - Allow staff_t to read login config - Allow ipsec_t to read .google authenticator data - Allow systemd running as git_systemd to bind git port - Fix mozilla_plugin_rw_tmpfs_files() - Call the correct interface - corenet_udp_bind_ktalkd_port() - Allow all domains that can read gnome_config to read kde config - Allow sandbox domain to read/write mozilla_plugin_tmpfs_t so pulseaudio will work - Allow mdadm to getattr any file system - Allow a confined domain to executes mozilla_exec_t via dbus - Allow cupsd_lpd_t to bind to the printer port - Dontaudit attempts to bind to ports < 1024 when nis is turned on - Allow apache domain to connect to gssproxy socket - Allow rlogind to bind to the rlogin_port - Allow telnetd to bind to the telnetd_port - Allow ktalkd to bind to the ktalkd_port - Allow cvs to bind to the cvs_port- Cleanup related to init_domain()+inetd_domain fixes - Use just init_domain instead of init_daemon_domain in inetd_core_service_domain - svirt domains neeed to create kobject_uevint_sockets - Lots of new access required for sosreport - Allow tgtd_t to connect to isns ports - Allow init_t to transition to all inetd domains: - openct needs to be able to create netlink_object_uevent_sockets - Dontaudit leaks into ldconfig_t - Dontaudit su domains getattr on /dev devices, move su domains to attribute based calls - Move kernel_stream_connect into all Xwindow using users - Dontaudit inherited lock files in ifconfig o dhcpc_t- Also sock_file trans rule is needed in lsm - Fix labeling for fetchmail pid files/dirs - Add additional fixes for abrt-upload-watch - Fix polipo.te - Fix transition rules in asterisk policy - Add fowner capability to networkmanager policy - Allow polipo to connect to tor ports - Cleanup lsmd.if - Cleanup openhpid policy - Fix kdump_read_crash() interface - Make more domains as init domain - Fix cupsd.te - Fix requires in rpm_rw_script_inherited_pipes - Fix interfaces in lsm.if - Allow munin service plugins to manage own tmpfs files/dirs - Allow virtd_t also relabel unix stream sockets for virt_image_type - Make ktalk as init domain - Fix to define ktalkd_unit_file_t correctly - Fix ktalk.fc - Add systemd support for talk-server - Allow glusterd to create sock_file in /run - Allow xdm_t to delete gkeyringd_tmp_t files on logout - Add fixes for hypervkvp policy - Add logwatch_can_sendmail boolean - Allow mysqld_safe_t to handle also symlinks in /var/log/mariadb - Allow xdm_t to delete gkeyringd_tmp_t files on logout- Add selinux-policy-sandbox pkg0 - Allow rhsmcertd to read init state - Allow fsetid for pkcsslotd - Fix labeling for /usr/lib/systemd/system/pkcsslotd.service - Allow fetchmail to create own pid with correct labeling - Fix rhcs_domain_template() - Allow roles which can run mock to read mock lib files to view results - Allow rpcbind to use nsswitch - Fix lsm.if summary - Fix collectd_t can read /etc/passwd file - Label systemd unit files under dracut correctly - Add support for pam_mount to mount user's encrypted home When a user logs in and logs out using ssh - Add support for .Xauthority-n - Label umount.crypt as lvm_exec_t - Allow syslogd to search psad lib files - Allow ssh_t to use /dev/ptmx - Make sure /run/pluto dir is created with correct labeling - Allow syslog to run shell and bin_t commands - Allow ip to relabel tun_sockets - Allow mount to create directories in files under /run - Allow processes to use inherited fifo files- Add policy for lsmd - Add support for /var/log/mariadb dir and allow mysqld_safe to list this directory - Update condor_master rules to allow read system state info and allow logging - Add labeling for /etc/condor and allow condor domain to write it (bug) - Allow condor domains to manage own logs - Allow glusterd to read domains state - Fix initial hypervkvp policy - Add policy for hypervkvpd - Fix redis.if summary- Allow boinc to connect to @/tmp/.X11-unix/X0 - Allow beam.smp to connect to tcp/5984 - Allow named to manage own log files - Add label for /usr/libexec/dcc/start-dccifd and domtrans to dccifd_t - Add virt_transition_userdomain boolean decl - Allow httpd_t to sendto unix_dgram sockets on its children - Allow nova domains to execute ifconfig - bluetooth wants to create fifo_files in /tmp - exim needs to be able to manage mailman data - Allow sysstat to getattr on all file systems - Looks like bluetoothd has moved - Allow collectd to send ping packets - Allow svirt_lxc domains to getpgid - Remove virt-sandbox-service labeling as virsh_exec_t, since it no longer does virsh_t stuff - Allow frpintd_t to read /dev/urandom - Allow asterisk_t to create sock_file in /var/run - Allow usbmuxd to use netlink_kobject - sosreport needs to getattr on lots of devices, and needs access to netlink_kobject_uevent_socket - More cleanup of svirt_lxc policy - virtd_lxc_t now talks to dbus - Dontaudit leaked ptmx_t - Allow processes to use inherited fifo files - Allow openvpn_t to connect to squid ports - Allow prelink_cron_system_t to ask systemd to reloaddd miscfiles_dontaudit_access_check_cert() - Allow ssh_t to use /dev/ptmx - Make sure /run/pluto dir is created with correct labeling - Allow syslog to run shell and bin_t commands - Allow ip to relabel tun_sockets - Allow mount to create directories in files under /run - Allow processes to use inherited fifo files - Allow user roles to connect to the journal socket- selinux_set_enforce_mode needs to be used with type - Add append to the dontaudit for unix_stream_socket of xdm_t leak - Allow xdm_t to create symlinks in log direcotries - Allow login programs to read afs config - Label 10933 as a pop port, for dovecot - New policy to allow selinux_server.py to run as semanage_t as a dbus service - Add fixes to make netlabelctl working on MLS - AVCs required for running sepolicy gui as staff_t - Dontaudit attempts to read symlinks, sepolicy gui is likely to cause this type of AVC - New dbus server to be used with new gui - After modifying some files in /etc/mail, I saw this needed on the next boot - Loading a vm from /usr/tmp with virt-manager - Clean up oracleasm policy for Fedora - Add oracleasm policy written by rlopez@redhat.com - Make postfix_postdrop_t as mta_agent to allow domtrans to system mail if it is executed by apache - Add label for /var/crash - Allow fenced to domtrans to sanclok_t - Allow nagios to manage nagios spool files - Make tfptd as home_manager - Allow kdump to read kcore on MLS system - Allow mysqld-safe sys_nice/sys_resource caps - Allow apache to search automount tmp dirs if http_use_nfs is enabled - Allow crond to transition to named_t, for use with unbound - Allow crond to look at named_conf_t, for unbound - Allow mozilla_plugin_t to transition its home content - Allow dovecot_domain to read all system and network state - Allow httpd_user_script_t to call getpw - Allow semanage to read pid files - Dontaudit leaked file descriptors from user domain into thumb - Make PAM authentication working if it is enabled in ejabberd - Add fixes for rabbit to fix ##992920,#992931 - Allow glusterd to mount filesystems - Loading a vm from /usr/tmp with virt-manager - Trying to load a VM I got an AVC from devicekit_disk for loopcontrol device - Add fix for pand service - shorewall touches own log - Allow nrpe to list /var - Mozilla_plugin_roles can not be passed into lpd_run_lpr - Allow afs domains to read afs_config files - Allow login programs to read afs config - Allow virt_domain to read virt_var_run_t symlinks - Allow smokeping to send its process signals - Allow fetchmail to setuid - Add kdump_manage_crash() interface - Allow abrt domain to write abrt.socket- Add more aliases in pegasus.te - Add more fixes for *_admin interfaces - Add interface fixes - Allow nscd to stream connect to nmbd - Allow gnupg apps to write to pcscd socket - Add more fixes for openlmi provides. Fix naming and support for additionals - Allow fetchmail to resolve host names - Allow firewalld to interact also with lnk files labeled as firewalld_etc_rw_t - Add labeling for cmpiLMI_Fan-cimprovagt - Allow net_admin for glusterd - Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/ - Add pegasus_openlmi_system_t - Fix puppet_domtrans_master() to make all puppet calling working in passenger.te - Fix corecmd_exec_chroot() - Fix logging_relabel_syslog_pid_socket interface - Fix typo in unconfineduser.te - Allow system_r to access unconfined_dbusd_t to run hp_chec- Allow xdm_t to act as a dbus client to itsel - Allow fetchmail to resolve host names - Allow gnupg apps to write to pcscd socket - Add labeling for cmpiLMI_Fan-cimprovagt - Allow net_admin for glusterd - Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/ - Add pegasus_openlmi_system_t - Fix puppet_domtrans_master() to make all puppet calling working in passenger.te -httpd_t does access_check on certs- Add support for cmpiLMI_Service-cimprovagt - Allow pegasus domtrans to rpm_t to make pycmpiLMI_Software-cimprovagt running as rpm_t - Label pycmpiLMI_Software-cimprovagt as rpm_exec_t - Add support for pycmpiLMI_Storage-cimprovagt - Add support for cmpiLMI_Networking-cimprovagt - Allow system_cronjob_t to create user_tmpfs_t to make pulseaudio working - Allow virtual machines and containers to run as user doains, needed for virt-sandbox - Allow buglist.cgi to read cpu info- Allow systemd-tmpfile to handle tmp content in print spool dir - Allow systemd-sysctl to send system log messages - Add support for RTP media ports and fmpro-internal - Make auditd working if audit is configured to perform SINGLE action on disk error - Add interfaces to handle systemd units - Make systemd-notify working if pcsd is used - Add support for netlabel and label /usr/sbin/netlabelctl as iptables_exec_t - Instead of having all unconfined domains get all of the named transition rules, - Only allow unconfined_t, init_t, initrc_t and rpm_script_t by default. - Add definition for the salt ports - Allow xdm_t to create link files in xdm_var_run_t - Dontaudit reads of blk files or chr files leaked into ldconfig_t - Allow sys_chroot for useradd_t - Allow net_raw cap for ipsec_t - Allow sysadm_t to reload services - Add additional fixes to make strongswan working with a simple conf - Allow sysadm_t to enable/disable init_t services - Add additional glusterd perms - Allow apache to read lnk files in the /mnt directory - Allow glusterd to ask the kernel to load a module - Fix description of ftpd_use_fusefs boolean - Allow svirt_lxc_net_t to sys_chroot, modify policy to tighten up svirt_lxc_domain capabilties and process controls, but add them to svirt_lxc_net_t - Allow glusterds to request load a kernel module - Allow boinc to stream connect to xserver_t - Allow sblim domains to read /etc/passwd - Allow mdadm to read usb devices - Allow collectd to use ping plugin - Make foghorn working with SNMP - Allow sssd to read ldap certs - Allow haproxy to connect to RTP media ports - Add additional trans rules for aide_db - Add labeling for /usr/lib/pcsd/pcsd - Add labeling for /var/log/pcsd - Add support for pcs which is a corosync and pacemaker configuration tool- Label /var/lib/ipa/pki-ca/publish as pki_tomcat_cert_t - Add labeling for /usr/libexec/kde4/polkit-kde-authentication-agent-1 - Allow all domains that can domtrans to shutdown, to start the power services script to shutdown - consolekit needs to be able to shut down system - Move around interfaces - Remove nfsd_rw_t and nfsd_ro_t, they don't do anything - Add additional fixes for rabbitmq_beam to allow getattr on mountpoints - Allow gconf-defaults-m to read /etc/passwd - Fix pki_rw_tomcat_cert() interface to support lnk_files- Add support for gluster ports - Make sure that all keys located in /etc/ssh/ are labeled correctly - Make sure apcuspd lock files get created with the correct label - Use getcap in gluster.te - Fix gluster policy - add additional fixes to allow beam.smp to interact with couchdb files - Additional fix for #974149 - Allow gluster to user gluster ports - Allow glusterd to transition to rpcd_t and add additional fixes for #980683 - Allow tgtd working when accessing to the passthrough device - Fix labeling for mdadm unit files- Add mdadm fixes- Fix definition of sandbox.disabled to sandbox.pp.disabled- Allow mdamd to execute systemctl - Allow mdadm to read /dev/kvm - Allow ipsec_mgmt_t to read l2tpd pid content- Allow nsd_t to read /dev/urand - Allow mdadm_t to read framebuffer - Allow rabbitmq_beam_t to read process info on rabbitmq_epmd_t - Allow mozilla_plugin_config_t to create tmp files - Cleanup openvswitch policy - Allow mozilla plugin to getattr on all executables - Allow l2tpd_t to create fifo_files in /var/run - Allow samba to touch/manage fifo_files or sock_files in a samba_share_t directory - Allow mdadm to connecto its own unix_stream_socket - FIXME: nagios changed locations to /log/nagios which is wrong. But we need to have this workaround for now. - Allow apache to access smokeping pid files - Allow rabbitmq_beam_t to getattr on all filesystems - Add systemd support for iodined - Allow nup_upsdrvctl_t to execute its entrypoint - Allow fail2ban_client to write to fail2ban_var_run_t, Also allow it to use nsswitch - add labeling for ~/.cache/libvirt-sandbox - Add interface to allow domains transitioned to by confined users to send sigchld to screen program - Allow sysadm_t to check the system status of files labeled etc_t, /etc/fstab - Allow systemd_localed to start /usr/lib/systemd/system/systemd-vconsole-setup.service - Allow an domain that has an entrypoint from a type to be allowed to execute the entrypoint without a transition, I can see no case where this is a bad thing, and elminiates a whole class of AVCs. - Allow staff to getsched all domains, required to run htop - Add port definition for redis port - fix selinuxuser_use_ssh_chroot boolean- Add prosody policy written by Michael Scherer - Allow nagios plugins to read /sys info - ntpd needs to manage own log files - Add support for HOME_DIR/.IBMERS - Allow iptables commands to read firewalld config - Allow consolekit_t to read utmp - Fix filename transitions on .razor directory - Add additional fixes to make DSPAM with LDA working - Allow snort to read /etc/passwd - Allow fail2ban to communicate with firewalld over dbus - Dontaudit openshift_cgreoup_file_t read/write leaked dev - Allow nfsd to use mountd port - Call th proper interface - Allow openvswitch to read sys and execute plymouth - Allow tmpwatch to read /var/spool/cups/tmp - Add support for /usr/libexec/telepathy-rakia - Add systemd support for zoneminder - Allow mysql to create files/directories under /var/log/mysql - Allow zoneminder apache scripts to rw zoneminder tmpfs - Allow httpd to manage zoneminder lib files - Add zoneminder_run_sudo boolean to allow to start zoneminder - Allow zoneminder to send mails - gssproxy_t sock_file can be under /var/lib - Allow web domains to connect to whois port. - Allow sandbox_web_type to connect to the same ports as mozilla_plugin_t. - We really need to add an interface to corenet to define what a web_client_domain is and - then define chrome_sandbox_t, mozilla_plugin_t and sandbox_web_type to that domain. - Add labeling for cmpiLMI_LogicalFile-cimprovagt - Also make pegasus_openlmi_logicalfile_t as unconfined to have unconfined_domain attribute for filename trans rules - Update policy rules for pegasus_openlmi_logicalfile_t - Add initial types for logicalfile/unconfined OpenLMI providers - mailmanctl needs to read own log - Allow logwatch manage own lock files - Allow nrpe to read meminfo - Allow httpd to read certs located in pki-ca - Add pki_read_tomcat_cert() interface - Add support for nagios openshift plugins - Add port definition for redis port - fix selinuxuser_use_ssh_chroot boolean- Shrink the size of policy by moving to attributes, also add dridomain so that mozilla_plugin can follow selinuxuse_dri boolean. - Allow bootloader to manage generic log files - Allow ftp to bind to port 989 - Fix label of new gear directory - Add support for new directory /var/lib/openshift/gears/ - Add openshift_manage_lib_dirs() - allow virtd domains to manage setrans_var_run_t - Allow useradd to manage all openshift content - Add support so that mozilla_plugin_t can use dri devices - Allow chronyd to change the scheduler - Allow apmd to shut downthe system - Devicekit_disk_t needs to manage /etc/fstab- Make DSPAM to act as a LDA working - Allow ntop to create netlink socket - Allow policykit to send a signal to policykit-auth - Allow stapserver to dbus chat with avahi/systemd-logind - Fix labeling on haproxy unit file - Clean up haproxy policy - A new policy for haproxy and placed it to rhcs.te - Add support for ldirectord and treat it with cluster_t - Make sure anaconda log dir is created with var_log_t- Allow lvm_t to create default targets for filesystem handling - Fix labeling for razor-lightdm binaries - Allow insmod_t to read any file labeled var_lib_t - Add policy for pesign - Activate policy for cmpiLMI_Account-cimprovagt - Allow isnsd syscall=listen - /usr/libexec/pegasus/cimprovagt needs setsched caused by sched_setscheduler - Allow ctdbd to use udp/4379 - gatherd wants sys_nice and setsched - Add support for texlive2012 - Allow NM to read file_t (usb stick with no labels used to transfer keys for example) - Allow cobbler to execute apache with domain transition- condor_collector uses tcp/9000 - Label /usr/sbin/virtlockd as virtd_exec_t for now - Allow cobbler to execute ldconfig - Allow NM to execute ssh - Allow mdadm to read /dev/crash - Allow antivirus domains to connect to snmp port - Make amavisd-snmp working correctly - Allow nfsd_t to mounton nfsd_fs_t - Add initial snapper policy - We still need to have consolekit policy - Dontaudit firefox attempting to connect to the xserver_port_t if run within sandbox_web_t - Dontaudit sandbox apps attempting to open user_devpts_t - Allow dirsrv to read network state - Fix pki_read_tomcat_lib_files - Add labeling for /usr/libexec/nm-ssh-service - Add label cert_t for /var/lib/ipa/pki-ca/publish - Lets label /sys/fs/cgroup as cgroup_t for now, to keep labels consistant - Allow nfsd_t to mounton nfsd_fs_t - Dontaudit sandbox apps attempting to open user_devpts_t - Allow passwd_t to change role to system_r from unconfined_r- Don't audit access checks by sandbox xserver on xdb var_lib - Allow ntop to read usbmon devices - Add labeling for new polcykit authorizor - Dontaudit access checks from fail2ban_client - Don't audit access checks by sandbox xserver on xdb var_lib - Allow apps that connect to xdm stream to conenct to xdm_dbusd_t stream - Fix labeling for all /usr/bim/razor-lightdm-* binaries - Add filename trans for /dev/md126p1- Make vdagent able to request loading kernel module - Add support for cloud-init make it as unconfined domain - Allow snmpd to run smartctl in fsadm_t domain - remove duplicate openshift_search_lib() interface - Allow mysqld to search openshift lib files - Allow openshift cgroup to interact with passedin file descriptors - Allow colord to list directories inthe users homedir - aide executes prelink to check files - Make sure cupsd_t creates content in /etc/cups with the correct label - Lest dontaudit apache read all domains, so passenger will not cause this avc - Allow gssd to connect to gssproxy - systemd-tmpfiles needs to be able to raise the level to fix labeling on /run/setrans in MLS - Allow systemd-tmpfiles to relabel also lock files - Allow useradd to add homdir in /var/lib/openshift - Allow setfiles and semanage to write output to /run/files- Add labeling for /dev/tgt - Dontaudit leak fd from firewalld for modprobe - Allow runuser running as rpm_script_t to create netlink_audit socket - Allow mdadm to read BIOS non-volatile RAM- accountservice watches when accounts come and go in wtmp - /usr/java/jre1.7.0_21/bin/java needs to create netlink socket - Add httpd_use_sasl boolean - Allow net_admin for tuned_t - iscsid needs sys_module to auto-load kernel modules - Allow blueman to read bluetooth conf - Add nova_manage_lib_files() interface - Fix mplayer_filetrans_home_content() - Add mplayer_filetrans_home_content() - mozilla_plugin_config_roles need to be able to access mozilla_plugin_config_t - Revert "Allow thumb_t to append inherited xdm stream socket" - Add iscsi_filetrans_named_content() interface - Allow to create .mplayer with the correct labeling for unconfined - Allow iscsiadmin to create lock file with the correct labeling- Allow wine to manage wine home content - Make amanda working with socket actiovation - Add labeling for /usr/sbin/iscsiadm - Add support for /var/run/gssproxy.sock - dnsmasq_t needs to read sysctl_net_t- Fix courier_domain_template() interface - Allow blueman to write ip_forward - Allow mongodb to connect to mongodb port - Allow mongodb to connect to mongodb port - Allow java to bind jobss_debug port - Fixes for *_admin interfaces - Allow iscsid auto-load kernel modules needed for proper iSCSI functionality - Need to assign attribute for courier_domain to all courier_domains - Fail2ban reads /etc/passwd - postfix_virtual will create new files in postfix_spool_t - abrt triggers sys_ptrace by running pidof - Label ~/abc as mozilla_home_t, since java apps as plugin want to create it - Add passenger fixes needed by foreman - Remove dup interfaces - Add additional interfaces for quantum - Add new interfaces for dnsmasq - Allow passenger to read localization and send signull to itself - Allow dnsmasq to stream connect to quantum - Add quantum_stream_connect() - Make sure that mcollective starts the service with the correct labeling - Add labels for ~/.manpath - Dontaudit attempts by svirt_t to getpw* calls - sandbox domains are trying to look at parent process data - Allow courior auth to create its pid file in /var/spool/courier subdir - Add fixes for beam to have it working with couchdb - Add labeling for /run/nm-xl2tpd.con - Allow apache to stream connect to thin - Add systemd support for amand - Make public types usable for fs mount points - Call correct mandb interface in domain.te - Allow iptables to r/w quantum inherited pipes and send sigchld - Allow ifconfig domtrans to iptables and execute ldconfig - Add labels for ~/.manpath - Allow systemd to read iscsi lib files - seunshare is trying to look at parent process data- Fix openshift_search_lib - Add support for abrt-uefioops-oops - Allow colord to getattr any file system - Allow chrome processes to look at each other - Allow sys_ptrace for abrt_t - Add new policy for gssproxy - Dontaudit leaked file descriptor writes from firewalld - openshift_net_type is interface not template - Dontaudit pppd to search gnome config - Update openshift_search_lib() interface - Add fs_list_pstorefs() - Fix label on libbcm_host.so since it is built incorrectly on raspberry pi, needs back port to F18 - Better labels for raspberry pi devices - Allow init to create devpts_t directory - Temporarily label rasbery pi devices as memory_device_t, needs back port to f18 - Allow sysadm_t to build kernels - Make sure mount creates /var/run/blkid with the correct label, needs back port to F18 - Allow userdomains to stream connect to gssproxy - Dontaudit leaked file descriptor writes from firewalld - Allow xserver to read /dev/urandom - Add additional fixes for ipsec-mgmt - Make SSHing into an Openshift Enterprise Node working- Add transition rules to unconfined domains and to sysadm_t to create /etc/adjtime - with the proper label. - Update files_filetrans_named_content() interface to get right labeling for pam.d conf files - Allow systemd-timedated to create adjtime - Add clock_create_adjtime() - Additional fix ifconfing for #966106 - Allow kernel_t to create boot.log with correct labeling - Remove unconfined_mplayer for which we don't have rules - Rename interfaces - Add userdom_manage_user_home_files/dirs interfaces - Fix files_dontaudit_read_all_non_security_files - Fix ipsec_manage_key_file() - Fix ipsec_filetrans_key_file() - Label /usr/bin/razor-lightdm-greeter as xdm_exec_t instead of spamc_exec_t - Fix labeling for ipse.secrets - Add interfaces for ipsec and labeling for ipsec.info and ipsec_setup.pid - Add files_dontaudit_read_all_non_security_files() interface - /var/log/syslog-ng should be labeled var_log_t - Make ifconfig_var_run_t a mountpoint - Add transition from ifconfig to dnsmasq - Allow ifconfig to execute bin_t/shell_exec_t - We want to have hwdb.bin labeled as etc_t - update logging_filetrans_named_content() interface - Allow systemd_timedate_t to manage /etc/adjtime - Allow NM to send signals to l2tpd - Update antivirus_can_scan_system boolean - Allow devicekit_disk_t to sys_config_tty - Run abrt-harvest programs as abrt_t, and allow abrt_t to list all filesystem directories - Make printing from vmware working - Allow php-cgi from php54 collection to access /var/lib/net-snmp/mib_indexes - Add virt_qemu_ga_data_t for qemu-ga - Make chrome and mozilla able to connect to same ports, add jboss_management_port_t to both - Fix typo in virt.te - Add virt_qemu_ga_unconfined_t for hook scripts - Make sure NetworkManager files get created with the correct label - Add mozilla_plugin_use_gps boolean - Fix cyrus to have support for net-snmp - Additional fixes for dnsmasq and quantum for #966106 - Add plymouthd_create_log() - remove httpd_use_oddjob for which we don't have rules - Add missing rules for httpd_can_network_connect_cobbler - Add missing cluster_use_execmem boolean - Call userdom_manage_all_user_home_type_files/dirs - Additional fix for ftp_home_dir - Fix ftp_home_dir boolean - Allow squit to recv/send client squid packet - Fix nut.te to have nut_domain attribute - Add support for ejabberd; TODO: revisit jabberd and rabbit policy - Fix amanda policy - Add more fixes for domains which use libusb - Make domains which use libusb working correctly - Allow l2tpd to create ipsec key files with correct labeling and manage them - Fix cobbler_manage_lib_files/cobbler_read_lib_files to cover also lnk files - Allow rabbitmq-beam to bind generic node - Allow l2tpd to read ipse-mgmt pid files - more fixes for l2tpd, NM and pppd from #967072- Dontaudit to getattr on dirs for dovecot-deliver - Allow raiudusd server connect to postgresql socket - Add kerberos support for radiusd - Allow saslauthd to connect to ldap port - Allow postfix to manage postfix_private_t files - Add chronyd support for #965457 - Fix labeling for HOME_DIR/\.icedtea - CHange squid and snmpd to be allowed also write own logs - Fix labeling for /usr/libexec/qemu-ga - Allow virtd_t to use virt_lock_t - Allow also sealert to read the policy from the kernel - qemu-ga needs to execute scripts in /usr/libexec/qemu-ga and to use /tmp content - Dontaudit listing of users homedir by sendmail Seems like a leak - Allow passenger to transition to puppet master - Allow apache to connect to mythtv - Add definition for mythtv ports- Add additional fixes for #948073 bug - Allow sge_execd_t to also connect to sge ports - Allow openshift_cron_t to manage openshift_var_lib_t sym links - Allow openshift_cron_t to manage openshift_var_lib_t sym links - Allow sge_execd to bind sge ports. Allow kill capability and reads cgroup files - Remove pulseaudio filetrans pulseaudio_manage_home_dirs which is a part of pulseaudio_manage_home_files - Add networkmanager_stream_connect() - Make gnome-abrt wokring with staff_t - Fix openshift_manage_lib_files() interface - mdadm runs ps command which seems to getattr on random log files - Allow mozilla_plugin_t to create pulseaudit_home_t directories - Allow qemu-ga to shutdown virtual hosts - Add labelling for cupsd-browsed - Add web browser plugins to connect to aol ports - Allow nm-dhcp-helper to stream connect to NM - Add port definition for sge ports- Make sure users and unconfined domains create .hushlogin with the correct label - Allow pegaus to chat with realmd over DBus - Allow cobblerd to read network state - Allow boicn-client to stat on /dev/input/mice - Allow certwatch to read net_config_t when it executes apache - Allow readahead to create /run/systemd and then create its own directory with the correct label- Transition directories and files when in a user_tmp_t directory - Change certwatch to domtrans to apache instead of just execute - Allow virsh_t to read xen lib files - update policy rules for pegasus_openlmi_account_t - Add support for svnserve_tmp_t - Activate account openlmi policy - pegasus_openlmi_domain_template needs also require pegasus_t - One more fix for policykit.te - Call fs_list_cgroups_dirs() in policykit.te - Allow nagios service plugin to read mysql config files - Add labeling for /var/svn - Fix chrome.te - Fix pegasus_openlmi_domain_template() interfaces - Fix dev_rw_vfio_dev definiton, allow virtd_t to read tmpfs_t symlinks - Fix location of google-chrome data - Add support for chome_sandbox to store content in the homedir - Allow policykit to watch for changes in cgroups file system - Add boolean to allow mozilla_plugin_t to use spice - Allow collectd to bind to udp port - Allow collected_t to read all of /proc - Should use netlink socket_perms - Should use netlink socket_perms - Allow glance domains to connect to apache ports - Allow apcupsd_t to manage its log files - Allow chrome objects to rw_inherited unix_stream_socket from callers - Allow staff_t to execute virtd_exec_t for running vms - nfsd_t needs to bind mountd port to make nfs-mountd.service working - Allow unbound net_admin capability because of setsockopt syscall - Fix fs_list_cgroup_dirs() - Label /usr/lib/nagios/plugins/utils.pm as bin_t - Remove uplicate definition of fs_read_cgroup_files() - Remove duplicate definition of fs_read_cgroup_files() - Add files_mountpoint_filetrans interface to be used by quotadb_t and snapperd - Additional interfaces needed to list and read cgroups config - Add port definition for collectd port - Add labels for /dev/ptp* - Allow staff_t to execute virtd_exec_t for running vms- Allow samba-net to also read realmd tmp files - Allow NUT to use serial ports - realmd can be started by systemctl now- Remove userdom_home_manager for xdm_t and move all rules to xserver.te directly - Add new xdm_write_home boolean to allow xdm_t to create files in HOME dirs with xdm_home_t - Allow postfix-showq to read/write unix.showq in /var/spool/postfix/pid - Allow virsh to read xen lock file - Allow qemu-ga to create files in /run with proper labeling - Allow glusterd to connect to own socket in /tmp - Allow glance-api to connect to http port to make glance image-create working - Allow keystonte_t to execute rpm- Fix realmd cache interfaces- Allow tcpd to execute leafnode - Allow samba-net to read realmd cache files - Dontaudit sys_tty_config for alsactl - Fix allow rules for postfix_var_run - Allow cobblerd to read /etc/passwd - Allow pegasus to read exports - Allow systemd-timedate to read xdm state - Allow mout to stream connect to rpcbind - Add labeling just for /usr/share/pki/ca-trust-source instead of /usr/share/pki- Allow thumbnails to share memory with apps which run thumbnails - Allow postfix-postqueue block_suspend - Add lib interfaces for smsd - Add support for nginx - Allow s2s running as jabberd_t to connect to jabber_interserver_port_t - Allow pki apache domain to create own tmp files and execute httpd_suexec - Allow procmail to manger user tmp files/dirs/lnk_files - Add virt_stream_connect_svirt() interface - Allow dovecot-auth to execute bin_t - Allow iscsid to request that kernel load a kernel module - Add labeling support for /var/lib/mod_security - Allow iw running as tuned_t to create netlink socket - Dontaudit sys_tty_config for thumb_t - Add labeling for nm-l2tp-service - Allow httpd running as certwatch_t to open tcp socket - Allow useradd to manager smsd lib files - Allow useradd_t to add homedirs in /var/lib - Fix typo in userdomain.te - Cleanup userdom_read_home_certs - Implement userdom_home_reader_certs_type to allow read certs also on encrypt /home with ecryptfs_t - Allow staff to stream connect to svirt_t to make gnome-boxes working- Allow lvm to create its own unit files - Label /var/lib/sepolgen as selinux_config_t - Add filetrans rules for tw devices - Add transition from cupsd_config_t to cupsd_t- Add filetrans rules for tw devices - Cleanup bad transition lines- Fix lockdev_manage_files() - Allow setroubleshootd to read var_lib_t to make email_alert working - Add lockdev_manage_files() - Call proper interface in virt.te - Allow gkeyring_domain to create /var/run/UID/config/dbus file - system dbus seems to be blocking suspend - Dontaudit attemps to sys_ptrace, which I believe gpsd does not need - When you enter a container from root, you generate avcs with a leaked file descriptor - Allow mpd getattr on file system directories - Make sure realmd creates content with the correct label - Allow systemd-tty-ask to write kmsg - Allow mgetty to use lockdev library for device locking - Fix selinuxuser_user_share_music boolean name to selinuxuser_share_music - When you enter a container from root, you generate avcs with a leaked file descriptor - Make sure init.fc files are labeled correctly at creation - File name trans vconsole.conf - Fix labeling for nagios plugins - label shared libraries in /opt/google/chrome as testrel_shlib_t- Allow certmonger to dbus communicate with realmd - Make realmd working- Fix mozilla specification of homedir content - Allow certmonger to read network state - Allow tmpwatch to read tmp in /var/spool/{cups,lpd} - Label all nagios plugin as unconfined by default - Add httpd_serve_cobbler_files() - Allow mdadm to read /dev/sr0 and create tmp files - Allow certwatch to send mails - Fix labeling for nagios plugins - label shared libraries in /opt/google/chrome as testrel_shlib_t- Allow realmd to run ipa, really needs to be an unconfined_domain - Allow sandbox domains to use inherted terminals - Allow pscd to use devices labeled svirt_image_t in order to use cat cards. - Add label for new alsa pid - Alsa now uses a pid file and needs to setsched - Fix oracleasmfs_t definition - Add support for sshd_unit_file_t - Add oracleasmfs_t - Allow unlabeled_t files to be stored on unlabeled_t filesystems- Fix description of deny_ptrace boolean - Remove allow for execmod lib_t for now - Allow quantum to connect to keystone port - Allow nova-console to talk with mysql over unix stream socket - Allow dirsrv to stream connect to uuidd - thumb_t needs to be able to create ~/.cache if it does not exist - virtd needs to be able to sys_ptrace when starting and stoping containers- Allow alsa_t signal_perms, we probaly should search for any app that can execute something without transition and give it signal_perms... - Add dontaudit for mozilla_plugin_t looking at the xdm_t sockets - Fix deny_ptrace boolean, certain ptrace leaked into the system - Allow winbind to manage kerberos_rcache_host - Allow spamd to create spamd_var_lib_t directories - Remove transition to mozilla_tmp_t by mozilla_t, to allow it to manage the users tmp dirs - Add mising nslcd_dontaudit_write_sock_file() interface - one more fix - Fix pki_read_tomcat_lib_files() interface - Allow certmonger to read pki-tomcat lib files - Allow certwatch to execute bin_t - Allow snmp to manage /var/lib/net-snmp files - Call snmp_manage_var_lib_files(fogorn_t) instead of snmp_manage_var_dirs - Fix vmware_role() interface - Fix cobbler_manage_lib_files() interface - Allow nagios check disk plugins to execute bin_t - Allow quantum to transition to openvswitch_t - Allow postdrop to stream connect to postfix-master - Allow quantum to stream connect to openvswitch - Add xserver_dontaudit_xdm_rw_stream_sockets() interface - Allow daemon to send dgrams to initrc_t - Allow kdm to start the power service to initiate a reboot or poweroff- Add mising nslcd_dontaudit_write_sock_file() interface - one more fix - Fix pki_read_tomcat_lib_files() interface - Allow certmonger to read pki-tomcat lib files - Allow certwatch to execute bin_t - Allow snmp to manage /var/lib/net-snmp files - Don't audit attempts to write to stream socket of nscld by thumbnailers - Allow git_system_t to read network state - Allow pegasas to execute mount command - Fix desc for drdb_admin - Fix condor_amin() - Interface fixes for uptime, vdagent, vnstatd - Fix labeling for moodle in /var/www/moodle/data - Add interface fixes - Allow bugzilla to read certs - /var/www/moodle needs to be writable by apache - Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest - Fix namespace_init_t to create content with proper labels, and allow it to manage all user content - Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean - Fixes for dlm_controld - Fix apache_read_sys_content_rw_dirs() interface - Allow logrotate to read /var/log/z-push dir - Fix sys_nice for cups_domain - Allow postfix_postdrop to acces postfix_public socket - Allow sched_setscheduler for cupsd_t - Add missing context for /usr/sbin/snmpd - Kernel_t needs mac_admin in order to support labeled NFS - Fix systemd_dontaudit_dbus_chat() interface - Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest - Allow consolehelper domain to write Xauth files in /root - Add port definition for osapi_compute port - Allow unconfined to create /etc/hostname with correct labeling - Add systemd_filetrans_named_hostname() interface- Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean - Fixes for dlm_controld - Fix apache_read_sys_content_rw_dirs() interface - Allow logrotate to read /var/log/z-push dir - Allow postfix_postdrop to acces postfix_public socket - Allow sched_setscheduler for cupsd_t - Add missing context for /usr/sbin/snmpd - Allow consolehelper more access discovered by Tom London - Allow fsdaemon to send signull to all domain - Add port definition for osapi_compute port - Allow unconfined to create /etc/hostname with correct labeling - Add systemd_filetrans_named_hostname() interface- Fix file_contexts.subs to label /run/lock correctly- Try to label on controlC devices up to 30 correctly - Add mount_rw_pid_files() interface - Add additional mount/umount interfaces needed by mock - fsadm_t sends audit messages in reads kernel_ipc_info when doing livecd-iso-to-disk - Fix tabs - Allow initrc_domain to search rgmanager lib files - Add more fixes which make mock working together with confined users * Allow mock_t to manage rpm files * Allow mock_t to read rpm log files * Allow mock to setattr on tmpfs, devpts * Allow mount/umount filesystems - Add rpm_read_log() interface - yum-cron runs rpm from within it. - Allow tuned to transition to dmidecode - Allow firewalld to do net_admin - Allow mock to unmont tmpfs_t - Fix virt_sigkill() interface - Add additional fixes for mock. Mainly caused by mount running in mock_t - Allow mock to write sysfs_t and mount pid files - Add mailman_domain to mailman_template() - Allow openvswitch to execute shell - Allow qpidd to use kerberos - Allow mailman to use fusefs, needs back port to RHEL6 - Allow apache and its scripts to use anon_inodefs - Add alias for git_user_content_t and git_sys_content_t so that RHEL6 will update to RHEL7 - Realmd needs to connect to samba ports, needs back port to F18 also - Allow colord to read /run/initial-setup- - Allow sanlock-helper to send sigkill to virtd which is registred to sanlock - Add virt_kill() interface - Add rgmanager_search_lib() interface - Allow wdmd to getattr on all filesystems. Back ported from RHEL6- Allow realmd to create tmp files - FIx ircssi_home_t type to irssi_home_t - Allow adcli running as realmd_t to connect to ldap port - Allow NetworkManager to transition to ipsec_t, for running strongswan - Make openshift_initrc_t an lxc_domain - Allow gssd to manage user_tmp_t files - Fix handling of irclogs in users homedir - Fix labeling for drupal an wp-content in subdirs of /var/www/html - Allow abrt to read utmp_t file - Fix openshift policy to transition lnk_file, sock-file an fifo_file when created in a tmpfs_t, needs back port to RHEL6 - fix labeling for (oo|rhc)-restorer-wrapper.sh - firewalld needs to be able to write to network sysctls - Fix mozilla_plugin_dontaudit_rw_sem() interface - Dontaudit generic ipc read/write to a mozilla_plugin for sandbox_x domains - Add mozilla_plugin_dontaudit_rw_sem() interface - Allow svirt_lxc_t to transition to openshift domains - Allow condor domains block_suspend and dac_override caps - Allow condor_master to read passd - Allow condor_master to read system state - Allow NetworkManager to transition to ipsec_t, for running strongswan - Lots of access required by lvm_t to created encrypted usb device - Allow xdm_t to dbus communicate with systemd_localed_t - Label strongswan content as ipsec_exec_mgmt_t for now - Allow users to dbus chat with systemd_localed - Fix handling of .xsession-errors in xserver.if, so kde will work - Might be a bug but we are seeing avc's about people status on init_t:service - Make sure we label content under /var/run/lock as <> - Allow daemon and systemprocesses to search init_var_run_t directory - Add boolean to allow xdm to write xauth data to the home directory - Allow mount to write keys for the unconfined domain - Add unconfined_write_keys() interface- Add labeling for /usr/share/pki - Allow programs that read var_run_t symlinks also read var_t symlinks - Add additional ports as mongod_port_t for 27018, 27019, 28017, 28018 and 28019 ports - Fix labeling for /etc/dhcp directory - add missing systemd_stub_unit_file() interface - Add files_stub_var() interface - Add lables for cert_t directories - Make localectl set-x11-keymap working at all - Allow abrt to manage mock build environments to catch build problems. - Allow virt_domains to setsched for running gdb on itself - Allow thumb_t to execute user home content - Allow pulseaudio running as mozilla_plugin_t to read /run/systemd/users/1000 - Allow certwatch to execut /usr/bin/httpd - Allow cgred to send signal perms to itself, needs back port to RHEL6 - Allow openshift_cron_t to look at quota - Allow cups_t to read inhered tmpfs_t from the kernel - Allow yppasswdd to use NIS - Tuned wants sys_rawio capability - Add ftpd_use_fusefs boolean - Allow dirsrvadmin_t to signal itself- Allow localectl to read /etc/X11/xorg.conf.d directory - Revert "Revert "Fix filetrans rules for kdm creates .xsession-errors"" - Allow mount to transition to systemd_passwd_agent - Make sure abrt directories are labeled correctly - Allow commands that are going to read mount pid files to search mount_var_run_t - label /usr/bin/repoquery as rpm_exec_t - Allow automount to block suspend - Add abrt_filetrans_named_content so that abrt directories get labeled correctly - Allow virt domains to setrlimit and read file_context- Allow nagios to manage nagios spool files - /var/spool/snmptt is a directory which snmdp needs to write to, needs back port to RHEL6 - Add swift_alias.* policy files which contain typealiases for swift types - Add support for /run/lock/opencryptoki - Allow pkcsslotd chown capability - Allow pkcsslotd to read passwd - Add rsync_stub() interface - Allow systemd_timedate also manage gnome config homedirs - Label /usr/lib64/security/pam_krb5/pam_krb5_cchelper as bin_t - Fix filetrans rules for kdm creates .xsession-errors - Allow sytemd_tmpfiles to create wtmp file - Really should not label content under /var/lock, since it could have labels on it different from var_lock_t - Allow systemd to list all file system directories - Add some basic stub interfaces which will be used in PRODUCT policies- Fix log transition rule for cluster domains - Start to group all cluster log together - Dont use filename transition for POkemon Advanced Adventure until a new checkpolicy update - cups uses usbtty_device_t devices - These fixes were all required to build a MLS virtual Machine with single level desktops - Allow domains to transiton using httpd_exec_t - Allow svirt domains to manage kernel key rings - Allow setroubleshoot to execute ldconfig - Allow firewalld to read generate gnome data - Allow bluetooth to read machine-info - Allow boinc domain to send signal to itself - Fix gnome_filetrans_home_content() interface - Allow mozilla_plugins to list apache modules, for use with gxine - Fix labels for POkemon in the users homedir - Allow xguest to read mdstat - Dontaudit virt_domains getattr on /dev/* - These fixes were all required to build a MLS virtual Machine with single level desktops - Need to back port this to RHEL6 for openshift - Add tcp/8891 as milter port - Allow nsswitch domains to read sssd_var_lib_t files - Allow ping to read network state. - Fix typo - Add labels to /etc/X11/xorg.d and allow systemd-timestampd_t to manage them- Adopt swift changes from lhh@redhat.com - Add rhcs_manage_cluster_pid_files() interface - Allow screen domains to configure tty and setup sock_file in ~/.screen directory - ALlow setroubleshoot to read default_context_t, needed to backport to F18 - Label /etc/owncloud as being an apache writable directory - Allow sshd to stream connect to an lxc domain- Allow postgresql to manage rgmanager pid files - Allow postgresql to read ccs data - Allow systemd_domain to send dbus messages to policykit - Add labels for /etc/hostname and /etc/machine-info and allow systemd-hostnamed to create them - All systemd domains that create content are reading the file_context file and setfscreate - Systemd domains need to search through init_var_run_t - Allow sshd to communicate with libvirt to set containers labels - Add interface to manage pid files - Allow NetworkManger_t to read /etc/hostname - Dontaudit leaked locked files into openshift_domains - Add fixes for oo-cgroup-read - it nows creates tmp files - Allow gluster to manage all directories as well as files - Dontaudit chrome_sandbox_nacl_t using user terminals - Allow sysstat to manage its own log files - Allow virtual machines to setrlimit and send itself signals. - Add labeling for /var/run/hplip- Fix POSTIN scriptlet- Merge rgmanger, corosync,pacemaker,aisexec policies to cluster_t in rhcs.pp- Fix authconfig.py labeling - Make any domains that write homedir content do it correctly - Allow glusterd to read/write anyhwere on the file system by default - Be a little more liberal with the rsync log files - Fix iscsi_admin interface - Allow iscsid_t to read /dev/urand - Fix up iscsi domain for use with unit files - Add filename transition support for spamassassin policy - Allow web plugins to use badly formated libraries - Allow nmbd_t to create samba_var_t directories - Add filename transition support for spamassassin policy - Add filename transition support for tvtime - Fix alsa_home_filetrans_alsa_home() interface - Move all userdom_filetrans_home_content() calling out of booleans - Allow logrotote to getattr on all file sytems - Remove duplicate userdom_filetrans_home_content() calling - Allow kadmind to read /etc/passwd - Dontaudit append .xsession-errors file on ecryptfs for policykit-auth - Allow antivirus domain to manage antivirus db links - Allow logrotate to read /sys - Allow mandb to setattr on man dirs - Remove mozilla_plugin_enable_homedirs boolean - Fix ftp_home_dir boolean - homedir mozilla filetrans has been moved to userdom_home_manager - homedir telepathy filetrans has been moved to userdom_home_manager - Remove gnome_home_dir_filetrans() from gnome_role_gkeyringd() - Might want to eventually write a daemon on fusefsd. - Add policy fixes for sshd [net] child from plautrba@redhat.com - Tor uses a new port - Remove bin_t for authconfig.py - Fix so only one call to userdom_home_file_trans - Allow home_manager_types to create content with the correctl label - Fix all domains that write data into the homedir to do it with the correct label - Change the postgresql to use proper boolean names, which is causing httpd_t to - not get access to postgresql_var_run_t - Hostname needs to send syslog messages - Localectl needs to be able to send dbus signals to users - Make sure userdom_filetrans_type will create files/dirs with user_home_t labeling by default - Allow user_home_manger domains to create spam* homedir content with correct labeling - Allow user_home_manger domains to create HOMEDIR/.tvtime with correct labeling - Add missing miscfiles_setattr_man_pages() interface and for now comment some rules for userdom_filetrans_type to make build process working - Declare userdom_filetrans_type attribute - userdom_manage_home_role() needs to be called withoout usertype attribute because of userdom_filetrans_type attribute - fusefsd is mounding a fuse file system on /run/user/UID/gvfs- Man pages are now generated in the build process - Allow cgred to list inotifyfs filesystem- Allow gluster to get attrs on all fs - New access required for virt-sandbox - Allow dnsmasq to execute bin_t - Allow dnsmasq to create content in /var/run/NetworkManager - Fix openshift_initrc_signal() interface - Dontaudit openshift domains doing getattr on other domains - Allow consolehelper domain to communicate with session bus - Mock should not be transitioning to any other domains, we should keep mock_t as mock_t - Update virt_qemu_ga_t policy - Allow authconfig running from realmd to restart oddjob service - Add systemd support for oddjob - Add initial policy for realmd_consolehelper_t which if for authconfig executed by realmd - Add labeling for gnashpluginrc - Allow chrome_nacl to execute /dev/zero - Allow condor domains to read /proc - mozilla_plugin_t will getattr on /core if firefox crashes - Allow condor domains to read /etc/passwd - Allow dnsmasq to execute shell scripts, openstack requires this access - Fix glusterd labeling - Allow virtd_t to interact with the socket type - Allow nmbd_t to override dac if you turned on sharing all files - Allow tuned to created kobject_uevent socket - Allow guest user to run fusermount - Allow openshift to read /proc and locale - Allow realmd to dbus chat with rpm - Add new interface for virt - Remove depracated interfaces - Allow systemd_domains read access on etc, etc_runtime and usr files, also allow them to connect stream to syslog socket - /usr/share/munin/plugins/plugin.sh should be labeled as bin_t - Remove some more unconfined_t process transitions, that I don't believe are necessary - Stop transitioning uncofnined_t to checkpc - dmraid creates /var/lock/dmraid - Allow systemd_localed to creatre unix_dgram_sockets - Allow systemd_localed to write kernel messages. - Also cleanup systemd definition a little. - Fix userdom_restricted_xwindows_user_template() interface - Label any block devices or char devices under /dev/infiniband as fixed_disk_device_t - User accounts need to dbus chat with accountsd daemon - Gnome requires all users to be able to read /proc/1/- virsh now does a setexeccon call - Additional rules required by openshift domains - Allow svirt_lxc_domains to use inherited terminals, needed to make virt-sandbox-service execute work - Allow spamd_update_t to search spamc_home_t - Avcs discovered by mounting an isci device under /mnt - Allow lspci running as logrotate to read pci.ids - Additional fix for networkmanager_read_pid_files() - Fix networkmanager_read_pid_files() interface - Allow all svirt domains to connect to svirt_socket_t - Allow virsh to set SELinux context for a process. - Allow tuned to create netlink_kobject_uevent_socket - Allow systemd-timestamp to set SELinux context - Add support for /var/lib/systemd/linger - Fix ssh_sysadm_login to be working on MLS as expected- Rename files_rw_inherited_tmp_files to files_rw_inherited_tmp_file - Add missing files_rw_inherited_tmp_files interface - Add additional interface for ecryptfs - ALlow nova-cert to connect to postgresql - Allow keystone to connect to postgresql - Allow all cups domains to getattr on filesystems - Allow pppd to send signull - Allow tuned to execute ldconfig - Allow gpg to read fips_enabled - Add additional fixes for ecryptfs - Allow httpd to work with posgresql - Allow keystone getsched and setsched- Allow gpg to read fips_enabled - Add support for /var/cache/realmd - Add support for /usr/sbin/blazer_usb and systemd support for nut - Add labeling for fenced_sanlock and allow sanclok transition to fenced_t - bitlbee wants to read own log file - Allow glance domain to send a signal itself - Allow xend_t to request that the kernel load a kernel module - Allow pacemaker to execute heartbeat lib files - cleanup new swift policy- Fix smartmontools - Fix userdom_restricted_xwindows_user_template() interface - Add xserver_xdm_ioctl_log() interface - Allow Xusers to ioctl lxdm.log to make lxdm working - Add MLS fixes to make MLS boot/log-in working - Add mls_socket_write_all_levels() also for syslogd - fsck.xfs needs to read passwd - Fix ntp_filetrans_named_content calling in init.te - Allow postgresql to create pg_log dir - Allow sshd to read rsync_data_t to make rsync working - Change ntp.conf to be labeled net_conf_t - Allow useradd to create homedirs in /run. ircd-ratbox does this and we should just allow it - Allow xdm_t to execute gstreamer home content - Allod initrc_t and unconfined domains, and sysadm_t to manage ntp - New policy for openstack swift domains - More access required for openshift_cron_t - Use cupsd_log_t instead of cupsd_var_log_t - rpm_script_roles should be used in rpm_run - Fix rpm_run() interface - Fix openshift_initrc_run() - Fix sssd_dontaudit_stream_connect() interface - Fix sssd_dontaudit_stream_connect() interface - Allow LDA's job to deliver mail to the mailbox - dontaudit block_suspend for mozilla_plugin_t - Allow l2tpd_t to all signal perms - Allow uuidgen to read /dev/random - Allow mozilla-plugin-config to read power_supply info - Implement cups_domain attribute for cups domains - We now need access to user terminals since we start by executing a command outside the tty - We now need access to user terminals since we start by executing a command outside the tty - svirt lxc containers want to execute userhelper apps, need these changes to allow this to happen - Add containment of openshift cron jobs - Allow system cron jobs to create tmp directories - Make userhelp_conf_t a config file - Change rpm to use rpm_script_roles - More fixes for rsync to make rsync wokring - Allow logwatch to domtrans to mdadm - Allow pacemaker to domtrans to ifconfig - Allow pacemaker to setattr on corosync.log - Add pacemaker_use_execmem for memcheck-amd64 command - Allow block_suspend capability - Allow create fifo_file in /tmp with pacemaker_tmp_t - Allow systat to getattr on fixed disk - Relabel /etc/ntp.conf to be net_conf_t - ntp_admin should create files in /etc with the correct label - Add interface to create ntp_conf_t files in /etc - Add additional labeling for quantum - Allow quantum to execute dnsmasq with transition- boinc_cliean wants also execmem as boinc projecs have - Allow sa-update to search admin home for /root/.spamassassin - Allow sa-update to search admin home for /root/.spamassassin - Allow antivirus domain to read net sysctl - Dontaudit attempts from thumb_t to connect to ssd - Dontaudit attempts by readahead to read sock_files - Dontaudit attempts by readahead to read sock_files - Create tmpfs file while running as wine as user_tmpfs_t - Dontaudit attempts by readahead to read sock_files - libmpg ships badly created librarie- Change ssh_use_pts to use macro and only inherited sshd_devpts_t - Allow confined users to read systemd_logind seat information - libmpg ships badly created libraries - Add support for strongswan.service - Add labeling for strongswan - Allow l2tpd_t to read network manager content in /run directory - Allow rsync to getattr any file in rsync_data_t - Add labeling and filename transition for .grl-podcasts- mount.glusterfs executes glusterfsd binary - Allow systemd_hostnamed_t to stream connect to systemd - Dontaudit any user doing a access check - Allow obex-data-server to request the kernel to load a module - Allow gpg-agent to manage gnome content (~/.cache/gpg-agent-info) - Allow gpg-agent to read /proc/sys/crypto/fips_enabled - Add new types for antivirus.pp policy module - Allow gnomesystemmm_t caps because of ioprio_set - Make sure if mozilla_plugin creates files while in permissive mode, they get created with the correct label, user_home_t - Allow gnomesystemmm_t caps because of ioprio_set - Allow NM rawip socket - files_relabel_non_security_files can not be used with boolean - Add interface to thumb_t dbus_chat to allow it to read remote process state - ALlow logrotate to domtrans to mdadm_t - kde gnomeclock wants to write content to /tmp- kde gnomeclock wants to write content to /tmp - /usr/libexec/kde4/kcmdatetimehelper attempts to create /root/.kde - Allow blueman_t to rwx zero_device_t, for some kind of jre - Allow mozilla_plugin_t to rwx zero_device_t, for some kind of jre - Ftp full access should be allowed to create directories as well as files - Add boolean to allow rsync_full_acces, so that an rsync server can write all - over the local machine - logrotate needs to rotate logs in openshift directories, needs back port to RHEL6 - Add missing vpnc_roles type line - Allow stapserver to write content in /tmp - Allow gnome keyring to create keyrings dir in ~/.local/share - Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on - Add interface to colord_t dbus_chat to allow it to read remote process state - Allow colord_t to read cupsd_t state - Add mate-thumbnail-font as thumnailer - Allow sectoolm to sys_ptrace since it is looking at other proceses /proc data. - Allow qpidd to list /tmp. Needed by ssl - Only allow init_t to transition to rsync_t domain, not initrc_t. This should be back ported to F17, F18 - - Added systemd support for ksmtuned - Added booleans ksmtuned_use_nfs ksmtuned_use_cifs - firewalld seems to be creating mmap files which it needs to execute in /run /tmp and /dev/shm. Would like to clean this up but for now we will allow - Looks like qpidd_t needs to read /dev/random - Lots of probing avc's caused by execugting gpg from staff_t - Dontaudit senmail triggering a net_admin avc - Change thumb_role to use thumb_run, not sure why we have a thumb_role, needs back port - Logwatch does access check on mdadm binary - Add raid_access_check_mdadm() iterface- Fix systemd_manage_unit_symlinks() interface - Call systemd_manage_unit_symlinks(() which is correct interface - Add filename transition for opasswd - Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock - Allow sytstemd-timedated to get status of init_t - Add new systemd policies for hostnamed and rename gnomeclock_t to systemd_timedate_t - colord needs to communicate with systemd and systemd_logind, also remove duplicate rules - Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock - Allow gpg_t to manage all gnome files - Stop using pcscd_read_pub_files - New rules for xguest, dontaudit attempts to dbus chat - Allow firewalld to create its mmap files in tmpfs and tmp directories - Allow firewalld to create its mmap files in tmpfs and tmp directories - run unbound-chkconf as named_t, so it can read dnssec - Colord is reading xdm process state, probably reads state of any apps that sends dbus message - Allow mdadm_t to change the kernel scheduler - mythtv policy - Update mandb_admin() interface - Allow dsspam to listen on own tpc_socket - seutil_filetrans_named_content needs to be optional - Allow sysadm_t to execute content in his homedir - Add attach_queue to tun_socket, new patch from Paul Moore - Change most of selinux configuration types to security_file_type. - Add filename transition rules for selinux configuration - ssh into a box with -X -Y requires ssh_use_ptys - Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on - Allow all unpriv userdomains to send dbus messages to hostnamed and timedated - New allow rules found by Tom London for systemd_hostnamed- Allow systemd-tmpfiles to relabel lpd spool files - Ad labeling for texlive bash scripts - Add xserver_filetrans_fonts_cache_home_content() interface - Remove duplicate rules from *.te - Add support for /var/lock/man-db.lock - Add support for /var/tmp/abrt(/.*)? - Add additional labeling for munin cgi scripts - Allow httpd_t to read munin conf files - Allow certwatch to read meminfo - Fix nscd_dontaudit_write_sock_file() interfac - Fix gnome_filetrans_home_content() to include also "fontconfig" dir as cache_home_t - llow mozilla_plugin_t to create HOMEDIR/.fontconfig with the proper labeling- Allow gnomeclock to talk to puppet over dbus - Allow numad access discovered by Dominic - Add support for HOME_DIR/.maildir - Fix attribute_role for mozilla_plugin_t domain to allow staff_r to access this domain - Allow udev to relabel udev_var_run_t lnk_files - New bin_t file in mcelog- Remove all mcs overrides and replace with t1 != mcs_constrained_types - Add attribute_role for iptables - mcs_process_set_categories needs to be called for type - Implement additional role_attribute statements - Sodo domain is attempting to get the additributes of proc_kcore_t - Unbound uses port 8953 - Allow svirt_t images to compromise_kernel when using pci-passthrough - Add label for dns lib files - Bluetooth aquires a dbus name - Remove redundant files_read_usr_file calling - Remove redundant files_read_etc_file calling - Fix mozilla_run_plugin() - Add role_attribute support for more domains- Mass merge with upstream- Bump the policy version to 28 to match selinux userspace - Rebuild versus latest libsepol- Add systemd_status_all_unit_files() interface - Add support for nshadow - Allow sysadm_t to administrate the postfix domains - Add interface to setattr on isid directories for use by tmpreaper - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Add systemd_status_all_unit_files() interface - Add support for nshadow - Allow sysadm_t to administrate the postfix domains - Add interface to setattr on isid directories for use by tmpreaper - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Allow sshd_t sys_admin for use with afs logins - Add labeling for /var/named/chroot/etc/localtim- Allow setroubleshoot_fixit to execute rpm - zoneminder needs to connect to httpd ports where remote cameras are listening - Allow firewalld to execute content created in /run directory - Allow svirt_t to read generic certs - Dontaudit leaked ps content to mozilla plugin - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - init scripts are creating systemd_unit_file_t directories- systemd_logind_t is looking at all files under /run/user/apache - Allow systemd to manage all user tmp files - Add labeling for /var/named/chroot/etc/localtime - Allow netlabel_peer_t type to flow over netif_t and node_t, and only be hindered by MLS, need back port to RHEL6 - Keystone is now using a differnt port - Allow xdm_t to use usbmuxd daemon to control sound - Allow passwd daemon to execute gnome_exec_keyringd - Fix chrome_sandbox policy - Add labeling for /var/run/checkquorum-timer - More fixes for the dspam domain, needs back port to RHEL6 - More fixes for the dspam domain, needs back port to RHEL6 - sssd needs to connect to kerberos password port if a user changes his password - Lots of fixes from RHEL testing of dspam web - Allow chrome and mozilla_plugin to create msgq and semaphores - Fixes for dspam cgi scripts - Fixes for dspam cgi scripts - Allow confine users to ptrace screen - Backport virt_qemu_ga_t changes from RHEL - Fix labeling for dspam.cgi needed for RHEL6 - We need to back port this policy to RHEL6, for lxc domains - Dontaudit attempts to set sys_resource of logrotate - Allow corosync to read/write wdmd's tmpfs files - I see a ptrace of mozilla_plugin_t by staff_t, will allow without deny_ptrace being set - Allow cron jobs to read bind config for unbound - libvirt needs to inhibit systemd - kdumpctl needs to delete boot_t files - Fix duplicate gnome_config_filetrans - virtd_lxc_t is using /dev/fuse - Passenger needs to create a directory in /var/log, needs a backport to RHEL6 for openshift - apcupsd can be setup to listen to snmp trafic - Allow transition from kdumpgui to kdumpctl - Add fixes for munin CGI scripts - Allow deltacloud to connect to openstack at the keystone port - Allow domains that transition to svirt domains to be able to signal them - Fix file context of gstreamer in .cache directory - libvirt is communicating with logind - NetworkManager writes to the systemd inhibit pipe- Allow munin disk plugins to get attributes of all directories - Allow munin disk plugins to get attributes of all directorie - Allow logwatch to get attributes of all directories - Fix networkmanager_manage_lib() interface - Fix gnome_manage_config() to allow to manage sock_file - Fix virtual_domain_context - Add support for dynamic DNS for DHCPv6- Allow svirt to use netlink_route_socket which was a part of auth_use_nsswitch - Add additional labeling for /var/www/openshift/broker - Fix rhev policy - Allow openshift_initrc domain to dbus chat with systemd_logind - Allow httpd to getattr passenger log file if run_stickshift - Allow consolehelper-gtk to connect to xserver - Add labeling for the tmp-inst directory defined in pam_namespace.conf - Add lvm_metadata_t labeling for /etc/multipath- consoletype is no longer used- Add label for efivarfs - Allow certmonger to send signal to itself - Allow plugin-config to read own process status - Add more fixes for pacemaker - apache/drupal can run clamscan on uploaded content - Allow chrome_sandbox_nacl_t to read pid 1 content- Fix MCS Constraints to control ingres and egres controls on the network. - Change name of svirt_nokvm_t to svirt_tcg_t - Allow tuned to request the kernel to load kernel modules- Label /var/lib/pgsql/.ssh as ssh_home_t - Add labeling for /usr/bin/pg_ctl - Allow systemd-logind to manage keyring user tmp dirs - Add support for 7389/tcp port - gems seems to be placed in lots of places - Since xdm is running a full session, it seems to be trying to execute lots of executables via dbus - Add back tcp/8123 port as http_cache port - Add ovirt-guest-agent\.pid labeling - Allow xend to run scsi_id - Allow rhsmcertd-worker to read "physical_package_id" - Allow pki_tomcat to connect to ldap port - Allow lpr to read /usr/share/fonts - Allow open file from CD/DVD drive on domU - Allow munin services plugins to talk to SSSD - Allow all samba domains to create samba directory in var_t directories - Take away svirt_t ability to use nsswitch - Dontaudit attempts by openshift to read apache logs - Allow apache to create as well as append _ra_content_t - Dontaudit sendmail_t reading a leaked file descriptor - Add interface to have admin transition /etc/prelink.cache to the proper label - Add sntp support to ntp policy - Allow firewalld to dbus chat with devicekit_power - Allow tuned to call lsblk - Allow tor to read /proc/sys/kernel/random/uuid - Add tor_can_network_relay boolean- Add openshift_initrc_signal() interface - Fix typos - dspam port is treat as spamd_port_t - Allow setroubleshoot to getattr on all executables - Allow tuned to execute profiles scripts in /etc/tuned - Allow apache to create directories to store its log files - Allow all directories/files in /var/log starting with passenger to be labeled passenger_log_t - Looks like apache is sending sinal to openshift_initrc_t now,needs back port to RHEL6 - Allow Postfix to be configured to listen on TCP port 10026 for email from DSPAM - Add filename transition for /etc/tuned/active_profile - Allow condor_master to send mails - Allow condor_master to read submit.cf - Allow condor_master to create /tmp files/dirs - Allow condor_mater to send sigkill to other condor domains - Allow condor_procd sigkill capability - tuned-adm wants to talk with tuned daemon - Allow kadmind and krb5kdc to also list sssd_public_t - Allow accountsd to dbus chat with init - Fix git_read_generic_system_content_files() interface - pppd wants sys_nice by nmcli because of "syscall=sched_setscheduler" - Fix mozilla_plugin_can_network_connect to allow to connect to all ports - Label all munin plugins which are not covered by munin plugins policy as unconfined_munin_plugin_exec_t - dspam wants to search /var/spool for opendkim data - Revert "Add support for tcp/10026 port as dspam_port_t" - Turning on labeled networking requires additional access for netlabel_peer_t; these allow rules need to be back ported to RHEL6 - Allow all application domains to use fifo_files passed in from userdomains, also allow them to write to tmp_files inherited from userdomain - Allow systemd_tmpfiles_t to setattr on mandb_cache_t- consolekit.pp was not removed from the postinstall script- Add back consolekit policy - Silence bootloader trying to use inherited tty - Silence xdm_dbusd_t trying to execute telepathy apps - Fix shutdown avcs when machine has unconfined.pp disabled - The host and a virtual machine can share the same printer on a usb device - Change oddjob to transition to a ranged openshift_initr_exec_t when run from oddjob - Allow abrt_watch_log_t to execute bin_t - Allow chrome sandbox to write content in ~/.config/chromium - Dontaudit setattr on fontconfig dir for thumb_t - Allow lircd to request the kernel to load module - Make rsync as userdom_home_manager - Allow rsync to search automount filesystem - Add fixes for pacemaker- Add support for 4567/tcp port - Random fixes from Tuomo Soini - xdm wants to get init status - Allow programs to run in fips_mode - Add interface to allow the reading of all blk device nodes - Allow init to relabel rpcbind sock_file - Fix labeling for lastlog and faillog related to logrotate - ALlow aeolus_configserver to use TRAM port - Add fixes for aeolus_configserver - Allow snmpd to connect to snmp port - Allow spamd_update to create spamd_var_lib_t directories - Allow domains that can read sssd_public_t files to also list the directory - Remove miscfiles_read_localization, this is defined for all domains- Allow syslogd to request the kernel to load a module - Allow syslogd_t to read the network state information - Allow xdm_dbusd_t connect to the system DBUS - Add support for 7389/tcp port - Allow domains to read/write all inherited sockets - Allow staff_t to read kmsg - Add awstats_purge_apache_log boolean - Allow ksysguardproces to read /.config/Trolltech.conf - Allow passenger to create and append puppet log files - Add puppet_append_log and puppet_create_log interfaces - Add puppet_manage_log() interface - Allow tomcat domain to search tomcat_var_lib_t - Allow pki_tomcat_t to connect to pki_ca ports - Allow pegasus_t to have net_admin capability - Allow pegasus_t to write /sys/class/net//flags - Allow mailserver_delivery to manage mail_home_rw_t lnk_files - Allow fetchmail to create log files - Allow gnomeclock to manage home config in .kde - Allow bittlebee to read kernel sysctls - Allow logrotate to list /root- Fix userhelper_console_role_template() - Allow enabling Network Access Point service using blueman - Make vmware_host_t as unconfined domain - Allow authenticate users in webaccess via squid, using mysql as backend - Allow gathers to get various metrics on mounted file systems - Allow firewalld to read /etc/hosts - Fix cron_admin_role() to make sysadm cronjobs running in the sysadm_t instead of cronjob_t - Allow kdumpgui to read/write to zipl.conf - Commands needed to get mock to build from staff_t in enforcing mode - Allow mdadm_t to manage cgroup files - Allow all daemons and systemprocesses to use inherited initrc_tmp_t files - dontaudit ifconfig_t looking at fifo_files that are leaked to it - Add lableing for Quest Authentication System- Fix filetrans interface definitions - Dontaudit xdm_t to getattr on BOINC lib files - Add systemd_reload_all_services() interface - Dontaudit write access on /var/lib/net-snmp/mib_indexes - Only stop mcsuntrustedproc from relableing files - Allow accountsd to dbus chat with gdm - Allow realmd to getattr on all fs - Allow logrotate to reload all services - Add systemd unit file for radiusd - Allow winbind to create samba pid dir - Add labeling for /var/nmbd/unexpected - Allow chrome and mozilla plugin to connect to msnp ports- Fix storage_rw_inherited_fixed_disk_dev() to cover also blk_file - Dontaudit setfiles reading /dev/random - On initial boot gnomeclock is going to need to be set buy gdm - Fix tftp_read_content() interface - Random apps looking at kernel file systems - Testing virt with lxc requiers additional access for virsh_t - New allow rules requied for latest libvirt, libvirt talks directly to journald,lxc setup tool needs compromize_kernel,and we need ipc_lock in the container - Allow MPD to read /dev/radnom - Allow sandbox_web_type to read logind files which needs to read pulseaudio - Allow mozilla plugins to read /dev/hpet - Add labeling for /var/lib/zarafa-webap - Allow BOINC client to use an HTTP proxy for all connections - Allow rhsmertd to domain transition to dmidecod - Allow setroubleshootd to send D-Bus msg to ABRT- Define usbtty_device_t as a term_tty - Allow svnserve to accept a connection - Allow xend manage default virt_image_t type - Allow prelink_cron_system_t to overide user componant when executing cp - Add labeling for z-push - Gnomeclock sets the realtime clock - Openshift seems to be storing apache logs in /var/lib/openshift/.log/httpd - Allow lxc domains to use /dev/random and /dev/urandom- Add port defintion for tcp/9000 - Fix labeling for /usr/share/cluster/checkquorum to label also checkquorum.wdmd - Add rules and labeling for $HOME/cache/\.gstreamer-.* directory - Add support for CIM provider openlmi-networking which uses NetworkManager dbus API - Allow shorewall_t to create netlink_socket - Allow krb5admind to block suspend - Fix labels on /var/run/dlm_controld /var/log/dlm_controld - Allow krb5kdc to block suspend - gnomessytemmm_t needs to read /etc/passwd - Allow cgred to read all sysctls- Allow all domains to read /proc/sys/vm/overcommit_memory - Make proc_numa_t an MLS Trusted Object - Add /proc/numactl support for confined users - Allow ssh_t to connect to any port > 1023 - Add openvswitch domain - Pulseaudio tries to create directories in gnome_home_t directories - New ypbind pkg wants to search /var/run which is caused by sd_notify - Allow NM to read certs on NFS/CIFS using use_nfs_*, use_samba_* booleans - Allow sanlock to read /dev/random - Treat php-fpm with httpd_t - Allow domains that can read named_conf_t to be able to list the directories - Allow winbind to create sock files in /var/run/samba- Add smsd policy - Add support for OpenShift sbin labelin - Add boolean to allow virt to use rawip - Allow mozilla_plugin to read all file systems with noxattrs support - Allow kerberos to write on anon_inodefs fs - Additional access required by fenced - Add filename transitions for passwd.lock/group.lock - UPdate man pages - Create coolkey directory in /var/cache with the correct label- Fix label on /etc/group.lock - Allow gnomeclock to create lnk_file in /etc - label /root/.pki as a home_cert_t - Add interface to make sure rpcbind.sock is created with the correct label - Add definition for new directory /var/lib/os-probe and bootloader wants to read udev rules - opendkim should be a part of milter - Allow libvirt to set the kernel sched algorythm - Allow mongod to read sysfs_t - Add authconfig policy - Remove calls to miscfiles_read_localization all domains get this - Allow virsh_t to read /root/.pki/ content - Add label for log directory under /var/www/stickshift- Allow getty to setattr on usb ttys - Allow sshd to search all directories for sshd_home_t content - Allow staff domains to send dbus messages to kdumpgui - Fix labels on /etc/.pwd.lock and friends to be passwd_file_t - Dontaudit setfiles reading urand - Add files_dontaudit_list_tmp() for domains to which we added sys_nice/setsched - Allow staff_gkeyringd_t to read /home/$USER/.local/share/keyrings dir - Allow systemd-timedated to read /dev/urandom - Allow entropyd_t to read proc_t (meminfo) - Add unconfined munin plugin - Fix networkmanager_read_conf() interface - Allow blueman to list /tmp which is needed by sys_nic/setsched - Fix label of /etc/mail/aliasesdb-stamp - numad is searching cgroups - realmd is communicating with networkmanager using dbus - Lots of fixes to try to get kdump to work- Allow loging programs to dbus chat with realmd - Make apache_content_template calling as optional - realmd is using policy kit- Add new selinuxuser_use_ssh_chroot boolean - dbus needs to be able to read/write inherited fixed disk device_t passed through it - Cleanup netutils process allow rule - Dontaudit leaked fifo files from openshift to ping - sanlock needs to read mnt_t lnk files - Fail2ban needs to setsched and sys_nice- Change default label of all files in /var/run/rpcbind - Allow sandbox domains (java) to read hugetlbfs_t - Allow awstats cgi content to create tmp files and read apache log files - Allow setuid/setgid for cupsd-config - Allow setsched/sys_nice pro cupsd-config - Fix /etc/localtime sym link to be labeled locale_t - Allow sshd to search postgresql db t since this is a homedir - Allow xwindows users to chat with realmd - Allow unconfined domains to configure all files and null_device_t service- Adopt pki-selinux policy- pki is leaking which we dontaudit until a pki code fix - Allow setcap for arping - Update man pages - Add labeling for /usr/sbin/mcollectived - pki fixes - Allow smokeping to execute fping in the netutils_t domain- Allow mount to relabelfrom unlabeled file systems - systemd_logind wants to send and receive messages from devicekit disk over dbus to make connected mouse working - Add label to get bin files under libreoffice labeled correctly - Fix interface to allow executing of base_ro_file_type - Add fixes for realmd - Update pki policy - Add tftp_homedir boolean - Allow blueman sched_setscheduler - openshift user domains wants to r/w ssh tcp sockets- Additional requirements for disable unconfined module when booting - Fix label of systemd script files - semanage can use -F /dev/stdin to get input - syslog now uses kerberos keytabs - Allow xserver to compromise_kernel access - Allow nfsd to write to mount_var_run_t when running the mount command - Add filename transition rule for bin_t directories - Allow files to read usr_t lnk_files - dhcpc wants chown - Add support for new openshift labeling - Clean up for tunable+optional statements - Add labeling for /usr/sbin/mkhomedir_helper - Allow antivirus domain to managa amavis spool files - Allow rpcbind_t to read passwd - Allow pyzor running as spamc to manage amavis spool- Add interfaces to read kernel_t proc info - Missed this version of exec_all - Allow anyone who can load a kernel module to compromise kernel - Add oddjob_dbus_chat to openshift apache policy - Allow chrome_sandbox_nacl_t to send signals to itself - Add unit file support to usbmuxd_t - Allow all openshift domains to read sysfs info - Allow openshift domains to getattr on all domains- MLS fixes from Dan - Fix name of capability2 secure_firmware->compromise_kerne- Allow xdm to search all file systems - Add interface to allow the config of all files - Add rngd policy - Remove kgpg as a gpg_exec_t type - Allow plymouthd to block suspend - Allow systemd_dbus to config any file - Allow system_dbus_t to configure all services - Allow freshclam_t to read usr_files - varnishd requires execmem to load modules- Allow semanage to verify types - Allow sudo domain to execute user home files - Allow session_bus_type to transition to user_tmpfs_t - Add dontaudit caused by yum updates - Implement pki policy but not activated- tuned wants to getattr on all filesystems - tuned needs also setsched. The build is needed for test day- Add policy for qemu-qa - Allow razor to write own config files - Add an initial antivirus policy to collect all antivirus program - Allow qdisk to read usr_t - Add additional caps for vmware_host - Allow tmpfiles_t to setattr on mandb_cache_t - Dontaudit leaked files into mozilla_plugin_config_t - Allow wdmd to getattr on tmpfs - Allow realmd to use /dev/random - allow containers to send audit messages - Allow root mount any file via loop device with enforcing mls policy - Allow tmpfiles_t to setattr on mandb_cache_t - Allow tmpfiles_t to setattr on mandb_cache_t - Make userdom_dontaudit_write_all_ not allow open - Allow init scripts to read all unit files - Add support for saphostctrl ports- Add kernel_read_system_state to sandbox_client_t - Add some of the missing access to kdumpgui - Allow systemd_dbusd_t to status the init system - Allow vmnet-natd to request the kernel to load a module - Allow gsf-office-thum to append .cache/gdm/session.log - realmd wants to read .config/dconf/user - Firewalld wants sys_nice/setsched - Allow tmpreaper to delete mandb cache files - Firewalld wants sys_nice/setsched - Allow firewalld to perform a DNS name resolution - Allown winbind to read /usr/share/samba/codepages/lowcase.dat - Add support for HTTPProxy* in /etc/freshclam.conf - Fix authlogin_yubike boolean - Extend smbd_selinux man page to include samba booleans - Allow dhcpc to execute consoletype - Allow ping to use inherited tmp files created in init scripts - On full relabel with unconfined domain disabled, initrc was running some chcon's - Allow people who delete man pages to delete mandb cache files- Add missing permissive domains- Add new mandb policy - ALlow systemd-tmpfiles_t to relabel mandb_cache_t - Allow logrotate to start all unit files- Add fixes for ctbd - Allow nmbd to stream connect to ctbd - Make cglear_t as nsswitch_domain - Fix bogus in interfaces - Allow openshift to read/write postfix public pipe - Add postfix_manage_spool_maildrop_files() interface - stickshift paths have been renamed to openshift - gnome-settings-daemon wants to write to /run/systemd/inhibit/ pipes - Update man pages, adding ENTRYPOINTS- Add mei_device_t - Make sure gpg content in homedir created with correct label - Allow dmesg to write to abrt cache files - automount wants to search virtual memory sysctls - Add support for hplip logs stored in /var/log/hp/tmp - Add labeling for /etc/owncloud/config.php - Allow setroubleshoot to send analysys to syslogd-journal - Allow virsh_t to interact with new fenced daemon - Allow gpg to write to /etc/mail/spamassassiin directories - Make dovecot_deliver_t a mail server delivery type - Add label for /var/tmp/DNS25- Fixes for tomcat_domain template interface- Remove init_systemd and init_upstart boolean, Move init_daemon_domain and init_system_domain to use attributes - Add attribute to all base os types. Allow all domains to read all ro base OS types- Additional unit files to be defined as power unit files - Fix more boolean names- Fix boolean name so subs will continue to work- dbus needs to start getty unit files - Add interface to allow system_dbusd_t to start the poweroff service - xdm wants to exec telepathy apps - Allow users to send messages to systemdlogind - Additional rules needed for systemd and other boot apps - systemd wants to list /home and /boot - Allow gkeyringd to write dbus/conf file - realmd needs to read /dev/urand - Allow readahead to delete /.readahead if labeled root_t, might get created before policy is loaded- Fixes to safe more rules - Re-write tomcat_domain_template() - Fix passenger labeling - Allow all domains to read man pages - Add ephemeral_port_t to the 'generic' port interfaces - Fix the names of postgresql booleans- Stop using attributes form netlabel_peer and syslog, auth_use_nsswitch setsup netlabel_peer - Move netlable_peer check out of booleans - Remove call to recvfrom_netlabel for kerberos call - Remove use of attributes when calling syslog call - Move -miscfiles_read_localization to domain.te to save hundreds of allow rules - Allow all domains to read locale files. This eliminates around 1500 allow rules- Cleanup nis_use_ypbind_uncond interface - Allow rndc to block suspend - tuned needs to modify the schedule of the kernel - Allow svirt_t domains to read alsa configuration files - ighten security on irc domains and make sure they label content in homedir correctly - Add filetrans_home_content for irc files - Dontaudit all getattr access for devices and filesystems for sandbox domains - Allow stapserver to search cgroups directories - Allow all postfix domains to talk to spamd- Add interfaces to ignore setattr until kernel fixes this to be checked after the DAC check - Change pam_t to pam_timestamp_t - Add dovecot_domain attribute and allow this attribute block_suspend capability2 - Add sanlock_use_fusefs boolean - numad wants send/recieve msg - Allow rhnsd to send syslog msgs - Make piranha-pulse as initrc domain - Update openshift instances to dontaudit setattr until the kernel is fixed.- Fix auth_login_pgm_domain() interface to allow domains also managed user tmp dirs because of #856880 related to pam_systemd - Remove pam_selinux.8 which conflicts with man page owned by the pam package - Allow glance-api to talk to mysql - ABRT wants to read Xorg.0.log if if it detects problem with Xorg - Fix gstreamer filename trans. interface- Man page fixes by Dan Walsh- Allow postalias to read postfix config files - Allow man2html to read man pages - Allow rhev-agentd to search all mountpoints - Allow rhsmcertd to read /dev/random - Add tgtd_stream_connect() interface - Add cyrus_write_data() interface - Dontaudit attempts by sandboxX clients connectiing to the xserver_port_t - Add port definition for tcp/81 as http_port_t - Fix /dev/twa labeling - Allow systemd to read modules config- Merge openshift policy - Allow xauth to read /dev/urandom - systemd needs to relabel content in /run/systemd directories - Files unconfined should be able to perform all services on all files - Puppet tmp file can be leaked to all domains - Dontaudit rhsmcertd-worker to search /root/.local - Allow chown capability for zarafa domains - Allow system cronjobs to runcon into openshift domains - Allow virt_bridgehelper_t to manage content in the svirt_home_t labeled directories- nmbd wants to create /var/nmbd - Stop transitioning out of anaconda and firstboot, just causes AVC messages - Allow clamscan to read /etc files - Allow bcfg2 to bind cyphesis port - heartbeat should be run as rgmanager_t instead of corosync_t - Add labeling for /etc/openldap/certs - Add labeling for /opt/sartest directory - Make crontab_t as userdom home reader - Allow tmpreaper to list admin_home dir - Add defition for imap_0 replay cache file - Add support for gitolite3 - Allow virsh_t to send syslog messages - allow domains that can read samba content to be able to list the directories also - Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd - Separate out sandbox from sandboxX policy so we can disable it by default - Run dmeventd as lvm_t - Mounting on any directory requires setattr and write permissions - Fix use_nfs_home_dirs() boolean - New labels for pam_krb5 - Allow init and initrc domains to sys_ptrace since this is needed to look at processes not owned by uid 0 - Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd- Separate sandbox policy into sandbox and sandboxX, and disable sandbox by default on fresh installs - Allow domains that can read etc_t to read etc_runtime_t - Allow all domains to use inherited tmpfiles- Allow realmd to read resolv.conf - Add pegasus_cache_t type - Label /usr/sbin/fence_virtd as virsh_exec_t - Add policy for pkcsslotd - Add support for cpglockd - Allow polkit-agent-helper to read system-auth-ac - telepathy-idle wants to read gschemas.compiled - Allow plymouthd to getattr on fs_t - Add slpd policy - Allow ksysguardproces to read/write config_usr_t- Fix labeling substitution so rpm will label /lib/systemd content correctly- Add file name transitions for ttyACM0 - spice-vdagent(d)'s are going to log over to syslog - Add sensord policy - Add more fixes for passenger policy related to puppet - Allow wdmd to create wdmd_tmpfs_t - Fix labeling for /var/run/cachefilesd\.pid - Add thumb_tmpfs_t files type- Allow svirt domains to manage the network since this is containerized - Allow svirt_lxc_net_t to send audit messages- Make "snmpwalk -mREDHAT-CLUSTER-MIB ...." working - Allow dlm_controld to execute dlm_stonith labeled as bin_t - Allow GFS2 working on F17 - Abrt needs to execute dmesg - Allow jockey to list the contents of modeprobe.d - Add policy for lightsquid as squid_cron_t - Mailscanner is creating files and directories in /tmp - dmesg is now reading /dev/kmsg - Allow xserver to communicate with secure_firmware - Allow fsadm tools (fsck) to read /run/mount contnet - Allow sysadm types to read /dev/kmsg -- Allow postfix, sssd, rpcd to block_suspend - udev seems to need secure_firmware capability - Allow virtd to send dbus messages to firewalld so it can configure the firewall- Fix labeling of content in /run created by virsh_t - Allow condor domains to read kernel sysctls - Allow condor_master to connect to amqp - Allow thumb drives to create shared memory and semaphores - Allow abrt to read mozilla_plugin config files - Add labels for lightsquid - Default files in /opt and /usr that end in .cgi as httpd_sys_script_t, allow - dovecot_auth_t uses ldap for user auth - Allow domains that can read dhcp_etc_t to read lnk_files - Add more then one watchdog device - Allow useradd_t to manage etc_t files so it can rename it and edit them - Fix invalid class dir should be fifo_file - Move /run/blkid to fsadm and make sure labeling is correct- Fix bogus regex found by eparis - Fix manage run interface since lvm needs more access - syslogd is searching cgroups directory - Fixes to allow virt-sandbox-service to manage lxc var run content- Fix Boolean settings - Add new libjavascriptcoregtk as textrel_shlib_t - Allow xdm_t to create xdm_home_t directories - Additional access required for systemd - Dontaudit mozilla_plugin attempts to ipc_lock - Allow tmpreaper to delete unlabeled files - Eliminate screen_tmp_t and allow it to manage user_tmp_t - Dontaudit mozilla_plugin_config_t to append to leaked file descriptors - Allow web plugins to connect to the asterisk ports - Condor will recreate the lock directory if it does not exist - Oddjob mkhomedir needs to connectto user processes - Make oddjob_mkhomedir_t a userdom home manager- Put placeholder back in place for proper numbering of capabilities - Systemd also configures init scripts- Fix ecryptfs interfaces - Bootloader seems to be trolling around /dev/shm and /dev - init wants to create /etc/systemd/system-update.target.wants - Fix systemd_filetrans call to move it out of tunable - Fix up policy to work with systemd userspace manager - Add secure_firmware capability and remove bogus epolwakeup - Call seutil_*_login_config interfaces where should be needed - Allow rhsmcertd to send signal to itself - Allow thin domains to send signal to itself - Allow Chrome_ChildIO to read dosfs_t- Add role rules for realmd, sambagui- Add new type selinux_login_config_t for /etc/selinux//logins/ - Additional fixes for seutil_manage_module_store() - dbus_system_domain() should be used with optional_policy - Fix svirt to be allowed to use fusefs file system - Allow login programs to read /run/ data created by systemd_login - sssd wants to write /etc/selinux//logins/ for SELinux PAM module - Fix svirt to be allowed to use fusefs file system - Allow piranha domain to use nsswitch - Sanlock needs to send Kill Signals to non root processes - Pulseaudio wants to execute /run/user/PID/.orc- Fix saslauthd when it tries to read /etc/shadow - Label gnome-boxes as a virt homedir - Need to allow svirt_t ability to getattr on nfs_t file systems - Update sanlock policy to solve all AVC's - Change confined users can optionally manage virt content - Handle new directories under ~/.cache - Add block suspend to appropriate domains - More rules required for containers - Allow login programs to read /run/ data created by systemd_logind - Allow staff users to run svirt_t processes- Update to upstream- More fixes for systemd to make rawhide booting from Dan Walsh- Add systemd fixes to make rawhide booting- Add systemd_logind_inhibit_var_run_t attribute - Remove corenet_all_recvfrom_unlabeled() for non-contrib policies because we moved it to domain.if for all domain_type - Add interface for mysqld to dontaudit signull to all processes - Label new /var/run/journal directory correctly - Allow users to inhibit suspend via systemd - Add new type for the /var/run/inhibit directory - Add interface to send signull to systemd_login so avahi can send them - Allow systemd_passwd to send syslog messages - Remove corenet_all_recvfrom_unlabeled() calling fro policy files - Allow editparams.cgi running as httpd_bugzilla_script_t to read /etc/group - Allow smbd to read cluster config - Add additional labeling for passenger - Allow dbus to inhibit suspend via systemd - Allow avahi to send signull to systemd_login- Add interface to dontaudit getattr access on sysctls - Allow sshd to execute /bin/login - Looks like xdm is recreating the xdm directory in ~/.cache/ on login - Allow syslog to use the leaked kernel_t unix_dgram_socket from system-jounald - Fix semanage to work with unconfined domain disabled on F18 - Dontaudit attempts by mozilla plugins to getattr on all kernel sysctls - Virt seems to be using lock files - Dovecot seems to be searching directories of every mountpoint - Allow jockey to read random/urandom, execute shell and install third-party drivers - Add aditional params to allow cachedfiles to manage its content - gpg agent needs to read /dev/random - The kernel hands an svirt domains /SYSxxxxx which is a tmpfs that httpd wants to read and write - Add a bunch of dontaudit rules to quiet svirt_lxc domains - Additional perms needed to run svirt_lxc domains - Allow cgclear to read cgconfig - Allow sys_ptrace capability for snmp - Allow freshclam to read /proc - Allow procmail to manage /home/user/Maildir content - Allow NM to execute wpa_cli - Allow amavis to read clamd system state - Regenerate man pages- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild- Add realmd and stapserver policies - Allow useradd to manage stap-server lib files - Tighten up capabilities for confined users - Label /etc/security/opasswd as shadow_t - Add label for /dev/ecryptfs - Allow condor_startd_t to start sshd with the ranged - Allow lpstat.cups to read fips_enabled file - Allow pyzor running as spamc_t to create /root/.pyzor directory - Add labelinf for amavisd-snmp init script - Add support for amavisd-snmp - Allow fprintd sigkill self - Allow xend (w/o libvirt) to start virtual machines - Allow aiccu to read /etc/passwd - Allow condor_startd to Make specified domain MCS trusted for setting any category set for the processes it executes - Add condor_startd_ranged_domtrans_to() interface - Add ssd_conf_t for /etc/sssd - accountsd needs to fchown some files/directories - Add ICACLient and zibrauserdata as mozilla_filetrans_home_content - SELinux reports afs_t needs dac_override to read /etc/mtab, even though everything works, adding dontaudit - Allow xend_t to read the /etc/passwd file- Until we figure out how to fix systemd issues, allow all apps that send syslog messages to send them to kernel_t - Add init_access_check() interface - Fix label on /usr/bin/pingus to not be labeled as ping_exec_t - Allow tcpdump to create a netlink_socket - Label newusers like useradd - Change xdm log files to be labeled xdm_log_t - Allow sshd_t with privsep to work in MLS - Allow freshclam to update databases thru HTTP proxy - Allow s-m-config to access check on systemd - Allow abrt to read public files by default - Fix amavis_create_pid_files() interface - Add labeling and filename transition for dbomatic.log - Allow system_dbusd_t to stream connect to bluetooth, and use its socket - Allow amavisd to execute fsav - Allow tuned to use sys_admin and sys_nice capabilities - Add php-fpm policy from Bryan - Add labeling for aeolus-configserver-thinwrapper - Allow thin domains to execute shell - Fix gnome_role_gkeyringd() interface description - Lot of interface fixes - Allow OpenMPI job running as condor_startd_ssh_t to manage condor lib files - Allow OpenMPI job to use kerberos - Make deltacloudd_t as nsswitch_domain - Allow xend_t to run lsscsi - Allow qemu-dm running as xend_t to create tun_socket - Add labeling for /opt/brother/Printers(.*/)?inf - Allow jockey-backend to read pyconfig-64.h labeled as usr_t - Fix clamscan_can_scan_system boolean - Allow lpr to connectto to /run/user/$USER/keyring-22uREb/pkcs11- initrc is calling exportfs which is not confined so it attempts to read nfsd_files - Fixes for passenger running within openshift. - Add labeling for all tomcat6 dirs - Add support for tomcat6 - Allow cobblerd to read /etc/passwd - Allow jockey to read sysfs and and execute binaries with bin_t - Allow thum to use user terminals - Allow cgclear to read cgconfig config files - Fix bcf2g.fc - Remove sysnet_dns_name_resolve() from policies where auth_use_nsswitch() is used for other domains - Allow dbomatic to execute ruby - abrt_watch_log should be abrt_domain - Allow mozilla_plugin to connect to gatekeeper port- add ptrace_child access to process - remove files_read_etc_files() calling from all policies which have auth_use_nsswith() - Allow boinc domains to manage boinc_lib_t lnk_files - Add support for boinc-client.service unit file - Add support for boinc.log - Allow mozilla_plugin execmod on mozilla home files if allow_ex - Allow dovecot_deliver_t to read dovecot_var_run_t - Allow ldconfig and insmod to manage kdumpctl tmp files - Move thin policy out from cloudform.pp and add a new thin poli - pacemaker needs to communicate with corosync streams - abrt is now started on demand by dbus - Allow certmonger to talk directly to Dogtag servers - Change labeling for /var/lib/cobbler/webui_sessions to httpd_c - Allow mozila_plugin to execute gstreamer home files - Allow useradd to delete all file types stored in the users hom - rhsmcertd reads the rpm database - Add support for lightdm- Add tomcat policy - Remove pyzor/razor policy - rhsmcertd reads the rpm database - Dontaudit thumb to setattr on xdm_tmp dir - Allow wicd to execute ldconfig in the networkmanager_t domain - Add /var/run/cherokee\.pid labeling - Allow mozilla_plugin to create mozilla_plugin_tmp_t lnk files too - Allow postfix-master to r/w pipes other postfix domains - Allow snort to create netlink_socket - Add kdumpctl policy - Allow firstboot to create tmp_t files/directories - /usr/bin/paster should not be labeled as piranha_exec_t - remove initrc_domain from tomcat - Allow ddclient to read /etc/passwd - Allow useradd to delete all file types stored in the users homedir - Allow ldconfig and insmod to manage kdumpctl tmp files - Firstboot should be just creating tmp_t dirs and xauth should be allowed to write to those - Transition xauth files within firstboot_tmp_t - Fix labeling of /run/media to match /media - Label all lxdm.log as xserver_log_t - Add port definition for mxi port - Allow local_login_t to execute tmux- apcupsd needs to read /etc/passwd - Sanlock allso sends sigkill - Allow glance_registry to connect to the mysqld port - Dontaudit mozilla_plugin trying to getattr on /dev/gpmctl - Allow firefox plugins/flash to connect to port 1234 - Allow mozilla plugins to delete user_tmp_t files - Add transition name rule for printers.conf.O - Allow virt_lxc_t to read urand - Allow systemd_loigind to list gstreamer_home_dirs - Fix labeling for /usr/bin - Fixes for cloudform services * support FIPS - Allow polipo to work as web caching - Allow chfn to execute tmux- Add support for ecryptfs * ecryptfs does not support xattr * we need labeling for HOMEDIR - Add policy for (u)mount.ecryptfs* - Fix labeling of kerbero host cache files, allow rpc.svcgssd to manage host cache - Allow dovecot to manage Maildir content, fix transitions to Maildir - Allow postfix_local to transition to dovecot_deliver - Dontaudit attempts to setattr on xdm_tmp_t, looks like bogus code - Cleanup interface definitions - Allow apmd to change with the logind daemon - Changes required for sanlock in rhel6 - Label /run/user/apache as httpd_tmp_t - Allow thumb to use lib_t as execmod if boolean turned on - Allow squid to create the squid directory in /var with the correct labe - Add a new policy for glusterd from Bryan Bickford (bbickfor@redhat.com) - Allow virtd to exec xend_exec_t without transition - Allow virtd_lxc_t to unmount all file systems- PolicyKit path has changed - Allow httpd connect to dirsrv socket - Allow tuned to write generic kernel sysctls - Dontaudit logwatch to gettr on /dev/dm-2 - Allow policykit-auth to manage kerberos files - Make condor_startd and rgmanager as initrc domain - Allow virsh to read /etc/passwd - Allow mount to mount on user_tmp_t for /run/user/dwalsh/gvfs - xdm now needs to execute xsession_exec_t - Need labels for /var/lib/gdm - Fix files_filetrans_named_content() interface - Add new attribute - initrc_domain - Allow systemd_logind_t to signal, signull, sigkill all processes - Add filetrans rules for etc_runtime files- Rename boolean names to remove allow_- Mass merge with upstream * new policy topology to include contrib policy modules * we have now two base policy patches- Fix description of authlogin_nsswitch_use_ldap - Fix transition rule for rhsmcertd_t needed for RHEL7 - Allow useradd to list nfs state data - Allow openvpn to manage its log file and directory - We want vdsm to transition to mount_t when executing mount command to make sure /etc/mtab remains labeled correctly - Allow thumb to use nvidia devices - Allow local_login to create user_tmp_t files for kerberos - Pulseaudio needs to read systemd_login /var/run content - virt should only transition named system_conf_t config files - Allow munin to execute its plugins - Allow nagios system plugin to read /etc/passwd - Allow plugin to connect to soundd port - Fix httpd_passwd to be able to ask passwords - Radius servers can use ldap for backing store - Seems to need to mount on /var/lib for xguest polyinstatiation to work. - Allow systemd_logind to list the contents of gnome keyring - VirtualGL need xdm to be able to manage content in /etc/opt/VirtualGL - Add policy for isns-utils- Add policy for subversion daemon - Allow boinc to read passwd - Allow pads to read kernel network state - Fix man2html interface for sepolgen-ifgen - Remove extra /usr/lib/systemd/system/smb - Remove all /lib/systemd and replace with /usr/lib/systemd - Add policy for man2html - Fix the label of kerberos_home_t to krb5_home_t - Allow mozilla plugins to use Citrix - Allow tuned to read /proc/sys/kernel/nmi_watchdog - Allow tune /sys options via systemd's tmpfiles.d "w" type- Dontaudit lpr_t to read/write leaked mozilla tmp files - Add file name transition for .grl-podcasts directory - Allow corosync to read user tmp files - Allow fenced to create snmp lib dirs/files - More fixes for sge policy - Allow mozilla_plugin_t to execute any application - Allow dbus to read/write any open file descriptors to any non security file on the system that it inherits to that it can pass them to another domain - Allow mongod to read system state information - Fix wrong type, we should dontaudit sys_admin for xdm_t not xserver_t - Allow polipo to manage polipo_cache dirs - Add jabbar_client port to mozilla_plugin_t - Cleanup procmail policy - system bus will pass around open file descriptors on files that do not have labels on them - Allow l2tpd_t to read system state - Allow tuned to run ls /dev - Allow sudo domains to read usr_t files - Add label to machine-id - Fix corecmd_read_bin_symlinks cut and paste error- Fix pulseaudio port definition - Add labeling for condor_starter - Allow chfn_t to creat user_tmp_files - Allow chfn_t to execute bin_t - Allow prelink_cron_system_t to getpw calls - Allow sudo domains to manage kerberos rcache files - Allow user_mail_domains to work with courie - Port definitions necessary for running jboss apps within openshift - Add support for openstack-nova-metadata-api - Add support for nova-console* - Add support for openstack-nova-xvpvncproxy - Fixes to make privsep+SELinux working if we try to use chage to change passwd - Fix auth_role() interface - Allow numad to read sysfs - Allow matahari-rpcd to execute shell - Add label for ~/.spicec - xdm is executing lspci as root which is requesting a sys_admin priv but seems to succeed without it - Devicekit_disk wants to read the logind sessions file when writing a cd - Add fixes for condor to make condor jobs working correctly - Change label of /var/log/rpmpkgs to cron_log_t - Access requires to allow systemd-tmpfiles --create to work. - Fix obex to be a user application started by the session bus. - Add additional filename trans rules for kerberos - Fix /var/run/heartbeat labeling - Allow apps that are managing rcache to file trans correctly - Allow openvpn to authenticate against ldap server - Containers need to listen to network starting and stopping events- Make systemd unit files less specific- Fix zarafa labeling - Allow guest_t to fix labeling - corenet_tcp_bind_all_unreserved_ports(ssh_t) should be called with the user_tcp_server boolean - add lxc_contexts - Allow accountsd to read /proc - Allow restorecond to getattr on all file sytems - tmpwatch now calls getpw - Allow apache daemon to transition to pwauth domain - Label content under /var/run/user/NAME/keyring* as gkeyringd_tmp_t - The obex socket seems to be a stream socket - dd label for /var/run/nologin- Allow jetty running as httpd_t to read hugetlbfs files - Allow sys_nice and setsched for rhsmcertd - Dontaudit attempts by mozilla_plugin_t to bind to ssdp ports - Allow setfiles to append to xdm_tmp_t - Add labeling for /export as a usr_t directory - Add labels for .grl files created by gstreamer- Add labeling for /usr/share/jetty/bin/jetty.sh - Add jetty policy which contains file type definitios - Allow jockey to use its own fifo_file and make this the default for all domains - Allow mozilla_plugins to use spice (vnc_port/couchdb) - asterisk wants to read the network state - Blueman now uses /var/lib/blueman- Add label for nodejs_debug - Allow mozilla_plugin_t to create ~/.pki directory and content- Add clamscan_can_scan_system boolean - Allow mysqld to read kernel network state - Allow sshd to read/write condor lib files - Allow sshd to read/write condor-startd tcp socket - Fix description on httpd_graceful_shutdown - Allow glance_registry to communicate with mysql - dbus_system_domain is using systemd to lauch applications - add interfaces to allow domains to send kill signals to user mail agents - Remove unnessary access for svirt_lxc domains, add privs for virtd_lxc_t - Lots of new access required for secure containers - Corosync needs sys_admin capability - ALlow colord to create shm - .orc should be allowed to be created by any app that can create gstream home content, thumb_t to be specific - Add boolean to control whether or not mozilla plugins can create random content in the users homedir - Add new interface to allow domains to list msyql_db directories, needed for libra - shutdown has to be allowed to delete etc_runtime_t - Fail2ban needs to read /etc/passwd - Allow ldconfig to create /var/cache/ldconfig - Allow tgtd to read hardware state information - Allow collectd to create packet socket - Allow chronyd to send signal to itself - Allow collectd to read /dev/random - Allow collectd to send signal to itself - firewalld needs to execute restorecon - Allow restorecon and other login domains to execute restorecon- Allow logrotate to getattr on systemd unit files - Add support for tor systemd unit file - Allow apmd to create /var/run/pm-utils with the correct label - Allow l2tpd to send sigkill to pppd - Allow pppd to stream connect to l2tpd - Add label for scripts in /etc/gdm/ - Allow systemd_logind_t to ignore mcs constraints on sigkill - Fix files_filetrans_system_conf_named_files() interface - Add labels for /usr/share/wordpress/wp-includes/*.php - Allow cobbler to get SELinux mode and booleans- Add unconfined_execmem_exec_t as an alias to bin_t - Allow fenced to read snmp var lib files, also allow it to read usr_t - ontaudit access checks on all executables from mozilla_plugin - Allow all user domains to setexec, so that sshd will work properly if it call setexec(NULL) while running withing a user mode - Allow systemd_tmpfiles_t to getattr all pipes and sockets - Allow glance-registry to send system log messages - semanage needs to manage mock lib files/dirs- Add policy for abrt-watch-log - Add definitions for jboss_messaging ports - Allow systemd_tmpfiles to manage printer devices - Allow oddjob to use nsswitch - Fix labeling of log files for postgresql - Allow mozilla_plugin_t to execmem and execstack by default - Allow firewalld to execute shell - Fix /etc/wicd content files to get created with the correct label - Allow mcelog to exec shell - Add ~/.orc as a gstreamer_home_t - /var/spool/postfix/lib64 should be labeled lib_t - mpreaper should be able to list all file system labeled directories - Add support for apache to use openstack - Add labeling for /etc/zipl.conf and zipl binary - Turn on allow_execstack and turn off telepathy transition for final release- More access required for virt_qmf_t - Additional assess required for systemd-logind to support multi-seat - Allow mozilla_plugin to setrlimit - Revert changes to fuse file system to stop deadlock- Allow condor domains to connect to ephemeral ports - More fixes for condor policy - Allow keystone to stream connect to mysqld - Allow mozilla_plugin_t to read generic USB device to support GPS devices - Allow thum to file name transition gstreamer home content - Allow thum to read all non security files - Allow glance_api_t to connect to ephemeral ports - Allow nagios plugins to read /dev/urandom - Allow syslogd to search postfix spool to support postfix chroot env - Fix labeling for /var/spool/postfix/dev - Allow wdmd chown - Label .esd_auth as pulseaudio_home_t - Have no idea why keyring tries to write to /run/user/dwalsh/dconf/user, but we can dontaudit for now- Add support for clamd+systemd - Allow fresclam to execute systemctl to handle clamd - Change labeling for /usr/sbin/rpc.ypasswd.env - Allow yppaswd_t to execute yppaswd_exec_t - Allow yppaswd_t to read /etc/passwd - Gnomekeyring socket has been moved to /run/user/USER/ - Allow samba-net to connect to ldap port - Allow signal for vhostmd - allow mozilla_plugin_t to read user_home_t socket - New access required for secure Linux Containers - zfs now supports xattrs - Allow quantum to execute sudo and list sysfs - Allow init to dbus chat with the firewalld - Allow zebra to read /etc/passwd- Allow svirt_t to create content in the users homedir under ~/.libvirt - Fix label on /var/lib/heartbeat - Allow systemd_logind_t to send kill signals to all processes started by a user - Fuse now supports Xattr Support- upowered needs to setsched on the kernel - Allow mpd_t to manage log files - Allow xdm_t to create /var/run/systemd/multi-session-x - Add rules for missedfont.log to be used by thumb.fc - Additional access required for virt_qmf_t - Allow dhclient to dbus chat with the firewalld - Add label for lvmetad - Allow systemd_logind_t to remove userdomain sock_files - Allow cups to execute usr_t files - Fix labeling on nvidia shared libraries - wdmd_t needs access to sssd and /etc/passwd - Add boolean to allow ftp servers to run in passive mode - Allow namepspace_init_t to relabelto/from a different user system_u from the user the namespace_init running with - Fix using httpd_use_fusefs - Allow chrome_sandbox_nacl to write inherited user tmp files as we allow it for chrome_sandbox- Rename rdate port to time port, and allow gnomeclock to connect to it - We no longer need to transition to ldconfig from rpm, rpm_script, or anaconda - /etc/auto.* should be labeled bin_t - Add httpd_use_fusefs boolean - Add fixes for heartbeat - Allow sshd_t to signal processes that it transitions to - Add condor policy - Allow svirt to create monitors in ~/.libvirt - Allow dovecot to domtrans sendmail to handle sieve scripts - Lot of fixes for cfengine- /var/run/postmaster.* labeling is no longer needed - Alllow drbdadmin to read /dev/urandom - l2tpd_t seems to use ptmx - group+ and passwd+ should be labeled as /etc/passwd - Zarafa-indexer is a socket- Ensure lastlog is labeled correctly - Allow accountsd to read /proc data about gdm - Add fixes for tuned - Add bcfg2 fixes which were discovered during RHEL6 testing - More fixes for gnome-keyring socket being moved - Run semanage as a unconfined domain, and allow initrc_t to create tmpfs_t sym links on shutdown - Fix description for files_dontaudit_read_security_files() interface- Add new policy and man page for bcfg2 - cgconfig needs to use getpw calls - Allow domains that communicate with the keyring to use cache_home_t instead of gkeyringd_tmpt - gnome-keyring wants to create a directory in cache_home_t - sanlock calls getpw- Add numad policy and numad man page - Add fixes for interface bugs discovered by SEWatch - Add /tmp support for squid - Add fix for #799102 * change default labeling for /var/run/slapd.* sockets - Make thumb_t as userdom_home_reader - label /var/lib/sss/mc same as pubconf, so getpw domains can read it - Allow smbspool running as cups_t to stream connect to nmbd - accounts needs to be able to execute passwd on behalf of users - Allow systemd_tmpfiles_t to delete boot flags - Allow dnssec_trigger to connect to apache ports - Allow gnome keyring to create sock_files in ~/.cache - google_authenticator is using .google_authenticator - sandbox running from within firefox is exposing more leaks - Dontaudit thumb to read/write /dev/card0 - Dontaudit getattr on init_exec_t for gnomeclock_t - Allow certmonger to do a transition to certmonger_unconfined_t - Allow dhcpc setsched which is caused by nmcli - Add rpm_exec_t for /usr/sbin/bcfg2 - system cronjobs are sending dbus messages to systemd_logind - Thumnailers read /dev/urand- Allow auditctl getcap - Allow vdagent to use libsystemd-login - Allow abrt-dump-oops to search /etc/abrt - Got these avc's while trying to print a boarding pass from firefox - Devicekit is now putting the media directory under /run/media - Allow thumbnailers to create content in ~/.thumbails directory - Add support for proL2TPd by Dominick Grift - Allow all domains to call getcap - wdmd seems to get a random chown capability check that it does not need - Allow vhostmd to read kernel sysctls- Allow chronyd to read unix - Allow hpfax to read /etc/passwd - Add support matahari vios-proxy-* apps and add virtd_exec_t label for them - Allow rpcd to read quota_db_t - Update to man pages to match latest policy - Fix bug in jockey interface for sepolgen-ifgen - Add initial svirt_prot_exec_t policy- More fixes for systemd from Dan Walsh- Add a new type for /etc/firewalld and allow firewalld to write to this directory - Add definition for ~/Maildir, and allow mail deliver domains to write there - Allow polipo to run from a cron job - Allow rtkit to schedule wine processes - Allow mozilla_plugin_t to acquire a bug, and allow it to transition gnome content in the home dir to the proper label - Allow users domains to send signals to consolehelper domains- More fixes for boinc policy - Allow polipo domain to create its own cache dir and pid file - Add systemctl support to httpd domain - Add systemctl support to polipo, allow NetworkManager to manage the service - Add policy for jockey-backend - Add support for motion daemon which is now covered by zoneminder policy - Allow colord to read/write motion tmpfs - Allow vnstat to search through var_lib_t directories - Stop transitioning to quota_t, from init an sysadm_t- Add svirt_lxc_file_t as a customizable type- Add additional fixes for icmp nagios plugin - Allow cron jobs to open fifo_files from cron, since service script opens /dev/stdin - Add certmonger_unconfined_exec_t - Make sure tap22 device is created with the correct label - Allow staff users to read systemd unit files - Merge in previously built policy - Arpwatch needs to be able to start netlink sockets in order to start - Allow cgred_t to sys_ptrace to look at other DAC Processes- Back port some of the access that was allowed in nsplugin_t - Add definitiona for couchdb ports - Allow nagios to use inherited users ttys - Add git support for mock - Allow inetd to use rdate port - Add own type for rdate port - Allow samba to act as a portmapper - Dontaudit chrome_sandbox attempts to getattr on chr_files in /dev - New fixes needed for samba4 - Allow apps that use lib_t to read lib_t symlinks- Add policy for nove-cert - Add labeling for nova-openstack systemd unit files - Add policy for keystoke- Fix man pages fro domains - Add man pages for SELinux users and roles - Add storage_dev_filetrans_named_fixed_disk() and use it for smartmon - Add policy for matahari-rpcd - nfsd executes mount command on restart - Matahari domains execute renice and setsched - Dontaudit leaked tty in mozilla_plugin_config - mailman is changing to a per instance naming - Add 7600 and 4447 as jboss_management ports - Add fixes for nagios event handlers - Label httpd.event as httpd_exec_t, it is an apache daemon- Add labeling for /var/spool/postfix/dev/log - NM reads sysctl.conf - Iscsi log file context specification fix - Allow mozilla plugins to send dbus messages to user domains that transition to it - Allow mysql to read the passwd file - Allow mozilla_plugin_t to create mozilla home dirs in user homedir - Allow deltacloud to read kernel sysctl - Allow postgresql_t to connectto itselfAllow postgresql_t to connectto itself - Allow postgresql_t to connectto itself - Add login_userdomain attribute for users which can log in using terminal- Allow sysadm_u to reach system_r by default #784011 - Allow nagios plugins to use inherited user terminals - Razor labeling is not used no longer - Add systemd support for matahari - Add port_types to man page, move booleans to the top, fix some english - Add support for matahari-sysconfig-console - Clean up matahari.fc - Fix matahari_admin() interfac - Add labels for/etc/ssh/ssh_host_*.pub keys- Allow ksysguardproces to send system log msgs - Allow boinc setpgid and signull - Allow xdm_t to sys_ptrace to run pidof command - Allow smtpd_t to manage spool files/directories and symbolic links - Add labeling for jetty - Needed changes to get unbound/dnssec to work with openswan- Add user_fonts_t alias xfs_tmp_t - Since depmod now runs as insmod_t we need to write to kernel_object_t - Allow firewalld to dbus chat with networkmanager - Allow qpidd to connect to matahari ports - policykit needs to read /proc for uses not owned by it - Allow systemctl apps to connecto the init stream- Turn on deny_ptrace boolean- Remove pam_selinux.8 man page. There was a conflict.- Add proxy class and read access for gssd_proxy - Separate out the sharing public content booleans - Allow certmonger to execute a script and send signals to apache and dirsrv to reload the certificate - Add label transition for gstream-0.10 and 12 - Add booleans to allow rsync to share nfs and cifs file sytems - chrome_sandbox wants to read the /proc/PID/exe file of the program that executed it - Fix filename transitions for cups files - Allow denyhosts to read "unix" - Add file name transition for locale.conf.new - Allow boinc projects to gconf config files - sssd needs to be able to increase the socket limit under certain loads - sge_execd needs to read /etc/passwd - Allow denyhost to check network state - NetworkManager needs to read sessions data - Allow denyhost to check network state - Allow xen to search virt images directories - Add label for /dev/megaraid_sas_ioctl_node - Add autogenerated man pages- Allow boinc project to getattr on fs - Allow init to execute initrc_state_t - rhev-agent package was rename to ovirt-guest-agent - If initrc_t creates /etc/local.conf then we need to make sure it is labeled correctly - sytemd writes content to /run/initramfs and executes it on shutdown - kdump_t needs to read /etc/mtab, should be back ported to F16 - udev needs to load kernel modules in early system boot- Need to add sys_ptrace back in since reading any content in /proc can cause these accesses - Add additional systemd interfaces which are needed fro *_admin interfaces - Fix bind_admin() interface- Allow firewalld to read urand - Alias java, execmem_mono to bin_t to allow third parties - Add label for kmod - /etc/redhat-lsb contains binaries - Add boolean to allow gitosis to send mail - Add filename transition also for "event20" - Allow systemd_tmpfiles_t to delete all file types - Allow collectd to ipc_lock- make consoletype_exec optional, so we can remove consoletype policy - remove unconfined_permisive.patch - Allow openvpn_t to inherit user home content and tmp content - Fix dnssec-trigger labeling - Turn on obex policy for staff_t - Pem files should not be secret - Add lots of rules to fix AVC's when playing with containers - Fix policy for dnssec - Label ask-passwd directories correctly for systemd- sshd fixes seem to be causing unconfined domains to dyntrans to themselves - fuse file system is now being mounted in /run/user - systemd_logind is sending signals to processes that are dbus messaging with it - Add support for winshadow port and allow iscsid to connect to this port - httpd should be allowed to bind to the http_port_t udp socket - zarafa_var_lib_t can be a lnk_file - A couple of new .xsession-errors files - Seems like user space and login programs need to read logind_sessions_files - Devicekit disk seems to be being launched by systemd - Cleanup handling of setfiles so most of rules in te file - Correct port number for dnssec - logcheck has the home dir set to its cache- Add policy for grindengine MPI jobs- Add new sysadm_secadm.pp module * contains secadm definition for sysadm_t - Move user_mail_domain access out of the interface into the te file - Allow httpd_t to create httpd_var_lib_t directories as well as files - Allow snmpd to connect to the ricci_modcluster stream - Allow firewalld to read /etc/passwd - Add auth_use_nsswitch for colord - Allow smartd to read network state - smartdnotify needs to read /etc/group- Allow gpg and gpg_agent to store sock_file in gpg_secret_t directory - lxdm startup scripts should be labeled bin_t, so confined users will work - mcstransd now creates a pid, needs back port to F16 - qpidd should be allowed to connect to the amqp port - Label devices 010-029 as usb devices - ypserv packager says ypserv does not use tmp_t so removing selinux policy types - Remove all ptrace commands that I believe are caused by the kernel/ps avcs - Add initial Obex policy - Add logging_syslogd_use_tty boolean - Add polipo_connect_all_unreserved bolean - Allow zabbix to connect to ftp port - Allow systemd-logind to be able to switch VTs - Allow apache to communicate with memcached through a sock_file- Fix file_context.subs_dist for now to work with pre usrmove- More /usr move fixes- Add zabbix_can_network boolean - Add httpd_can_connect_zabbix boolean - Prepare file context labeling for usrmove functions - Allow system cronjobs to read kernel network state - Add support for selinux_avcstat munin plugin - Treat hearbeat with corosync policy - Allow corosync to read and write to qpidd shared mem - mozilla_plugin is trying to run pulseaudio - Fixes for new sshd patch for running priv sep domains as the users context - Turn off dontaudit rules when turning on allow_ypbind - udev now reads /etc/modules.d directory- Turn on deny_ptrace boolean for the Rawhide run, so we can test this out - Cups exchanges dbus messages with init - udisk2 needs to send syslog messages - certwatch needs to read /etc/passwd- Add labeling for udisks2 - Allow fsadmin to communicate with the systemd process- Treat Bip with bitlbee policy * Bip is an IRC proxy - Add port definition for interwise port - Add support for ipa_memcached socket - systemd_jounald needs to getattr on all processes - mdadmin fixes * uses getpw - amavisd calls getpwnam() - denyhosts calls getpwall()- Setup labeling of /var/rsa and /var/lib/rsa to allow login programs to write there - bluetooth says they do not use /tmp and want to remove the type - Allow init to transition to colord - Mongod needs to read /proc/sys/vm/zone_reclaim_mode - Allow postfix_smtpd_t to connect to spamd - Add boolean to allow ftp to connect to all ports > 1023 - Allow sendmain to write to inherited dovecot tmp files - setroubleshoot needs to be able to execute rpm to see what version of packages- Merge systemd patch - systemd-tmpfiles wants to relabel /sys/devices/system/cpu/online - Allow deltacloudd dac_override, setuid, setgid caps - Allow aisexec to execute shell - Add use_nfs_home_dirs boolean for ssh-keygen- Fixes to make rawhide boot in enforcing mode with latest systemd changes- Add labeling for /var/run/systemd/journal/syslog - libvirt sends signals to ifconfig - Allow domains that read logind session files to list them- Fixed destined form libvirt-sandbox - Allow apps that list sysfs to also read sympolicy links in this filesystem - Add ubac_constrained rules for chrome_sandbox - Need interface to allow domains to use tmpfs_t files created by the kernel, used by libra - Allow postgresql to be executed by the caller - Standardize interfaces of daemons - Add new labeling for mm-handler - Allow all matahari domains to read network state and etc_runtime_t files- New fix for seunshare, requires seunshare_domains to be able to mounton / - Allow systemctl running as logrotate_t to connect to private systemd socket - Allow tmpwatch to read meminfo - Allow rpc.svcgssd to read supported_krb5_enctype - Allow zarafa domains to read /dev/random and /dev/urandom - Allow snmpd to read dev_snmp6 - Allow procmail to talk with cyrus - Add fixes for check_disk and check_nagios plugins- default trans rules for Rawhide policy - Make sure sound_devices controlC* are labeled correctly on creation - sssd now needs sys_admin - Allow snmp to read all proc_type - Allow to setup users homedir with quota.group- Add httpd_can_connect_ldap() interface - apcupsd_t needs to use seriel ports connected to usb devices - Kde puts procmail mail directory under ~/.local/share - nfsd_t can trigger sys_rawio on tests that involve too many mountpoints, dontaudit for now - Add labeling for /sbin/iscsiuio- Add label for /var/lib/iscan/interpreter - Dont audit writes to leaked file descriptors or redirected output for nacl - NetworkManager needs to write to /sys/class/net/ib*/mode- Allow abrt to request the kernel to load a module - Make sure mozilla content is labeled correctly - Allow tgtd to read system state - More fixes for boinc * allow to resolve dns name * re-write boinc policy to use boinc_domain attribute - Allow munin services plugins to use NSCD services- Allow mozilla_plugin_t to manage mozilla_home_t - Allow ssh derived domain to execute ssh-keygen in the ssh_keygen_t domain - Add label for tumblerd- Fixes for xguest package- Fixes related to /bin, /sbin - Allow abrt to getattr on blk files - Add type for rhev-agent log file - Fix labeling for /dev/dmfm - Dontaudit wicd leaking - Allow systemd_logind_t to look at process info of apps that exchange dbus messages with it - Label /etc/locale.conf correctly - Allow user_mail_t to read /dev/random - Allow postfix-smtpd to read MIMEDefang - Add label for /var/log/suphp.log - Allow swat_t to connect and read/write nmbd_t sock_file - Allow systemd-tmpfiles to setattr for /run/user/gdm/dconf - Allow systemd-tmpfiles to change user identity in object contexts - More fixes for rhev_agentd_t consolehelper policy- Use fs_use_xattr for squashf - Fix procs_type interface - Dovecot has a new fifo_file /var/run/dovecot/stats-mail - Dovecot has a new fifo_file /var/run/stats-mail - Colord does not need to connect to network - Allow system_cronjob to dbus chat with NetworkManager - Puppet manages content, want to make sure it labels everything correctly- Change port 9050 to tor_socks_port_t and then allow openvpn to connect to it - Allow all postfix domains to use the fifo_file - Allow sshd_t to getattr on all file systems in order to generate avc on nfs_t - Allow apmd_t to read grub.cfg - Let firewallgui read the selinux config - Allow systemd-tmpfiles to delete content in /root that has been moved to /tmp - Fix devicekit_manage_pid_files() interface - Allow squid to check the network state - Dontaudit colord getattr on file systems - Allow ping domains to read zabbix_tmp_t files- Allow mcelog_t to create dir and file in /var/run and label it correctly - Allow dbus to manage fusefs - Mount needs to read process state when mounting gluster file systems - Allow collectd-web to read collectd lib files - Allow daemons and system processes started by init to read/write the unix_stream_socket passed in from as stdin/stdout/stderr - Allow colord to get the attributes of tmpfs filesystem - Add sanlock_use_nfs and sanlock_use_samba booleans - Add bin_t label for /usr/lib/virtualbox/VBoxManage- Add ssh_dontaudit_search_home_dir - Changes to allow namespace_init_t to work - Add interface to allow exec of mongod, add port definition for mongod port, 27017 - Label .kde/share/apps/networkmanagement/certificates/ as home_cert_t - Allow spamd and clamd to steam connect to each other - Add policy label for passwd.OLD - More fixes for postfix and postfix maildro - Add ftp support for mozilla plugins - Useradd now needs to manage policy since it calls libsemanage - Fix devicekit_manage_log_files() interface - Allow colord to execute ifconfig - Allow accountsd to read /sys - Allow mysqld-safe to execute shell - Allow openct to stream connect to pcscd - Add label for /var/run/nm-dns-dnsmasq\.conf - Allow networkmanager to chat with virtd_t- Pulseaudio changes - Merge patches- Merge patches back into git repository.- Remove allow_execmem boolean and replace with deny_execmem boolean- Turn back on allow_execmem boolean- Add more MCS fixes to make sandbox working - Make faillog MLS trusted to make sudo_$1_t working - Allow sandbox_web_client_t to read passwd_file_t - Add .mailrc file context - Remove execheap from openoffice domain - Allow chrome_sandbox_nacl_t to read cpu_info - Allow virtd to relabel generic usb which is need if USB device - Fixes for virt.if interfaces to consider chr_file as image file type- Remove Open Office policy - Remove execmem policy- MCS fixes - quota fixes- Remove transitions to consoletype- Make nvidia* to be labeled correctly - Fix abrt_manage_cache() interface - Make filetrans rules optional so base policy will build - Dontaudit chkpwd_t access to inherited TTYS - Make sure postfix content gets created with the correct label - Allow gnomeclock to read cgroup - Fixes for cloudform policy- Check in fixed for Chrome nacl support- Begin removing qemu_t domain, we really no longer need this domain. - systemd_passwd needs dac_overide to communicate with users TTY's - Allow svirt_lxc domains to send kill signals within their container- Remove qemu.pp again without causing a crash- Remove qemu.pp, everything should use svirt_t or stay in its current domain- Allow policykit to talk to the systemd via dbus - Move chrome_sandbox_nacl_t to permissive domains - Additional rules for chrome_sandbox_nacl- Change bootstrap name to nacl - Chrome still needs execmem - Missing role for chrome_sandbox_bootstrap - Add boolean to remove execmem and execstack from virtual machines - Dontaudit xdm_t doing an access_check on etc_t directories- Allow named to connect to dirsrv by default - add ldapmap1_0 as a krb5_host_rcache_t file - Google chrome developers asked me to add bootstrap policy for nacl stuff - Allow rhev_agentd_t to getattr on mountpoints - Postfix_smtpd_t needs access to milters and cleanup seems to read/write postfix_smtpd_t unix_stream_sockets- Fixes for cloudform policies which need to connect to random ports - Make sure if an admin creates modules content it creates them with the correct label - Add port 8953 as a dns port used by unbound - Fix file name transition for alsa and confined users- Turn on mock_t and thumb_t for unconfined domains- Policy update should not modify local contexts- Remove ada policy- Remove tzdata policy - Add labeling for udev - Add cloudform policy - Fixes for bootloader policy- Add policies for nova openstack- Add fixes for nova-stack policy- Allow svirt_lxc_domain to chr_file and blk_file devices if they are in the domain - Allow init process to setrlimit on itself - Take away transition rules for users executing ssh-keygen - Allow setroubleshoot_fixit_t to read /dev/urand - Allow sshd to relbale tunnel sockets - Allow fail2ban domtrans to shorewall in the same way as with iptables - Add support for lnk files in the /var/lib/sssd directory - Allow system mail to connect to courier-authdaemon over an unix stream socket- Add passwd_file_t for /etc/ptmptmp- Dontaudit access checks for all executables, gnome-shell is doing access(EXEC, X_OK) - Make corosync to be able to relabelto cluster lib fies - Allow samba domains to search /var/run/nmbd - Allow dirsrv to use pam - Allow thumb to call getuid - chrome less likely to get mmap_zero bug so removing dontaudit - gimp help-browser has built in javascript - Best guess is that devices named /dev/bsr4096 should be labeled as cpu_device_t - Re-write glance policy- Move dontaudit sys_ptrace line from permissive.te to domain.te - Remove policy for hal, it no longer exists- Don't check md5 size or mtime on certain config files- Remove allow_ptrace and replace it with deny_ptrace, which will remove all ptrace from the system - Remove 2000 dontaudit rules between confined domains on transition and replace with single dontaudit domain domain:process { noatsecure siginh rlimitinh } ;- Fixes for bootloader policy - $1_gkeyringd_t needs to read $HOME/%USER/.local/share/keystore - Allow nsplugin to read /usr/share/config - Allow sa-update to update rules - Add use_fusefs_home_dirs for chroot ssh option - Fixes for grub2 - Update systemd_exec_systemctl() interface - Allow gpg to read the mail spool - More fixes for sa-update running out of cron job - Allow ipsec_mgmt_t to read hardware state information - Allow pptp_t to connect to unreserved_port_t - Dontaudit getattr on initctl in /dev from chfn - Dontaudit getattr on kernel_core from chfn - Add systemd_list_unit_dirs to systemd_exec_systemctl call - Fixes for collectd policy - CHange sysadm_t to create content as user_tmp_t under /tmp- Shrink size of policy through use of attributes for userdomain and apache- Allow virsh to read xenstored pid file - Backport corenetwork fixes from upstream - Do not audit attempts by thumb to search config_home_t dirs (~/.config) - label ~/.cache/telepathy/logger telepathy_logger_cache_home_t - allow thumb to read generic data home files (mime.type)- Allow nmbd to manage sock file in /var/run/nmbd - ricci_modservice send syslog msgs - Stop transitioning from unconfined_t to ldconfig_t, but make sure /etc/ld.so.cache is labeled correctly - Allow systemd_logind_t to manage /run/USER/dconf/user- Fix missing patch from F16- Allow logrotate setuid and setgid since logrotate is supposed to do it - Fixes for thumb policy by grift - Add new nfsd ports - Added fix to allow confined apps to execmod on chrome - Add labeling for additional vdsm directories - Allow Exim and Dovecot SASL - Add label for /var/run/nmbd - Add fixes to make virsh and xen working together - Colord executes ls - /var/spool/cron is now labeled as user_cron_spool_t- Stop complaining about leaked file descriptors during install- Remove java and mono module and merge into execmem- Fixes for thumb policy and passwd_file_t- Fixes caused by the labeling of /etc/passwd - Add thumb.patch to transition unconfined_t to thumb_t for Rawhide- Add support for Clustered Samba commands - Allow ricci_modrpm_t to send log msgs - move permissive virt_qmf_t from virt.te to permissivedomains.te - Allow ssh_t to use kernel keyrings - Add policy for libvirt-qmf and more fixes for linux containers - Initial Polipo - Sanlock needs to run ranged in order to kill svirt processes - Allow smbcontrol to stream connect to ctdbd- Add label for /etc/passwd- Change unconfined_domains to permissive for Rawhide - Add definition for the ephemeral_ports- Make mta_role() active - Allow asterisk to connect to jabber client port - Allow procmail to read utmp - Add NIS support for systemd_logind_t - Allow systemd_logind_t to manage /run/user/$USER/dconf dir which is labeled as config_home_t - Fix systemd_manage_unit_dirs() interface - Allow ssh_t to manage directories passed into it - init needs to be able to create and delete unit file directories - Fix typo in apache_exec_sys_script - Add ability for logrotate to transition to awstat domain- Change screen to use screen_domain attribute and allow screen_domains to read all process domain state - Add SELinux support for ssh pre-auth net process in F17 - Add logging_syslogd_can_sendmail boolean- Add definition for ephemeral ports - Define user_tty_device_t as a customizable_type- Needs to require a new version of checkpolicy - Interface fixes- Allow sanlock to manage virt lib files - Add virt_use_sanlock booelan - ksmtuned is trying to resolve uids - Make sure .gvfs is labeled user_home_t in the users home directory - Sanlock sends kill signals and needs the kill capability - Allow mockbuild to work on nfs homedirs - Fix kerberos_manage_host_rcache() interface - Allow exim to read system state- Allow systemd-tmpfiles to set the correct labels on /var/run, /tmp and other files - We want any file type that is created in /tmp by a process running as initrc_t to be labeled initrc_tmp_t- Allow collectd to read hardware state information - Add loop_control_device_t - Allow mdadm to request kernel to load module - Allow domains that start other domains via systemctl to search unit dir - systemd_tmpfilses, needs to list any file systems mounted on /tmp - No one can explain why radius is listing the contents of /tmp, so we will dontaudit - If I can manage etc_runtime files, I should be able to read the links - Dontaudit hostname writing to mock library chr_files - Have gdm_t setup labeling correctly in users home dir - Label content unde /var/run/user/NAME/dconf as config_home_t - Allow sa-update to execute shell - Make ssh-keygen working with fips_enabled - Make mock work for staff_t user - Tighten security on mock_t- removing unconfined_notrans_t no longer necessary - Clean up handling of secure_mode_insmod and secure_mode_policyload - Remove unconfined_mount_t- Add exim_exec_t label for /usr/sbin/exim_tidydb - Call init_dontaudit_rw_stream_socket() interface in mta policy - sssd need to search /var/cache/krb5rcache directory - Allow corosync to relabel own tmp files - Allow zarafa domains to send system log messages - Allow ssh to do tunneling - Allow initrc scripts to sendto init_t unix_stream_socket - Changes to make sure dmsmasq and virt directories are labeled correctly - Changes needed to allow sysadm_t to manage systemd unit files - init is passing file descriptors to dbus and on to system daemons - Allow sulogin additional access Reported by dgrift and Jeremy Miller - Steve Grubb believes that wireshark does not need this access - Fix /var/run/initramfs to stop restorecon from looking at - pki needs another port - Add more labels for cluster scripts - Allow apps that manage cgroup_files to manage cgroup link files - Fix label on nfs-utils scripts directories - Allow gatherd to read /dev/rand and /dev/urand- pki needs another port - Add more labels for cluster scripts - Fix label on nfs-utils scripts directories - Fixes for cluster - Allow gatherd to read /dev/rand and /dev/urand - abrt leaks fifo files- Add glance policy - Allow mdadm setsched - /var/run/initramfs should not be relabeled with a restorecon run - memcache can be setup to override sys_resource - Allow httpd_t to read tetex data - Allow systemd_tmpfiles to delete kernel modules left in /tmp directory.- Allow Postfix to deliver to Dovecot LMTP socket - Ignore bogus sys_module for lldpad - Allow chrony and gpsd to send dgrams, gpsd needs to write to the real time clock - systemd_logind_t sets the attributes on usb devices - Allow hddtemp_t to read etc_t files - Add permissivedomains module - Move all permissive domains calls to permissivedomain.te - Allow pegasis to send kill signals to other UIDs- Allow insmod_t to use fds leaked from devicekit - dontaudit getattr between insmod_t and init_t unix_stream_sockets - Change sysctl unit file interfaces to use systemctl - Add support for chronyd unit file - Allow mozilla_plugin to read gnome_usr_config - Add policy for new gpsd - Allow cups to create kerberos rhost cache files - Add authlogin_filetrans_named_content, to unconfined_t to make sure shadow and other log files get labeled correctly- Make users_extra and seusers.final into config(noreplace) so semanage users and login does not get overwritten- Add policy for sa-update being run out of cron jobs - Add create perms to postgresql_manage_db - ntpd using a gps has to be able to read/write generic tty_device_t - If you disable unconfined and unconfineduser, rpm needs more privs to manage /dev - fix spec file - Remove qemu_domtrans_unconfined() interface - Make passenger working together with puppet - Add init_dontaudit_rw_stream_socket interface - Fixes for wordpress- Turn on allow_domain_fd_use boolean on F16 - Allow syslog to manage all log files - Add use_fusefs_home_dirs boolean for chrome - Make vdagent working with confined users - Add abrt_handle_event_t domain for ABRT event scripts - Labeled /usr/sbin/rhnreg_ks as rpm_exec_t and added changes related to this change - Allow httpd_git_script_t to read passwd data - Allow openvpn to set its process priority when the nice parameter is used- livecd fixes - spec file fixes- fetchmail can use kerberos - ksmtuned reads in shell programs - gnome_systemctl_t reads the process state of ntp - dnsmasq_t asks the kernel to load multiple kernel modules - Add rules for domains executing systemctl - Bogus text within fc file- Add cfengine policy- Add abrt_domain attribute - Allow corosync to manage cluster lib files - Allow corosync to connect to the system DBUS- Add sblim, uuidd policies - Allow kernel_t dyntrasition to init_t- init_t need setexec - More fixes of rules which cause an explosion in rules by Dan Walsh- Allow rcsmcertd to perform DNS name resolution - Add dirsrvadmin_unconfined_script_t domain type for 389-ds admin scripts - Allow tmux to run as screen - New policy for collectd - Allow gkeyring_t to interact with all user apps - Add rules to allow firstboot to run on machines with the unconfined.pp module removed- Allow systemd_logind to send dbus messages with users - allow accountsd to read wtmp file - Allow dhcpd to get and set capabilities- Fix oracledb_port definition - Allow mount to mounton the selinux file system - Allow users to list /var directories- systemd fixes- Add initial policy for abrt_dump_oops_t - xtables-multi wants to getattr of the proc fs - Smoltclient is connecting to abrt - Dontaudit leaked file descriptors to postdrop - Allow abrt_dump_oops to look at kernel sysctls - Abrt_dump_oops_t reads kernel ring buffer - Allow mysqld to request the kernel to load modules - systemd-login needs fowner - Allow postfix_cleanup_t to searh maildrop- Initial systemd_logind policy - Add policy for systemd_logger and additional proivs for systemd_logind - More fixes for systemd policies- Allow setsched for virsh - Systemd needs to impersonate cups, which means it needs to create tcp_sockets in cups_t domain, as well as manage spool directories - iptables: the various /sbin/ip6?tables.* are now symlinks for /sbin/xtables-multi- A lot of users are running yum -y update while in /root which is causing ldconfig to list the contents, adding dontaudit - Allow colord to interact with the users through the tmpfs file system - Since we changed the label on deferred, we need to allow postfix_qmgr_t to be able to create maildrop_t files - Add label for /var/log/mcelog - Allow asterisk to read /dev/random if it uses TLS - Allow colord to read ini files which are labeled as bin_t - Allow dirsrvadmin sys_resource and setrlimit to use ulimit - Systemd needs to be able to create sock_files for every label in /var/run directory, cupsd being the first. - Also lists /var and /var/spool directories - Add openl2tpd to l2tpd policy - qpidd is reading the sysfs file- Change usbmuxd_t to dontaudit attempts to read chr_file - Add mysld_safe_exec_t for libra domains to be able to start private mysql domains - Allow pppd to search /var/lock dir - Add rhsmcertd policy- Update to upstream- More fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git- Fix spec file to not report Verify errors- Add dspam policy - Add lldpad policy - dovecot auth wants to search statfs #713555 - Allow systemd passwd apps to read init fifo_file - Allow prelink to use inherited terminals - Run cherokee in the httpd_t domain - Allow mcs constraints on node connections - Implement pyicqt policy - Fixes for zarafa policy - Allow cobblerd to send syslog messages- Add policy.26 to the payload - Remove olpc stuff - Remove policygentool- Fixes for zabbix - init script needs to be able to manage sanlock_var_run_... - Allow sandlock and wdmd to create /var/run directories... - mixclip.so has been compiled correctly - Fix passenger policy module name- Add mailscanner policy from dgrift - Allow chrome to optionally be transitioned to - Zabbix needs these rules when starting the zabbix_server_mysql - Implement a type for freedesktop openicc standard (~/.local/share/icc) - Allow system_dbusd_t to read inherited icc_data_home_t files. - Allow colord_t to read icc_data_home_t content. #706975 - Label stuff under /usr/lib/debug as if it was labeled under /- Fixes for sanlock policy - Fixes for colord policy - Other fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git;a=log- Add rhev policy module to modules-targeted.conf- Lot of fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git;a=log- Allow logrotate to execute systemctl - Allow nsplugin_t to getattr on gpmctl - Fix dev_getattr_all_chr_files() interface - Allow shorewall to use inherited terms - Allow userhelper to getattr all chr_file devices - sandbox domains should be able to getattr and dontaudit search of sysctl_kernel_t - Fix labeling for ABRT Retrace Server- Dontaudit sys_module for ifconfig - Make telepathy and gkeyringd daemon working with confined users - colord wants to read files in users homedir - Remote login should be creating user_tmp_t not its own tmp files- Fix label for /usr/share/munin/plugins/munin_* plugins - Add support for zarafa-indexer - Fix boolean description - Allow colord to getattr on /proc/scsi/scsi - Add label for /lib/upstart/init - Colord needs to list /mnt- Forard port changes from F15 for telepathy - NetworkManager should be allowed to use /dev/rfkill - Fix dontaudit messages to say Domain to not audit - Allow telepathy domains to read/write gnome_cache files - Allow telepathy domains to call getpw - Fixes for colord and vnstatd policy- Allow init_t getcap and setcap - Allow namespace_init_t to use nsswitch - aisexec will execute corosync - colord tries to read files off noxattr file systems - Allow init_t getcap and setcap- Add support for ABRT retrace server - Allow user_t and staff_t access to generic scsi to handle locally plugged in scanners - Allow telepath_msn_t to read /proc/PARENT/cmdline - ftpd needs kill capability - Allow telepath_msn_t to connect to sip port - keyring daemon does not work on nfs homedirs - Allow $1_sudo_t to read default SELinux context - Add label for tgtd sock file in /var/run/ - Add apache_exec_rotatelogs interface - allow all zaraha domains to signal themselves, server writes to /tmp - Allow syslog to read the process state - Add label for /usr/lib/chromium-browser/chrome - Remove the telepathy transition from unconfined_t - Dontaudit sandbox domains trying to mounton sandbox_file_t, this is caused by fuse mounts - Allow initrc_t domain to manage abrt pid files - Add support for AEOLUS project - Virt_admin should be allowed to manage images and processes - Allow plymountd to send signals to init - Change labeling of fping6- Add filename transitions- Fixes for zarafa policy - Add support for AEOLUS project - Change labeling of fping6 - Allow plymountd to send signals to init - Allow initrc_t domain to manage abrt pid files - Virt_admin should be allowed to manage images and processes- xdm_t needs getsession for switch user - Every app that used to exec init is now execing systemdctl - Allow squid to manage krb5_host_rcache_t files - Allow foghorn to connect to agentx port - Fixes for colord policy- Add Dan's patch to remove 64 bit variants - Allow colord to use unix_dgram_socket - Allow apps that search pids to read /var/run if it is a lnk_file - iscsid_t creates its own directory - Allow init to list var_lock_t dir - apm needs to verify user accounts auth_use_nsswitch - Add labeling for systemd unit files - Allow gnomeclok to enable ntpd service using systemctl - systemd_systemctl_t domain was added - Add label for matahari-broker.pid file - We want to remove untrustedmcsprocess from ability to read /proc/pid - Fixes for matahari policy - Allow system_tmpfiles_t to delete user_home_t files in the /tmp dir - Allow sshd to transition to sysadm_t if ssh_sysadm_login is turned on- Fix typo- Add /var/run/lock /var/lock definition to file_contexts.subs - nslcd_t is looking for kerberos cc files - SSH_USE_STRONG_RNG is 1 which requires /dev/random - Fix auth_rw_faillog definition - Allow sysadm_t to set attributes on fixed disks - allow user domains to execute lsof and look at application sockets - prelink_cron job calls telinit -u if init is rewritten - Fixes to run qemu_t from staff_t- Fix label for /var/run/udev to udev_var_run_t - Mock needs to be able to read network state- Add file_contexts.subs to handle /run and /run/lock - Add other fixes relating to /run changes from F15 policy- Allow $1_sudo_t and $1_su_t open access to user terminals - Allow initrc_t to use generic terminals - Make Makefile/Rules.modular run sepolgen-ifgen during build to check if files for bugs -systemd is going to be useing /run and /run/lock for early bootup files. - Fix some comments in rlogin.if - Add policy for KDE backlighthelper - sssd needs to read ~/.k5login in nfs, cifs or fusefs file systems - sssd wants to read .k5login file in users homedir - setroubleshoot reads executables to see if they have TEXTREL - Add /var/spool/audit support for new version of audit - Remove kerberos_connect_524() interface calling - Combine kerberos_master_port_t and kerberos_port_t - systemd has setup /dev/kmsg as stderr for apps it executes - Need these access so that init can impersonate sockets on unix_dgram_socket- Remove some unconfined domains - Remove permissive domains - Add policy-term.patch from Dan- Fix multiple specification for boot.log - devicekit leaks file descriptors to setfiles_t - Change all all_nodes to generic_node and all_if to generic_if - Should not use deprecated interface - Switch from using all_nodes to generic_node and from all_if to generic_if - Add support for xfce4-notifyd - Fix file context to show several labels as SystemHigh - seunshare needs to be able to mounton nfs/cifs/fusefs homedirs - Add etc_runtime_t label for /etc/securetty - Fixes to allow xdm_t to start gkeyringd_USERTYPE_t directly - login.krb needs to be able to write user_tmp_t - dirsrv needs to bind to port 7390 for dogtag - Fix a bug in gpg policy - gpg sends audit messages - Allow qpid to manage matahari files- Initial policy for matahari - Add dev_read_watchdog - Allow clamd to connect clamd port - Add support for kcmdatetimehelper - Allow shutdown to setrlimit and sys_nice - Allow systemd_passwd to talk to /dev/log before udev or syslog is running - Purge chr_file and blk files on /tmp - Fixes for pads - Fixes for piranha-pulse - gpg_t needs to be able to encyprt anything owned by the user- mozilla_plugin_tmp_t needs to be treated as user tmp files - More dontaudits of writes from readahead - Dontaudit readahead_t file_type:dir write, to cover up kernel bug - systemd_tmpfiles needs to relabel faillog directory as well as the file - Allow hostname and consoletype to r/w inherited initrc_tmp_t files handline hostname >> /tmp/myhost- Add policykit fixes from Tim Waugh - dontaudit sandbox domains sandbox_file_t:dir mounton - Add new dontaudit rules for sysadm_dbusd_t - Change label for /var/run/faillock * other fixes which relate with this change- Update to upstream - Fixes for telepathy - Add port defition for ssdp port - add policy for /bin/systemd-notify from Dan - Mount command requires users read mount_var_run_t - colord needs to read konject_uevent_socket - User domains connect to the gkeyring socket - Add colord policy and allow user_t and staff_t to dbus chat with it - Add lvm_exec_t label for kpartx - Dontaudit reading the mail_spool_t link from sandbox -X - systemd is creating sockets in avahi_var_run and system_dbusd_var_run- gpg_t needs to talk to gnome-keyring - nscd wants to read /usr/tmp->/var/tmp to generate randomziation in unixchkpwd - enforce MCS labeling on nodes - Allow arpwatch to read meminfo - Allow gnomeclock to send itself signals - init relabels /dev/.udev files on boot - gkeyringd has to transition back to staff_t when it runs commands in bin_t or shell_exec_t - nautilus checks access on /media directory before mounting usb sticks, dontaudit access_check on mnt_t - dnsmasq can run as a dbus service, needs acquire service - mysql_admin should be allowed to connect to mysql service - virt creates monitor sockets in the users home dir- Allow usbhid-ups to read hardware state information - systemd-tmpfiles has moved - Allo cgroup to sys_tty_config - For some reason prelink is attempting to read gconf settings - Add allow_daemons_use_tcp_wrapper boolean - Add label for ~/.cache/wocky to make telepathy work in enforcing mode - Add label for char devices /dev/dasd* - Fix for apache_role - Allow amavis to talk to nslcd - allow all sandbox to read selinux poilcy config files - Allow cluster domains to use the system bus and send each other dbus messages- Update to upstream- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild- Update to ref policy - cgred needs chown capability - Add /dev/crash crash_dev_t - systemd-readahead wants to use fanotify which means readahead_t needs sys_admin capability- New labeling for postfmulti #675654 - dontaudit xdm_t listing noxattr file systems - dovecot-auth needs to be able to connect to mysqld via the network as well as locally - shutdown is passed stdout to a xdm_log_t file - smartd creates a fixed disk device - dovecot_etc_t contains a lnk_file that domains need to read - mount needs to be able to read etc_runtim_t:lnk_file since in rawhide this is a link created at boot- syslog_t needs syslog capability - dirsrv needs to be able to create /var/lib/snmp - Fix labeling for dirsrv - Fix for dirsrv policy missing manage_dirs_pattern - corosync needs to delete clvm_tmpfs_t files - qdiskd needs to list hugetlbfs - Move setsched to sandbox_x_domain, so firefox can run without network access - Allow hddtemp to read removable devices - Adding syslog and read_policy permissions to policy * syslog Allow unconfined, sysadm_t, secadm_t, logadm_t * read_policy allow unconfined, sysadm_t, secadm_t, staff_t on Targeted allow sysadm_t (optionally), secadm_t on MLS - mdadm application will write into /sys/.../uevent whenever arrays are assembled or disassembled.- Add tcsd policy- ricci_modclusterd_t needs to bind to rpc ports 500-1023 - Allow dbus to use setrlimit to increase resoueces - Mozilla_plugin is leaking to sandbox - Allow confined users to connect to lircd over unix domain stream socket which allow to use remote control - Allow awstats to read squid logs - seunshare needs to manage tmp_t - apcupsd cgi scripts have a new directory- Fix xserver_dontaudit_read_xdm_pid - Change oracle_port_t to oracledb_port_t to prevent conflict with satellite - Allow dovecot_deliver_t to read/write postfix_master_t:fifo_file. * These fifo_file is passed from postfix_master_t to postfix_local_t to dovecot_deliver_t - Allow readahead to manage readahead pid dirs - Allow readahead to read all mcs levels - Allow mozilla_plugin_t to use nfs or samba homedirs- Allow nagios plugin to read /proc/meminfo - Fix for mozilla_plugin - Allow samba_net_t to create /etc/keytab - pppd_t setting up vpns needs to run unix_chkpwd, setsched its process and write wtmp_t - nslcd can read user credentials - Allow nsplugin to delete mozilla_plugin_tmpfs_t - abrt tries to create dir in rpm_var_lib_t - virt relabels fifo_files - sshd needs to manage content in fusefs homedir - mock manages link files in cache dir- nslcd needs setsched and to read /usr/tmp - Invalid call in likewise policy ends up creating a bogus role - Cannon puts content into /var/lib/bjlib that cups needs to be able to write - Allow screen to create screen_home_t in /root - dirsrv sends syslog messages - pinentry reads stuff in .kde directory - Add labels for .kde directory in homedir - Treat irpinit, iprupdate, iprdump services with raid policy- NetworkManager wants to read consolekit_var_run_t - Allow readahead to create /dev/.systemd/readahead - Remove permissive domains - Allow newrole to run namespace_init- Add sepgsql_contexts file- Update to upstream- Add oracle ports and allow apache to connect to them if the connect_db boolean is turned on - Add puppetmaster_use_db boolean - Fixes for zarafa policy - Fixes for gnomeclock poliy - Fix systemd-tmpfiles to use auth_use_nsswitch- gnomeclock executes a shell - Update for screen policy to handle pipe in homedir - Fixes for polyinstatiated homedir - Fixes for namespace policy and other fixes related to polyinstantiation - Add namespace policy - Allow dovecot-deliver transition to sendmail which is needed by sieve scripts - Fixes for init, psad policy which relate with confined users - Do not audit bootloader attempts to read devicekit pid files - Allow nagios service plugins to read /proc- Add firewalld policy - Allow vmware_host to read samba config - Kernel wants to read /proc Fix duplicate grub def in cobbler - Chrony sends mail, executes shell, uses fifo_file and reads /proc - devicekitdisk getattr all file systems - sambd daemon writes wtmp file - libvirt transitions to dmidecode- Add initial policy for system-setup-keyboard which is now daemon - Label /var/lock/subsys/shorewall as shorewall_lock_t - Allow users to communicate with the gpg_agent_t - Dontaudit mozilla_plugin_t using the inherited terminal - Allow sambagui to read files in /usr - webalizer manages squid log files - Allow unconfined domains to bind ports to raw_ip_sockets - Allow abrt to manage rpm logs when running yum - Need labels for /var/run/bittlebee - Label .ssh under amanda - Remove unused genrequires for virt_domain_template - Allow virt_domain to use fd inherited from virtd_t - Allow iptables to read shorewall config- Gnome apps list config_home_t - mpd creates lnk files in homedir - apache leaks write to mail apps on tmp files - /var/stockmaniac/templates_cache contains log files - Abrt list the connects of mount_tmp_t dirs - passwd agent reads files under /dev and reads utmp file - squid apache script connects to the squid port - fix name of plymouth log file - teamviewer is a wine app - allow dmesg to read system state - Stop labeling files under /var/lib/mock so restorecon will not go into this - nsplugin needs to read network state for google talk- Allow xdm and syslog to use /var/log/boot.log - Allow users to communicate with mozilla_plugin and kill it - Add labeling for ipv6 and dhcp- New labels for ghc http content - nsplugin_config needs to read urand, lvm now calls setfscreate to create dev - pm-suspend now creates log file for append access so we remove devicekit_wri - Change authlogin_use_sssd to authlogin_nsswitch_use_ldap - Fixes for greylist_milter policy- Update to upstream - Fixes for systemd policy - Fixes for passenger policy - Allow staff users to run mysqld in the staff_t domain, akonadi needs this - Add bin_t label for /usr/share/kde4/apps/kajongg/kajongg.py - auth_use_nsswitch does not need avahi to read passwords,needed for resolving data - Dontaudit (xdm_t) gok attempting to list contents of /var/account - Telepathy domains need to read urand - Need interface to getattr all file classes in a mock library for setroubleshoot- Update selinux policy to handle new /usr/share/sandbox/start script- Update to upstream - Fix version of policy in spec file- Allow sandbox to run on nfs partitions, fixes for systemd_tmpfs - remove per sandbox domains devpts types - Allow dkim-milter sending signal to itself- Allow domains that transition to ping or traceroute, kill them - Allow user_t to conditionally transition to ping_t and traceroute_t - Add fixes to systemd- tools, including new labeling for systemd-fsck, systemd-cryptsetup- Turn on systemd policy - mozilla_plugin needs to read certs in the homedir. - Dontaudit leaked file descriptors from devicekit - Fix ircssi to use auth_use_nsswitch - Change to use interface without param in corenet to disable unlabelednet packets - Allow init to relabel sockets and fifo files in /dev - certmonger needs dac* capabilities to manage cert files not owned by root - dovecot needs fsetid to change group membership on mail - plymouthd removes /var/log/boot.log - systemd is creating symlinks in /dev - Change label on /etc/httpd/alias to be all cert_t- Fixes for clamscan and boinc policy - Add boinc_project_t setpgid - Allow alsa to create tmp files in /tmp- Push fixes to allow disabling of unlabeled_t packet access - Enable unlabelednet policy- Fixes for lvm to work with systemd- Fix the label for wicd log - plymouthd creates force-display-on-active-vt file - Allow avahi to request the kernel to load a module - Dontaudit hal leaks - Fix gnome_manage_data interface - Add new interface corenet_packet to define a type as being an packet_type. - Removed general access to packet_type from icecast and squid. - Allow mpd to read alsa config - Fix the label for wicd log - Add systemd policy- Fix gnome_manage_data interface - Dontaudit sys_ptrace capability for iscsid - Fixes for nagios plugin policy- Fix cron to run ranged when started by init - Fix devicekit to use log files - Dontaudit use of devicekit_var_run_t for fstools - Allow init to setattr on logfile directories - Allow hald to manage files in /var/run/pm-utils/ dir which is now labeled as devicekit_var_run_t- Fix up handling of dnsmasq_t creating /var/run/libvirt/network - Turn on sshd_forward_ports boolean by default - Allow sysadmin to dbus chat with rpm - Add interface for rw_tpm_dev - Allow cron to execute bin - fsadm needs to write sysfs - Dontaudit consoletype reading /var/run/pm-utils - Lots of new privs fro mozilla_plugin_t running java app, make mozilla_plugin - certmonger needs to manage dirsrv data - /var/run/pm-utils should be labeled as devicekit_var_run_t- fixes to allow /var/run and /var/lock as tmpfs - Allow chrome sandbox to connect to web ports - Allow dovecot to listem on lmtp and sieve ports - Allov ddclient to search sysctl_net_t - Transition back to original domain if you execute the shell- Remove duplicate declaration- Update to upstream - Cleanup for sandbox - Add attribute to be able to select sandbox types- Allow ddclient to fix file mode bits of ddclient conf file - init leaks file descriptors to daemons - Add labels for /etc/lirc/ and - Allow amavis_t to exec shell - Add label for gssd_tmp_t for /var/tmp/nfs_0- Put back in lircd_etc_t so policy will install- Turn on allow_postfix_local_write_mail_spool - Allow initrc_t to transition to shutdown_t - Allow logwatch and cron to mls_read_to_clearance for MLS boxes - Allow wm to send signull to all applications and receive them from users - lircd patch from field - Login programs have to read /etc/samba - New programs under /lib/systemd - Abrt needs to read config files- Update to upstream - Dontaudit leaked sockets from userdomains to user domains - Fixes for mcelog to handle scripts - Apply patch from Ruben Kerkhof - Allow syslog to search spool dirs- Allow nagios plugins to read usr files - Allow mysqld-safe to send system log messages - Fixes fpr ddclient policy - Fix sasl_admin interface - Allow apache to search zarafa config - Allow munin plugins to search /var/lib directory - Allow gpsd to read sysfs_t - Fix labels on /etc/mcelog/triggers to bin_t- Remove saslauthd_tmp_t and transition tmp files to krb5_host_rcache_t - Allow saslauthd_t to create krb5_host_rcache_t files in /tmp - Fix xserver interface - Fix definition of /var/run/lxdm- Turn on mediawiki policy - kdump leaks kdump_etc_t to ifconfig, add dontaudit - uux needs to transition to uucpd_t - More init fixes relabels man,faillog - Remove maxima defs in libraries.fc - insmod needs to be able to create tmpfs_t files - ping needs setcap- Allow groupd transition to fenced domain when executes fence_node - Fixes for rchs policy - Allow mpd to be able to read samba/nfs files- Fix up corecommands.fc to match upstream - Make sure /lib/systemd/* is labeled init_exec_t - mount wants to setattr on all mountpoints - dovecot auth wants to read dovecot etc files - nscd daemon looks at the exe file of the comunicating daemon - openvpn wants to read utmp file - postfix apps now set sys_nice and lower limits - remote_login (telnetd/login) wants to use telnetd_devpts_t and user_devpts_t to work correctly - Also resolves nsswitch - Fix labels on /etc/hosts.* - Cleanup to make upsteam patch work - allow abrt to read etc_runtime_t- Add conflicts for dirsrv package- Update to upstream - Add vlock policy- Fix sandbox to work on nfs homedirs - Allow cdrecord to setrlimit - Allow mozilla_plugin to read xauth - Change label on systemd-logger to syslogd_exec_t - Install dirsrv policy from dirsrv package- Add virt_home_t, allow init to setattr on xserver_tmp_t and relabel it - Udev needs to stream connect to init and kernel - Add xdm_exec_bootloader boolean, which allows xdm to execute /sbin/grub and read files in /boot directory- Allow NetworkManager to read openvpn_etc_t - Dontaudit hplip to write of /usr dirs - Allow system_mail_t to create /root/dead.letter as mail_home_t - Add vdagent policy for spice agent daemon- Dontaudit sandbox sending sigkill to all user domains - Add policy for rssh_chroot_helper - Add missing flask definitions - Allow udev to relabelto removable_t - Fix label on /var/log/wicd.log - Transition to initrc_t from init when executing bin_t - Add audit_access permissions to file - Make removable_t a device_node - Fix label on /lib/systemd/*- Fixes for systemd to manage /var/run - Dontaudit leaks by firstboot- Allow chome to create netlink_route_socket - Add additional MATHLAB file context - Define nsplugin as an application_domain - Dontaudit sending signals from sandboxed domains to other domains - systemd requires init to build /tmp /var/auth and /var/lock dirs - mount wants to read devicekit_power /proc/ entries - mpd wants to connect to soundd port - Openoffice causes a setattr on a lib_t file for normal users, add dontaudit - Treat lib_t and textrel_shlib_t directories the same - Allow mount read access on virtual images- Allow sandbox_x_domains to work with nfs/cifs/fusefs home dirs. - Allow devicekit_power to domtrans to mount - Allow dhcp to bind to udp ports > 1024 to do named stuff - Allow ssh_t to exec ssh_exec_t - Remove telepathy_butterfly_rw_tmp_files(), dev_read_printk() interfaces which are nolonger used - Fix clamav_append_log() intefaces - Fix 'psad_rw_fifo_file' interface- Allow cobblerd to list cobler appache content- Fixup for the latest version of upowed - Dontaudit sandbox sending SIGNULL to desktop apps- Update to upstream-Mount command from a confined user generates setattr on /etc/mtab file, need to dontaudit this access - dovecot-auth_t needs ipc_lock - gpm needs to use the user terminal - Allow system_mail_t to append ~/dead.letter - Allow NetworkManager to edit /etc/NetworkManager/NetworkManager.conf - Add pid file to vnstatd - Allow mount to communicate with gfs_controld - Dontaudit hal leaks in setfiles- Lots of fixes for systemd - systemd now executes readahead and tmpwatch type scripts - Needs to manage random seed- Allow smbd to use sys_admin - Remove duplicate file context for tcfmgr - Update to upstream- Fix fusefs handling - Do not allow sandbox to manage nsplugin_rw_t - Allow mozilla_plugin_t to connecto its parent - Allow init_t to connect to plymouthd running as kernel_t - Add mediawiki policy - dontaudit sandbox sending signals to itself. This can happen when they are running at different mcs. - Disable transition from dbus_session_domain to telepathy for F14 - Allow boinc_project to use shm - Allow certmonger to search through directories that contain certs - Allow fail2ban the DAC Override so it can read log files owned by non root users- Start adding support for use_fusefs_home_dirs - Add /var/lib/syslog directory file context - Add /etc/localtime as locale file context- Turn off default transition to mozilla_plugin and telepathy domains from unconfined user - Turn off iptables from unconfined user - Allow sudo to send signals to any domains the user could have transitioned to. - Passwd in single user mode needs to talk to console_device_t - Mozilla_plugin_t needs to connect to web ports, needs to write to video device, and read alsa_home_t alsa setsup pulseaudio - locate tried to read a symbolic link, will dontaudit - New labels for telepathy-sunshine content in homedir - Google is storing other binaries under /opt/google/talkplugin - bluetooth/kernel is creating unlabeled_t socket that I will allow it to use until kernel fixes bug - Add boolean for unconfined_t transition to mozilla_plugin_t and telepathy domains, turned off in F14 on in F15 - modemmanger and bluetooth send dbus messages to devicekit_power - Samba needs to getquota on filesystems labeld samba_share_t- Dontaudit attempts by xdm_t to write to bin_t for kdm - Allow initrc_t to manage system_conf_t- Fixes to allow mozilla_plugin_t to create nsplugin_home_t directory. - Allow mozilla_plugin_t to create tcp/udp/netlink_route sockets - Allow confined users to read xdm_etc_t files - Allow xdm_t to transition to xauth_t for lxdm program- Rearrange firewallgui policy to be more easily updated to upstream, dontaudit search of /home - Allow clamd to send signals to itself - Allow mozilla_plugin_t to read user home content. And unlink pulseaudio shm. - Allow haze to connect to yahoo chat and messenger port tcp:5050. Bz #637339 - Allow guest to run ps command on its processes by allowing it to read /proc - Allow firewallgui to sys_rawio which seems to be required to setup masqerading - Allow all domains to search through default_t directories, in order to find differnet labels. For example people serring up /foo/bar to be share via samba. - Add label for /var/log/slim.log- Pull in cleanups from dgrift - Allow mozilla_plugin_t to execute mozilla_home_t - Allow rpc.quota to do quotamod- Cleanup policy via dgrift - Allow dovecot_deliver to append to inherited log files - Lots of fixes for consolehelper- Fix up Xguest policy- Add vnstat policy - allow libvirt to send audit messages - Allow chrome-sandbox to search nfs_t- Update to upstream- Add the ability to send audit messages to confined admin policies - Remove permissive domain from cmirrord and dontaudit sys_tty_config - Split out unconfined_domain() calls from other unconfined_ calls so we can d - virt needs to be able to read processes to clearance for MLS- Allow all domains that can use cgroups to search tmpfs_t directory - Allow init to send audit messages- Update to upstream- Allow mdadm_t to create files and sock files in /dev/md/- Add policy for ajaxterm- Handle /var/db/sudo - Allow pulseaudio to read alsa config - Allow init to send initrc_t dbus messagesAllow iptables to read shorewall tmp files Change chfn and passwd to use auth_use_pam so they can send dbus messages to fpr intd label vlc as an execmem_exec_t Lots of fixes for mozilla_plugin to run google vidio chat Allow telepath_msn to execute ldconfig and its own tmp files Fix labels on hugepages Allow mdadm to read files on /dev Remove permissive domains and change back to unconfined Allow freshclam to execute shell and bin_t Allow devicekit_power to transition to dhcpc Add boolean to allow icecast to connect to any port- Merge upstream fix of mmap_zero - Allow mount to write files in debugfs_t - Allow corosync to communicate with clvmd via tmpfs - Allow certmaster to read usr_t files - Allow dbus system services to search cgroup_t - Define rlogind_t as a login pgm- Allow mdadm_t to read/write hugetlbfs- Dominic Grift Cleanup - Miroslav Grepl policy for jabberd - Various fixes for mount/livecd and prelink- Merge with upstream- More access needed for devicekit - Add dbadm policy- Merge with upstream- Allow seunshare to fowner- Allow cron to look at user_cron_spool links - Lots of fixes for mozilla_plugin_t - Add sysv file system - Turn unconfined domains to permissive to find additional avcs- Update policy for mozilla_plugin_t- Allow clamscan to read proc_t - Allow mount_t to write to debufs_t dir - Dontaudit mount_t trying to write to security_t dir- Allow clamscan_t execmem if clamd_use_jit set - Add policy for firefox plugin-container- Fix /root/.forward definition- label dead.letter as mail_home_t- Allow login programs to search /cgroups- Fix cert handling- Fix devicekit_power bug - Allow policykit_auth_t more access.- Fix nis calls to allow bind to ports 512-1024 - Fix smartmon- Allow pcscd to read sysfs - systemd fixes - Fix wine_mmap_zero_ignore boolean- Apply Miroslav munin patch - Turn back on allow_execmem and allow_execmod booleans- Merge in fixes from dgrift repository- Update boinc policy - Fix sysstat policy to allow sys_admin - Change failsafe_context to unconfined_r:unconfined_t:s0- New paths for upstart- New permissions for syslog - New labels for /lib/upstart- Add mojomojo policy- Allow systemd to setsockcon on sockets to immitate other services- Remove debugfs label- Update to latest policy- Fix eclipse labeling from IBMSupportAssasstant packageing- Make boot with systemd in enforcing mode- Update to upstream- Add boolean to turn off port forwarding in sshd.- Add support for ebtables - Fixes for rhcs and corosync policy-Update to upstream-Update to upstream-Update to upstream- Add Zarafa policy- Cleanup of aiccu policy - initial mock policy- Lots of random fixes- Update to upstream- Update to upstream - Allow prelink script to signal itself - Cobbler fixes- Add xdm_var_run_t to xserver_stream_connect_xdm - Add cmorrord and mpd policy from Miroslav Grepl- Fix sshd creation of krb cc files for users to be user_tmp_t- Fixes for accountsdialog - Fixes for boinc- Fix label on /var/lib/dokwiki - Change permissive domains to enforcing - Fix libvirt policy to allow it to run on mls- Update to upstream- Allow procmail to execute scripts in the users home dir that are labeled home_bin_t - Fix /var/run/abrtd.lock label- Allow login programs to read krb5_home_t Resolves: 594833 - Add obsoletes for cachefilesfd-selinux package Resolves: #575084- Allow mount to r/w abrt fifo file - Allow svirt_t to getattr on hugetlbfs - Allow abrt to create a directory under /var/spool- Add labels for /sys - Allow sshd to getattr on shutdown - Fixes for munin - Allow sssd to use the kernel key ring - Allow tor to send syslog messages - Allow iptabels to read usr files - allow policykit to read all domains state- Fix path for /var/spool/abrt - Allow nfs_t as an entrypoint for http_sys_script_t - Add policy for piranha - Lots of fixes for sosreport- Allow xm_t to read network state and get and set capabilities - Allow policykit to getattr all processes - Allow denyhosts to connect to tcp port 9911 - Allow pyranha to use raw ip sockets and ptrace itself - Allow unconfined_execmem_t and gconfsd mechanism to dbus - Allow staff to kill ping process - Add additional MLS rules- Allow gdm to edit ~/.gconf dir Resolves: #590677 - Allow dovecot to create directories in /var/lib/dovecot Partially resolves 590224 - Allow avahi to dbus chat with NetworkManager - Fix cobbler labels - Dontaudit iceauth_t leaks - fix /var/lib/lxdm file context - Allow aiccu to use tun tap devices - Dontaudit shutdown using xserver.log- Fixes for sandbox_x_net_t to match access for sandbox_web_t ++ - Add xdm_etc_t for /etc/gdm directory, allow accountsd to manage this directory - Add dontaudit interface for bluetooth dbus - Add chronyd_read_keys, append_keys for initrc_t - Add log support for ksmtuned Resolves: #586663- Allow boinc to send mail- Allow initrc_t to remove dhcpc_state_t - Fix label on sa-update.cron - Allow dhcpc to restart chrony initrc - Don't allow sandbox to send signals to its parent processes - Fix transition from unconfined_t -> unconfined_mount_t -> rpcd_t Resolves: #589136- Fix location of oddjob_mkhomedir Resolves: #587385 - fix labeling on /root/.shosts and ~/.shosts - Allow ipsec_mgmt_t to manage net_conf_t Resolves: #586760- Dontaudit sandbox trying to connect to netlink sockets Resolves: #587609 - Add policy for piranha- Fixups for xguest policy - Fixes for running sandbox firefox- Allow ksmtuned to use terminals Resolves: #586663 - Allow lircd to write to generic usb devices- Allow sandbox_xserver to connectto unconfined stream Resolves: #585171- Allow initrc_t to read slapd_db_t Resolves: #585476 - Allow ipsec_mgmt to use unallocated devpts and to create /etc/resolv.conf Resolves: #585963- Allow rlogind_t to search /root for .rhosts Resolves: #582760 - Fix path for cached_var_t - Fix prelink paths /var/lib/prelink - Allow confined users to direct_dri - Allow mls lvm/cryptosetup to work- Allow virtd_t to manage firewall/iptables config Resolves: #573585- Fix label on /root/.rhosts Resolves: #582760 - Add labels for Picasa - Allow openvpn to read home certs - Allow plymouthd_t to use tty_device_t - Run ncftool as iptables_t - Allow mount to unmount unlabeled_t - Dontaudit hal leaks- Allow livecd to transition to mount- Update to upstream - Allow abrt to delete sosreport Resolves: #579998 - Allow snmp to setuid and gid Resolves: #582155 - Allow smartd to use generic scsi devices Resolves: #582145- Allow ipsec_t to create /etc/resolv.conf with the correct label - Fix reserved port destination - Allow autofs to transition to showmount - Stop crashing tuned- Add telepathysofiasip policy- Update to upstream - Fix label for /opt/google/chrome/chrome-sandbox - Allow modemmanager to dbus with policykit- Fix allow_httpd_mod_auth_pam to use auth_use_pam(httpd_t) - Allow accountsd to read shadow file - Allow apache to send audit messages when using pam - Allow asterisk to bind and connect to sip tcp ports - Fixes for dovecot 2.0 - Allow initrc_t to setattr on milter directories - Add procmail_home_t for .procmailrc file- Fixes for labels during install from livecd- Fix /cgroup file context - Fix broken afs use of unlabled_t - Allow getty to use the console for s390- Fix cgroup handling adding policy for /cgroup - Allow confined users to write to generic usb devices, if user_rw_noexattrfile boolean set- Merge patches from dgrift- Update upstream - Allow abrt to write to the /proc under any process- Fix ~/.fontconfig label - Add /root/.cert label - Allow reading of the fixed_file_disk_t:lnk_file if you can read file - Allow qemu_exec_t as an entrypoint to svirt_t- Update to upstream - Allow tmpreaper to delete sandbox sock files - Allow chrome-sandbox_t to use /dev/zero, and dontaudit getattr file systems - Fixes for gitosis - No transition on livecd to passwd or chfn - Fixes for denyhosts- Add label for /var/lib/upower - Allow logrotate to run sssd - dontaudit readahead on tmpfs blk files - Allow tmpreaper to setattr on sandbox files - Allow confined users to execute dos files - Allow sysadm_t to kill processes running within its clearance - Add accountsd policy - Fixes for corosync policy - Fixes from crontab policy - Allow svirt to manage svirt_image_t chr files - Fixes for qdisk policy - Fixes for sssd policy - Fixes for newrole policy- make libvirt work on an MLS platform- Add qpidd policy- Update to upstream- Allow boinc to read kernel sysctl - Fix snmp port definitions - Allow apache to read anon_inodefs- Allow shutdown dac_override- Add device_t as a file system - Fix sysfs association- Dontaudit ipsec_mgmt sys_ptrace - Allow at to mail its spool files - Allow nsplugin to search in .pulse directory- Update to upstream- Allow users to dbus chat with xdm - Allow users to r/w wireless_device_t - Dontaudit reading of process states by ipsec_mgmt- Fix openoffice from unconfined_t- Add shutdown policy so consolekit can shutdown system- Update to upstream- Update to upstream- Update to upstream - These are merges of my patches - Remove 389 labeling conflicts - Add MLS fixes found in RHEL6 testing - Allow pulseaudio to run as a service - Add label for mssql and allow apache to connect to this database port if boolean set - Dontaudit searches of debugfs mount point - Allow policykit_auth to send signals to itself - Allow modcluster to call getpwnam - Allow swat to signal winbind - Allow usbmux to run as a system role - Allow svirt to create and use devpts- Add MLS fixes found in RHEL6 testing - Allow domains to append to rpm_tmp_t - Add cachefilesfd policy - Dontaudit leaks when transitioning- Change allow_execstack and allow_execmem booleans to on - dontaudit acct using console - Add label for fping - Allow tmpreaper to delete sandbox_file_t - Fix wine dontaudit mmap_zero - Allow abrt to read var_t symlinks- Additional policy for rgmanager- Allow sshd to setattr on pseudo terms- Update to upstream- Allow policykit to send itself signals- Fix duplicate cobbler definition- Fix file context of /var/lib/avahi-autoipd- Merge with upstream- Allow sandbox to work with MLS- Make Chrome work with staff user- Add icecast policy - Cleanup spec file- Add mcelog policy- Lots of fixes found in F12- Fix rpm_dontaudit_leaks- Add getsched to hald_t - Add file context for Fedora/Redhat Directory Server- Allow abrt_helper to getattr on all filesystems - Add label for /opt/real/RealPlayer/plugins/oggfformat\.so- Add gstreamer_home_t for ~/.gstreamer- Update to upstream- Fix git- Turn on puppet policy - Update to dgrift git policy- Move users file to selection by spec file. - Allow vncserver to run as unconfined_u:unconfined_r:unconfined_t- Update to upstream- Remove most of the permissive domains from F12.- Add cobbler policy from dgrift- add usbmon device - Add allow rulse for devicekit_disk- Lots of fixes found in F12, fixes from Tom London- Cleanups from dgrift- Add back xserver_manage_home_fonts- Dontaudit sandbox trying to read nscd and sssd- Update to upstream- Rename udisks-daemon back to devicekit_disk_t policy- Fixes for abrt calls- Add tgtd policy- Update to upstream release- Add asterisk policy back in - Update to upstream release 2.20091117- Update to upstream release 2.20091117- Fixup nut policy- Update to upstream- Allow vpnc request the kernel to load modules- Fix minimum policy installs - Allow udev and rpcbind to request the kernel to load modules- Add plymouth policy - Allow local_login to sys_admin- Allow cupsd_config to read user tmp - Allow snmpd_t to signal itself - Allow sysstat_t to makedir in sysstat_log_t- Update rhcs policy- Allow users to exec restorecond- Allow sendmail to request kernel modules load- Fix all kernel_request_load_module domains- Fix all kernel_request_load_module domains- Remove allow_exec* booleans for confined users. Only available for unconfined_t- More fixes for sandbox_web_t- Allow sshd to create .ssh directory and content- Fix request_module line to module_request- Fix sandbox policy to allow it to run under firefox. - Dont audit leaks.- Fixes for sandbox- Update to upstream - Dontaudit nsplugin search /root - Dontaudit nsplugin sys_nice- Fix label on /usr/bin/notepad, /usr/sbin/vboxadd-service - Remove policycoreutils-python requirement except for minimum- Fix devicekit_disk_t to getattr on all domains sockets and fifo_files - Conflicts seedit (You can not use selinux-policy-targeted and seedit at the same time.)- Add wordpress/wp-content/uploads label - Fixes for sandbox when run from staff_t- Update to upstream - Fixes for devicekit_disk- More fixes- Lots of fixes for initrc and other unconfined domains- Allow xserver to use netlink_kobject_uevent_socket- Fixes for sandbox- Dontaudit setroubleshootfix looking at /root directory- Update to upsteam- Allow gssd to send signals to users - Fix duplicate label for apache content- Update to upstream- Remove polkit_auth on upgrades- Add back in unconfined.pp and unconfineduser.pp - Add Sandbox unshare- Fixes for cdrecord, mdadm, and others- Add capability setting to dhcpc and gpm- Allow cronjobs to read exim_spool_t- Add ABRT policy- Fix system-config-services policy- Allow libvirt to change user componant of virt_domain- Allow cupsd_config_t to be started by dbus - Add smoltclient policy- Add policycoreutils-python to pre install- Make all unconfined_domains permissive so we can see what AVC's happen- Add pt_chown policy- Add kdump policy for Miroslav Grepl - Turn off execstack boolean- Turn on execstack on a temporary basis (#512845)- Allow nsplugin to connecto the session bus - Allow samba_net to write to coolkey data- Allow devicekit_disk to list inotify- Allow svirt images to create sock_file in svirt_var_run_t- Allow exim to getattr on mountpoints - Fixes for pulseaudio- Allow svirt_t to stream_connect to virtd_t- Allod hald_dccm_t to create sock_files in /tmp- More fixes from upstream- Fix polkit label - Remove hidebrokensymptoms for nss_ldap fix - Add modemmanager policy - Lots of merges from upstream - Begin removing textrel_shlib_t labels, from fixed libraries- Update to upstream- Allow certmaster to override dac permissions- Update to upstream- Fix context for VirtualBox- Update to upstream- Allow clamscan read amavis spool files- Fixes for xguest- fix multiple directory ownership of mandirs- Update to upstream- Add rules for rtkit-daemon- Update to upstream - Fix nlscd_stream_connect- Add rtkit policy- Allow rpcd_t to stream connect to rpcbind- Allow kpropd to create tmp files- Fix last duplicate /var/log/rpmpkgs- Update to upstream * add sssd- Update to upstream * cleanup- Update to upstream - Additional mail ports - Add virt_use_usb boolean for svirt- Fix mcs rules to include chr_file and blk_file- Add label for udev-acl- Additional rules for consolekit/udev, privoxy and various other fixes- New version for upstream- Allow NetworkManager to read inotifyfs- Allow setroubleshoot to run mlocate- Update to upstream- Add fish as a shell - Allow fprintd to list usbfs_t - Allow consolekit to search mountpoints - Add proper labeling for shorewall- New log file for vmware - Allow xdm to setattr on user_tmp_t- Upgrade to upstream- Allow fprintd to access sys_ptrace - Add sandbox policy- Add varnishd policy- Fixes for kpropd- Allow brctl to r/w tun_tap_device_t- Add /usr/share/selinux/packages- Allow rpcd_t to send signals to kernel threads- Fix upgrade for F10 to F11- Add policy for /var/lib/fprint-Remove duplicate line- Allow svirt to manage pci and other sysfs device data- Fix package selection handling- Fix /sbin/ip6tables-save context - Allod udev to transition to mount - Fix loading of mls policy file- Add shorewall policy- Additional rules for fprintd and sssd- Allow nsplugin to unix_read unix_write sem for unconfined_java- Fix uml files to be owned by users- Fix Upgrade path to install unconfineduser.pp when unocnfined package is 3.0.0 or less- Allow confined users to manage virt_content_t, since this is home dir content - Allow all domains to read rpm_script_tmp_t which is what shell creates on redirection- Fix labeling on /var/lib/misc/prelink* - Allow xserver to rw_shm_perms with all x_clients - Allow prelink to execute files in the users home directory- Allow initrc_t to delete dev_null - Allow readahead to configure auditing - Fix milter policy - Add /var/lib/readahead- Update to latest milter code from Paul Howarth- Additional perms for readahead- Allow pulseaudio to acquire_svc on session bus - Fix readahead labeling- Allow sysadm_t to run rpm directly - libvirt needs fowner- Allow sshd to read var_lib symlinks for freenx- Allow nsplugin unix_read and write on users shm and sem - Allow sysadm_t to execute su- Dontaudit attempts to getattr user_tmpfs_t by lvm - Allow nfs to share removable media- Add ability to run postdrop from confined users- Fixes for podsleuth- Turn off nsplugin transition - Remove Konsole leaked file descriptors for release- Allow cupsd_t to create link files in print_spool_t - Fix iscsi_stream_connect typo - Fix labeling on /etc/acpi/actions - Don't reinstall unconfine and unconfineuser on upgrade if they are not installed- Allow audioentroy to read etc files- Add fail2ban_var_lib_t - Fixes for devicekit_power_t- Separate out the ucnonfined user from the unconfined.pp package- Make sure unconfined_java_t and unconfined_mono_t create user_tmpfs_t.- Upgrade to latest upstream - Allow devicekit_disk sys_rawio- Dontaudit binds to ports < 1024 for named - Upgrade to latest upstream- Allow podsleuth to use tmpfs files- Add customizable_types for svirt- Allow setroubelshoot exec* privs to prevent crash from bad libraries - add cpufreqselector- Dontaudit listing of /root directory for cron system jobs- Fix missing ld.so.cache label- Add label for ~/.forward and /root/.forward- Fixes for svirt- Fixes to allow svirt read iso files in homedir- Add xenner and wine fixes from mgrepl- Allow mdadm to read/write mls override- Change to svirt to only access svirt_image_t- Fix libvirt policy- Upgrade to latest upstream- Fixes for iscsid and sssd - More cleanups for upgrade from F10 to Rawhide.- Add pulseaudio, sssd policy - Allow networkmanager to exec udevadm- Add pulseaudio context- Upgrade to latest patches- Fixes for libvirt- Update to Latest upstream- Fix setrans.conf to show SystemLow for s0- Further confinement of qemu images via svirt- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild- Allow NetworkManager to manage /etc/NetworkManager/system-connections- add virtual_image_context and virtual_domain_context files- Allow rpcd_t to send signal to mount_t - Allow libvirtd to run ranged- Fix sysnet/net_conf_t- Fix squidGuard labeling- Re-add corenet_in_generic_if(unlabeled_t)* Tue Feb 10 2009 Dan Walsh 3.6.5-2 - Add git web policy- Add setrans contains from upstream- Do transitions outside of the booleans- Allow xdm to create user_tmp_t sockets for switch user to work- Fix staff_t domain- Grab remainder of network_peer_controls patch- More fixes for devicekit- Upgrade to latest upstream- Add boolean to disallow unconfined_t login- Add back transition from xguest to mozilla- Add virt_content_ro_t and labeling for isos directory- Fixes for wicd daemon- More mls/rpm fixes- Add policy to make dbus/nm-applet work- Remove polgen-ifgen from post and add trigger to policycoreutils-python- Add wm policy - Make mls work in graphics mode- Fixed for DeviceKit- Add devicekit policy- Update to upstream- Define openoffice as an x_domain- Fixes for reading xserver_tmp_t- Allow cups_pdf_t write to nfs_t- Remove audio_entropy policy- Update to upstream- Allow hal_acl_t to getattr/setattr fixed_disk- Change userdom_read_all_users_state to include reading symbolic links in /proc- Fix dbus reading /proc information- Add missing alias for home directory content- Fixes for IBM java location- Allow unconfined_r unconfined_java_t- Add cron_role back to user domains- Fix sudo setting of user keys- Allow iptables to talk to terminals - Fixes for policy kit - lots of fixes for booting.- Cleanup policy- Rebuild for Python 2.6- Fix labeling on /var/spool/rsyslog- Allow postgresl to bind to udp nodes- Allow lvm to dbus chat with hal - Allow rlogind to read nfs_t- Fix cyphesis file context- Allow hal/pm-utils to look at /var/run/video.rom - Add ulogd policy- Additional fixes for cyphesis - Fix certmaster file context - Add policy for system-config-samba - Allow hal to read /var/run/video.rom- Allow dhcpc to restart ypbind - Fixup labeling in /var/run- Add certmaster policy- Fix confined users - Allow xguest to read/write xguest_dbusd_t- Allow openoffice execstack/execmem privs- Allow mozilla to run with unconfined_execmem_t- Dontaudit domains trying to write to .xsession-errors- Allow nsplugin to look at autofs_t directory- Allow kerneloops to create tmp files- More alias for fastcgi- Remove mod_fcgid-selinux package- Fix dovecot access- Policy cleanup- Remove Multiple spec - Add include - Fix makefile to not call per_role_expansion- Fix labeling of libGL- Update to upstream- Update to upstream policy- Fixes for confined xwindows and xdm_t- Allow confined users and xdm to exec wm - Allow nsplugin to talk to fifo files on nfs- Allow NetworkManager to transition to avahi and iptables - Allow domains to search other domains keys, coverup kernel bug- Fix labeling for oracle- Allow nsplugin to comminicate with xdm_tmp_t sock_file- Change all user tmpfs_t files to be labeled user_tmpfs_t - Allow radiusd to create sock_files- Upgrade to upstream- Allow confined users to login with dbus- Fix transition to nsplugin- Add file context for /dev/mspblk.*- Fix transition to nsplugin '- Fix labeling on new pm*log - Allow ssh to bind to all nodes- Merge upstream changes - Add Xavier Toth patches- Add qemu_cache_t for /var/cache/libvirt- Remove gamin policy- Add tinyxs-max file system support- Update to upstream - New handling of init scripts- Allow pcsd to dbus - Add memcache policy- Allow audit dispatcher to kill his children- Update to upstream - Fix crontab use by unconfined user- Allow ifconfig_t to read dhcpc_state_t- Update to upstream- Update to upstream- Allow system-config-selinux to work with policykit- Fix novel labeling- Consolodate pyzor,spamassassin, razor into one security domain - Fix xdm requiring additional perms.- Fixes for logrotate, alsa- Eliminate vbetool duplicate entry- Fix xguest -> xguest_mozilla_t -> xguest_openiffice_t - Change dhclient to be able to red networkmanager_var_run- Update to latest refpolicy - Fix libsemanage initial install bug- Add inotify support to nscd- Allow unconfined_t to setfcap- Allow amanda to read tape - Allow prewikka cgi to use syslog, allow audisp_t to signal cgi - Add support for netware file systems- Allow ypbind apps to net_bind_service- Allow all system domains and application domains to append to any log file- Allow gdm to read rpm database - Allow nsplugin to read mplayer config files- Allow vpnc to run ifconfig- Allow confined users to use postgres - Allow system_mail_t to exec other mail clients - Label mogrel_rails as an apache server- Apply unconfined_execmem_exec_t to haskell programs- Fix prelude file context- allow hplip to talk dbus - Fix context on ~/.local dir- Prevent applications from reading x_device- Add /var/lib/selinux context- Update to upstream- Add livecd policy- Dontaudit search of admin_home for init_system_domain - Rewrite of xace interfaces - Lots of new fs_list_inotify - Allow livecd to transition to setfiles_mac- Begin XAce integration- Merge Upstream- Allow amanada to create data files- Fix initial install, semanage setup- Allow system_r for httpd_unconfined_script_t- Remove dmesg boolean - Allow user domains to read/write game data- Change unconfined_t to transition to unconfined_mono_t when running mono - Change XXX_mono_t to transition to XXX_t when executing bin_t files, so gnome-do will work- Remove old booleans from targeted-booleans.conf file- Add boolean to mmap_zero - allow tor setgid - Allow gnomeclock to set clock- Don't run crontab from unconfined_t- Change etc files to config files to allow users to read them- Lots of fixes for confined domains on NFS_t homedir- dontaudit mrtg reading /proc - Allow iscsi to signal itself - Allow gnomeclock sys_ptrace- Allow dhcpd to read kernel network state- Label /var/run/gdm correctly - Fix unconfined_u user creation- Allow transition from initrc_t to getty_t- Allow passwd to communicate with user sockets to change gnome-keyring- Fix initial install- Allow radvd to use fifo_file - dontaudit setfiles reading links - allow semanage sys_resource - add allow_httpd_mod_auth_ntlm_winbind boolean - Allow privhome apps including dovecot read on nfs and cifs home dirs if the boolean is set- Allow nsplugin to read /etc/mozpluggerrc, user_fonts - Allow syslog to manage innd logs. - Allow procmail to ioctl spamd_exec_t- Allow initrc_t to dbus chat with consolekit.- Additional access for nsplugin - Allow xdm setcap/getcap until pulseaudio is fixed- Allow mount to mkdir on tmpfs - Allow ifconfig to search debugfs- Fix file context for MATLAB - Fixes for xace- Allow stunnel to transition to inetd children domains - Make unconfined_dbusd_t an unconfined domain- Fixes for qemu/virtd- Fix bug in mozilla policy to allow xguest transition - This will fix the libsemanage.dbase_llist_query: could not find record value libsemanage.dbase_llist_query: could not query record value (No such file or directory) bug in xguest- Allow nsplugin to run acroread- Add cups_pdf policy - Add openoffice policy to run in xguest- prewika needs to contact mysql - Allow syslog to read system_map files- Change init_t to an unconfined_domain- Allow init to transition to initrc_t on shell exec. - Fix init to be able to sendto init_t. - Allow syslog to connect to mysql - Allow lvm to manage its own fifo_files - Allow bugzilla to use ldap - More mls fixes- fixes for init policy (#436988) - fix build- Additional changes for MLS policy- Fix initrc_context generation for MLS- Fixes for libvirt- Allow bitlebee to read locale_t- More xselinux rules- Change httpd_$1_script_r*_t to httpd_$1_content_r*_t- Prepare policy for beta release - Change some of the system domains back to unconfined - Turn on some of the booleans- Allow nsplugin_config execstack/execmem - Allow nsplugin_t to read alsa config - Change apache to use user content- Add cyphesis policy- Fix Makefile.devel to build mls modules - Fix qemu to be more specific on labeling- Update to upstream fixes- Allow staff to mounton user_home_t- Add xace support- Add fusectl file system- Fixes from yum-cron - Update to latest upstream- Fix userdom_list_user_files- Merge with upstream- Allow udev to send audit messages- Add additional login users interfaces - userdom_admin_login_user_template(staff)- More fixes for polkit- Eliminate transition from unconfined_t to qemu by default - Fixes for gpg- Update to upstream- Fixes for staff_t- Add policy for kerneloops - Add policy for gnomeclock- Fixes for libvirt- Fixes for nsplugin- More fixes for qemu- Additional ports for vnc and allow qemu and libvirt to search all directories- Update to upstream - Add libvirt policy - add qemu policy- Allow fail2ban to create a socket in /var/run- Allow allow_httpd_mod_auth_pam to work- Add audisp policy and prelude- Allow all user roles to executae samba net command- Allow usertypes to read/write noxattr file systems- Fix nsplugin to allow flashplugin to work in enforcing mode- Allow pam_selinux_permit to kill all processes- Allow ptrace or user processes by users of same type - Add boolean for transition to nsplugin- Allow nsplugin sys_nice, getsched, setsched- Allow login programs to talk dbus to oddjob- Add procmail_log support - Lots of fixes for munin- Allow setroubleshoot to read policy config and send audit messages- Allow users to execute all files in homedir, if boolean set - Allow mount to read samba config- Fixes for xguest to run java plugin- dontaudit pam_t and dbusd writing to user_home_t- Update gpg to allow reading of inotify- Change user and staff roles to work correctly with varied perms- Fix munin log, - Eliminate duplicate mozilla file context - fix wpa_supplicant spec- Fix role transition from unconfined_r to system_r when running rpm - Allow unconfined_domains to communicate with user dbus instances- Fixes for xguest- Let all uncofined domains communicate with dbus unconfined- Run rpm in system_r- Zero out customizable types- Fix definiton of admin_home_t- Fix munin file context- Allow cron to run unconfined apps- Modify default login to unconfined_u- Dontaudit dbus user client search of /root- Update to upstream- Fixes for polkit - Allow xserver to ptrace- Add polkit policy - Symplify userdom context, remove automatic per_role changes- Update to upstream - Allow httpd_sys_script_t to search users homedirs- Allow rpm_script to transition to unconfined_execmem_t- Remove user based home directory separation- Remove user specific crond_t- Merge with upstream - Allow xsever to read hwdata_t - Allow login programs to setkeycreate- Update to upstream- Update to upstream- Allow XServer to read /proc/self/cmdline - Fix unconfined cron jobs - Allow fetchmail to transition to procmail - Fixes for hald_mac - Allow system_mail to transition to exim - Allow tftpd to upload files - Allow xdm to manage unconfined_tmp - Allow udef to read alsa config - Fix xguest to be able to connect to sound port- Fixes for hald_mac - Treat unconfined_home_dir_t as a home dir - dontaudit rhgb writes to fonts and root- Fix dnsmasq - Allow rshd full login privs- Allow rshd to connect to ports > 1023- Fix vpn to bind to port 4500 - Allow ssh to create shm - Add Kismet policy- Allow rpm to chat with networkmanager- Fixes for ipsec and exim mail - Change default to unconfined user- Pass the UNK_PERMS param to makefile - Fix gdm location- Make alsa work- Fixes for consolekit and startx sessions- Dontaudit consoletype talking to unconfined_t- Remove homedir_template- Check asound.state- Fix exim policy- Allow tmpreadper to read man_t - Allow racoon to bind to all nodes - Fixes for finger print reader- Allow xdm to talk to input device (fingerprint reader) - Allow octave to run as java- Allow login programs to set ioctl on /proc- Allow nsswitch apps to read samba_var_t- Fix maxima- Eliminate rpm_t:fifo_file avcs - Fix dbus path for helper app- Fix service start stop terminal avc's- Allow also to search var_lib - New context for dbus launcher- Allow cupsd_config_t to read/write usb_device_t - Support for finger print reader, - Many fixes for clvmd - dbus starting networkmanager- Fix java and mono to run in xguest account- Fix to add xguest account when inititial install - Allow mono, java, wine to run in userdomains- Allow xserver to search devpts_t - Dontaudit ldconfig output to homedir- Remove hplip_etc_t change back to etc_t.- Allow cron to search nfs and samba homedirs- Allow NetworkManager to dbus chat with yum-updated- Allow xfs to bind to port 7100- Allow newalias/sendmail dac_override - Allow bind to bind to all udp ports- Turn off direct transition- Allow wine to run in system role- Fix java labeling- Define user_home_type as home_type- Allow sendmail to create etc_aliases_t- Allow login programs to read symlinks on homedirs- Update an readd modules- Cleanup spec file- Allow xserver to be started by unconfined process and talk to tty- Upgrade to upstream to grab postgressql changes- Add setransd for mls policy- Add ldconfig_cache_t- Allow sshd to write to proc_t for afs login- Allow xserver access to urand- allow dovecot to search mountpoints- Fix Makefile for building policy modules- Fix dhcpc startup of service- Fix dbus chat to not happen for xguest and guest users- Fix nagios cgi - allow squid to communicate with winbind- Fixes for ldconfig- Update from upstream- Add nasd support- Fix new usb devices and dmfm- Eliminate mount_ntfs_t policy, merge into mount_t- Allow xserver to write to ramfs mounted by rhgb- Add context for dbus machine id- Update with latest changes from upstream- Fix prelink to handle execmod- Add ntpd_key_t to handle secret data- Add anon_inodefs - Allow unpriv user exec pam_exec_t - Fix trigger- Allow cups to use generic usb - fix inetd to be able to run random apps (git)- Add proper contexts for rsyslogd- Fixes for xguest policy- Allow execution of gconf- Fix moilscanner update problem- Begin adding policy to separate setsebool from semanage - Fix xserver.if definition to not break sepolgen.if- Add new devices- Add brctl policy- Fix root login to include system_r- Allow prelink to read kernel sysctls- Default to user_u:system_r:unconfined_t- fix squid - Fix rpm running as uid- Fix syslog declaration- Allow avahi to access inotify - Remove a lot of bogus security_t:filesystem avcs- Remove ifdef strict policy from upstream- Remove ifdef strict to allow user_u to login- Fix for amands - Allow semanage to read pp files - Allow rhgb to read xdm_xserver_tmp- Allow kerberos servers to use ldap for backing store- allow alsactl to read kernel state- More fixes for alsactl - Transition from hal and modutils - Fixes for suspend resume. - insmod domtrans to alsactl - insmod writes to hal log- Allow unconfined_t to transition to NetworkManager_t - Fix netlabel policy- Update to latest from upstream- Update to latest from upstream- Update to latest from upstream- Allow pcscd_t to send itself signals- Fixes for unix_update - Fix logwatch to be able to search all dirs- Upstream bumped the version- Allow consolekit to syslog - Allow ntfs to work with hal- Allow iptables to read etc_runtime_t- MLS Fixes- Fix path of /etc/lvm/cache directory - Fixes for alsactl and pppd_t - Fixes for consolekit- Allow insmod_t to mount kvmfs_t filesystems- Rwho policy - Fixes for consolekit- fixes for fusefs- Fix samba_net to allow it to view samba_var_t- Update to upstream- Fix Sonypic backlight - Allow snmp to look at squid_conf_t- Fixes for pyzor, cyrus, consoletype on everything installs- Fix hald_acl_t to be able to getattr/setattr on usb devices - Dontaudit write to unconfined_pipes for load_policy- Allow bluetooth to read inotifyfs- Fixes for samba domain controller. - Allow ConsoleKit to look at ttys- Fix interface call- Allow syslog-ng to read /var - Allow locate to getattr on all filesystems - nscd needs setcap- Update to upstream- Allow samba to run groupadd- Update to upstream- Allow mdadm to access generic scsi devices- Fix labeling on udev.tbl dirs- Fixes for logwatch- Add fusermount and mount_ntfs policy- Update to upstream - Allow saslauthd to use kerberos keytabs- Fixes for samba_var_t- Allow networkmanager to setpgid - Fixes for hal_acl_t- Remove disable_trans booleans - hald_acl_t needs to talk to nscd- Fix prelink to be able to manage usr dirs.- Allow insmod to launch init scripts- Remove setsebool policy- Fix handling of unlabled_t packets- More of my patches from upstream- Update to latest from upstream - Add fail2ban policy- Update to remove security_t:filesystem getattr problems- Policy for consolekit- Update to latest from upstream- Revert Nemiver change - Set sudo as a corecmd so prelink will work, remove sudoedit mapping, since this will not work, it does not transition. - Allow samba to execute useradd- Upgrade to the latest from upstream- Add sepolgen support - Add bugzilla policy- Fix file context for nemiver- Remove include sym link- Allow mozilla, evolution and thunderbird to read dev_random. Resolves: #227002 - Allow spamd to connect to smtp port Resolves: #227184 - Fixes to make ypxfr work Resolves: #227237- Fix ssh_agent to be marked as an executable - Allow Hal to rw sound device- Fix spamassisin so crond can update spam files - Fixes to allow kpasswd to work - Fixes for bluetooth- Remove some targeted diffs in file context file- Fix squid cachemgr labeling- Add ability to generate webadm_t policy - Lots of new interfaces for httpd - Allow sshd to login as unconfined_t- Continue fixing, additional user domains- Begin adding user confinement to targeted policy- Fixes for prelink, ktalkd, netlabel- Allow prelink when run from rpm to create tmp files Resolves: #221865 - Remove file_context for exportfs Resolves: #221181 - Allow spamassassin to create ~/.spamassissin Resolves: #203290 - Allow ssh access to the krb tickets - Allow sshd to change passwd - Stop newrole -l from working on non securetty Resolves: #200110 - Fixes to run prelink in MLS machine Resolves: #221233 - Allow spamassassin to read var_lib_t dir Resolves: #219234- fix mplayer to work under strict policy - Allow iptables to use nscd Resolves: #220794- Add gconf policy and make it work with strict- Many fixes for strict policy and by extension mls.- Fix to allow ftp to bind to ports > 1024 Resolves: #219349- Allow semanage to exec it self. Label genhomedircon as semanage_exec_t Resolves: #219421 - Allow sysadm_lpr_t to manage other print spool jobs Resolves: #220080- allow automount to setgid Resolves: #219999- Allow cron to polyinstatiate - Fix creation of boot flags Resolves: #207433- Fixes for irqbalance Resolves: #219606- Fix vixie-cron to work on mls Resolves: #207433Resolves: #218978- Allow initrc to create files in /var directories Resolves: #219227- More fixes for MLS Resolves: #181566- More Fixes polyinstatiation Resolves: #216184- More Fixes polyinstatiation - Fix handling of keyrings Resolves: #216184- Fix polyinstatiation - Fix pcscd handling of terminal Resolves: #218149 Resolves: #218350- More fixes for quota Resolves: #212957- ncsd needs to use avahi sockets Resolves: #217640 Resolves: #218014- Allow login programs to polyinstatiate homedirs Resolves: #216184 - Allow quotacheck to create database files Resolves: #212957- Dontaudit appending hal_var_lib files Resolves: #217452 Resolves: #217571 Resolves: #217611 Resolves: #217640 Resolves: #217725- Fix context for helix players file_context #216942- Fix load_policy to be able to mls_write_down so it can talk to the terminal- Fixes for hwclock, clamav, ftp- Move to upstream version which accepted my patches- Fixes for nvidia driver- Allow semanage to signal mcstrans- Update to upstream- Allow modstorage to edit /etc/fstab file- Fix for qemu, /dev/- Fix path to realplayer.bin- Allow xen to connect to xen port- Allow cups to search samba_etc_t directory - Allow xend_t to list auto_mountpoints- Allow xen to search automount- Fix spec of jre files- Fix unconfined access to shadow file- Allow xend to create files in xen_image_t directories- Fixes for /var/lib/hal- Remove ability for sysadm_t to look at audit.log- Fix rpc_port_types - Add aide policy for mls- Merge with upstream- Lots of fixes for ricci- Allow xen to read/write fixed devices with a boolean - Allow apache to search /var/log- Fix policygentool specfile problem. - Allow apache to send signals to it's logging helpers. - Resolves: rhbz#212731- Add perms for swat- Add perms for swat- Allow daemons to dump core files to /- Fixes for ricci- Allow mount.nfs to work- Allow ricci-modstorage to look at lvm_etc_t- Fixes for ricci using saslauthd- Allow mountpoint on home_dir_t and home_t- Update xen to read nfs files- Allow noxattrfs to associate with other noxattrfs- Allow hal to use power_device_t- Allow procemail to look at autofs_t - Allow xen_image_t to work as a fixed device- Refupdate from upstream- Add lots of fixes for mls cups- Lots of fixes for ricci- Fix number of cats- Update to upstream- More iSCSI changes for #209854- Test ISCSI fixes for #209854- allow semodule to rmdir selinux_config_t dir- Fix boot_runtime_t problem on ppc. Should not be creating these files.- Fix context mounts on reboot - Fix ccs creation of directory in /var/log- Update for tallylog- Allow xend to rewrite dhcp conf files - Allow mgetty sys_admin capability- Make xentapctrl work- Don't transition unconfined_t to bootloader_t - Fix label in /dev/xen/blktap- Patch for labeled networking- Fix crond handling for mls- Update to upstream- Remove bluetooth-helper transition - Add selinux_validate for semanage - Require new version of libsemanage- Fix prelink- Fix rhgb- Fix setrans handling on MLS and useradd- Support for fuse - fix vigr- Fix dovecot, amanda - Fix mls- Allow java execheap for itanium- Update with upstream- mls fixes- Update from upstream- More fixes for mls - Revert change on automount transition to mount- Fix cron jobs to run under the correct context- Fixes to make pppd work- Multiple policy fixes - Change max categories to 1023- Fix transition on mcstransd- Add /dev/em8300 defs- Upgrade to upstream- Fix ppp connections from network manager- Add tty access to all domains boolean - Fix gnome-pty-helper context for ia64- Fixed typealias of firstboot_rw_t- Fix location of xel log files - Fix handling of sysadm_r -> rpm_exec_t- Fixes for autofs, lp- Update from upstream- Fixup for test6- Update to upstream- Update to upstream- Fix suspend to disk problems- Lots of fixes for restarting daemons at the console.- Fix audit line - Fix requires line- Upgrade to upstream- Fix install problems- Allow setroubleshoot to getattr on all dirs to gather RPM data- Set /usr/lib/ia32el/ia32x_loader to unconfined_execmem_exec_t for ia32 platform - Fix spec for /dev/adsp- Fix xen tty devices- Fixes for setroubleshoot- Update to upstream- Fixes for stunnel and postgresql - Update from upstream- Update from upstream - More java fixes- Change allow_execstack to default to on, for RHEL5 Beta. This is required because of a Java compiler problem. Hope to turn off for next beta- Misc fixes- More fixes for strict policy- Quiet down anaconda audit messages- Fix setroubleshootd- Update to the latest from upstream- More fixes for xen- Fix anaconda transitions- yet more xen rules- more xen rules- Fixes for Samba- Fixes for xen- Allow setroubleshootd to send mail- Add nagios policy- fixes for setroubleshoot- Added Paul Howarth patch to only load policy packages shipped with this package - Allow pidof from initrc to ptrace higher level domains - Allow firstboot to communicate with hal via dbus- Add policy for /var/run/ldapi- Fix setroubleshoot policy- Fixes for mls use of ssh - named has a new conf file- Fixes to make setroubleshoot work- Cups needs to be able to read domain state off of printer client- add boolean to allow zebra to write config files- setroubleshootd fixes- Allow prelink to read bin_t symlink - allow xfs to read random devices - Change gfs to support xattr- Remove spamassassin_can_network boolean- Update to upstream - Fix lpr domain for mls- Add setroubleshoot policy- Turn off auditallow on setting booleans- Multiple fixes- Update to upstream- Update to upstream - Add new class for kernel key ring- Update to upstream- Update to upstream- Break out selinux-devel package- Add ibmasmfs- Fix policygentool gen_requires- Update from Upstream- Fix spec of realplay- Update to upstream- Fix semanage- Allow useradd to create_home_dir in MLS environment- Update from upstream- Update from upstream- Add oprofilefs- Fix for hplip and Picasus- Update to upstream- Update to upstream- fixes for spamd- fixes for java, openldap and webalizer- Xen fixes- Upgrade to upstream- allow hal to read boot_t files - Upgrade to upstream- allow hal to read boot_t files- Update from upstream- Fixes for amavis- Update from upstream- Allow auditctl to search all directories- Add acquire service for mono.- Turn off allow_execmem boolean - Allow ftp dac_override when allowed to access users homedirs- Clean up spec file - Transition from unconfined_t to prelink_t- Allow execution of cvs command- Update to upstream- Update to upstream- Fix libjvm spec- Update to upstream- Add xm policy - Fix policygentool- Update to upstream - Fix postun to only disable selinux on full removal of the packages- Allow mono to chat with unconfined- Allow procmail to sendmail - Allow nfs to share dosfs- Update to latest from upstream - Allow selinux-policy to be removed and kernel not to crash- Update to latest from upstream - Add James Antill patch for xen - Many fixes for pegasus- Add unconfined_mount_t - Allow privoxy to connect to httpd_cache - fix cups labeleing on /var/cache/cups- Update to latest from upstream- Update to latest from upstream - Allow mono and unconfined to talk to initrc_t dbus objects- Change libraries.fc to stop shlib_t form overriding texrel_shlib_t- Fix samba creating dirs in homedir - Fix NFS so its booleans would work- Allow secadm_t ability to relabel all files - Allow ftp to search xferlog_t directories - Allow mysql to communicate with ldap - Allow rsync to bind to rsync_port_t- Fixed mailman with Postfix #183928 - Allowed semanage to create file_context files. - Allowed amanda_t to access inetd_t TCP sockets and allowed amanda_recover_t to bind to reserved ports. #149030 - Don't allow devpts_t to be associated with tmp_t. - Allow hald_t to stat all mountpoints. - Added boolean samba_share_nfs to allow smbd_t full access to NFS mounts. - Make mount run in mount_t domain from unconfined_t to prevent mislabeling of /etc/mtab. - Changed the file_contexts to not have a regex before the first ^/[a-z]/ whenever possible, makes restorecon slightly faster. - Correct the label of /etc/named.caching-nameserver.conf - Now label /usr/src/kernels/.+/lib(/.*)? as usr_t instead of /usr/src(/.*)?/lib(/.*)? - I don't think we need anything else under /usr/src hit by this. - Granted xen access to /boot, allowed mounting on xend_var_lib_t, and allowed xenstored_t rw access to the xen device node.- More textrel_shlib_t file path fixes - Add ada support- Get auditctl working in MLS policy- Add mono dbus support - Lots of file_context fixes for textrel_shlib_t in FC5 - Turn off execmem auditallow since they are filling log files- Update to upstream- Allow automount and dbus to read cert files- Fix ftp policy - Fix secadm running of auditctl- Update to upstream- Update to upstream- Fix policyhelp- Fix pam_console handling of usb_device - dontaudit logwatch reading /mnt dir- Update to upstream- Get transition rules to create policy.20 at SystemHigh- Allow secadmin to shutdown system - Allow sendmail to exec newalias- MLS Fixes dmidecode needs mls_file_read_up - add ypxfr_t - run init needs access to nscd - udev needs setuid - another xen log file - Dontaudit mount getattr proc_kcore_t- fix buildroot usage (#185391)- Get rid of mount/fsdisk scan of /dev messages - Additional fixes for suspend/resume- Fake make to rebuild enableaudit.pp- Get xen networking running.- Fixes for Xen - enableaudit should not be the same as base.pp - Allow ps to work for all process- more xen policy fixups- more xen fixage (#184393)- Fix blkid specification - Allow postfix to execute mailman_que- Blkid changes - Allow udev access to usb_device_t - Fix post script to create targeted policy config file- Allow lvm tools to create drevice dir- Add Xen support- Fixes for cups - Make cryptosetup work with hal- Load Policy needs translock- Fix cups html interface- Add hal changes suggested by Jeremy - add policyhelp to point at policy html pages- Additional fixes for nvidia and cups- Update to upstream - Merged my latest fixes - Fix cups policy to handle unix domain sockets- NSCD socket is in nscd_var_run_t needs to be able to search dir- Fixes Apache interface file- Fixes for new version of cups- Turn off polyinstatiate util after FC5- Fix problem with privoxy talking to Tor- Turn on polyinstatiation- Don't transition from unconfined_t to fsadm_t- Fix policy update model.- Update to upstream- Fix load_policy to work on MLS - Fix cron_rw_system_pipes for postfix_postdrop_t - Allow audotmount to run showmount- Fix swapon - allow httpd_sys_script_t to be entered via a shell - Allow httpd_sys_script_t to read eventpolfs- Update from upstream- allow cron to read apache files- Fix vpnc policy to work from NetworkManager- Update to upstream - Fix semoudle polcy- Update to upstream - fix sysconfig/selinux link- Add router port for zebra - Add imaze port for spamd - Fixes for amanda and java- Fix bluetooth handling of usb devices - Fix spamd reading of ~/ - fix nvidia spec- Update to upsteam- Add users_extra files- Update to upstream- Add semodule policy- Update from upstream- Fix for spamd to use razor port- Fixes for mcs - Turn on mount and fsadm for unconfined_t- Fixes for the -devel package- Fix for spamd to use ldap- Update to upstream- Update to upstream - Fix rhgb, and other Xorg startups- Update to upstream- Separate out role of secadm for mls- Add inotifyfs handling- Update to upstream - Put back in changes for pup/zen- Many changes for MLS - Turn on strict policy- Update to upstream- Update to upstream - Fixes for booting and logging in on MLS machine- Update to upstream - Turn off execheap execstack for unconfined users - Add mono/wine policy to allow execheap and execstack for them - Add execheap for Xdm policy- Update to upstream - Fixes to fetchmail,- Update to upstream- Fix for procmail/spamassasin - Update to upstream - Add rules to allow rpcd to work with unlabeled_networks.- Update to upstream - Fix ftp Man page- Update to upstream- fix pup transitions (#177262) - fix xen disks (#177599)- Update to upstream- More Fixes for hal and readahead- Fixes for hal and readahead- Update to upstream - Apply- Add wine and fix hal problems- Handle new location of hal scripts- Allow su to read /etc/mtab- Update to upstream- Fix "libsemanage.parse_module_headers: Data did not represent a module." problem- Allow load_policy to read /etc/mtab- Fix dovecot to allow dovecot_auth to look at /tmp- Allow restorecon to read unlabeled_t directories in order to fix labeling.- Add Logwatch policy- Fix /dev/ub[a-z] file context- Fix library specification - Give kudzu execmem privs- Fix hostname in targeted policy- Fix passwd command on mls- Lots of fixes to make mls policy work- Add dri libs to textrel_shlib_t - Add system_r role for java - Add unconfined_exec_t for vncserver - Allow slapd to use kerberos- Add man pages- Add enableaudit.pp- Fix mls policy- Update mls file from old version- Add sids back in - Rebuild with update checkpolicy- Fixes to allow automount to use portmap - Fixes to start kernel in s0-s15:c0.c255- Add java unconfined/execmem policy- Add file context for /var/cvs - Dontaudit webalizer search of homedir- Update from upstream- Clean up spec - range_transition crond to SystemHigh- Fixes for hal - Update to upstream- Turn back on execmem since we need it for java, firefox, ooffice - Allow gpm to stream socket to itself- fix requirements to be on the actual packages so that policy can get created properly at install time- Allow unconfined_t to execmod texrel_shlib_t- Update to upstream - Turn off allow_execmem and allow_execmod booleans - Add tcpd and automount policies- Add two new httpd booleans, turned off by default * httpd_can_network_relay * httpd_can_network_connect_db- Add ghost for policy.20- Update to upstream - Turn off boolean allow_execstack- Change setrans-mls to use new libsetrans - Add default_context rule for xdm- Change Requires to PreReg for requiring of policycoreutils on install- New upstream releaseAdd xdm policyUpdate from upstreamUpdate from upstreamUpdate from upstream- Also trigger to rebuild policy for versions up to 2.0.7.- No longer installing policy.20 file, anaconda handles the building of the app.- Fixes for dovecot and saslauthd- Cleanup pegasus and named - Fix spec file - Fix up passwd changing applications-Update to latest from upstream- Add rules for pegasus and avahi- Start building MLS Policy- Update to upstream- Turn on bash- Initial version/bin/sh/bin/shselinux-policy-mls-sources  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXY3.13.1-166.el73.13.1-166.el73.13.1-166.el72      !!!"""###$$$%%%&&&'''((()))***+++,,,---...///000111222333444555666777888999:::;;;<<<===>>>???@@@AAABBBCCCDDDEEEFFFGGGHHHIIIJJJKKKLLLMMMNNNOOOPPPQQQRRRSSSTTTUUUVVVWWWXXXYYYZZZ[[[\\\]]]^^^___```aaabbbcccdddeeefffggghhhiiijjjkkklllmmmnnnooopppqqqrrrssstttuuuvvvwwwxxxyyyzzz{{{|||}}}~~~                                     mls.policy.sha512activecommit_numfile_contextshomedir_templatemodules100accountsdcilhlllang_extacctcilhlllang_extafscilhlllang_extaidecilhlllang_extalsacilhlllang_extamandacilhlllang_extamtucilhlllang_extanacondacilhlllang_extantiviruscilhlllang_extapachecilhlllang_extapcupsdcilhlllang_extapmcilhlllang_extapplicationcilhlllang_extarpwatchcilhlllang_extauditadmcilhlllang_extauthlogincilhlllang_extautomountcilhlllang_extavahicilhlllang_extawstatscilhlllang_extbasecilhlllang_extbindcilhlllang_extbitlbeecilhlllang_extbluetoothcilhlllang_extboinccilhlllang_extbootloadercilhlllang_extbrctlcilhlllang_extbugzillacilhlllang_extcachefilesdcilhlllang_extcalamariscilhlllang_extcannacilhlllang_extccscilhlllang_extcdrecordcilhlllang_extcertmastercilhlllang_extcertmongercilhlllang_extcertwatchcilhlllang_extcgroupcilhlllang_extchromecilhlllang_extchronydcilhlllang_extcipecilhlllang_extclockcilhlllang_extclogdcilhlllang_extcmirrordcilhlllang_extcolordcilhlllang_extcomsatcilhlllang_extcouriercilhlllang_extcpucontrolcilhlllang_extcpufreqselectorcilhlllang_extcroncilhlllang_extcupscilhlllang_extcvscilhlllang_extcyphesiscilhlllang_extcyruscilhlllang_extdaemontoolscilhlllang_extdbadmcilhlllang_extdbskkcilhlllang_extdbuscilhlllang_extdcccilhlllang_extdevicekitcilhlllang_extdhcpcilhlllang_extdictdcilhlllang_extdmesgcilhlllang_extdmidecodecilhlllang_extdnsmasqcilhlllang_extdnsseccilhlllang_extdovecotcilhlllang_extentropydcilhlllang_exteximcilhlllang_extfail2bancilhlllang_extfetchmailcilhlllang_extfingercilhlllang_extfirewalldcilhlllang_extfirewallguicilhlllang_extfirstbootcilhlllang_extfprintdcilhlllang_extfstoolscilhlllang_extftpcilhlllang_extgamescilhlllang_extgettycilhlllang_extgitcilhlllang_extgitosiscilhlllang_extglancecilhlllang_extgnomecilhlllang_extgpgcilhlllang_extgpmcilhlllang_extgpsdcilhlllang_extgssproxycilhlllang_extguestcilhlllang_exthostnamecilhlllang_extinetdcilhlllang_extinitcilhlllang_extinncilhlllang_extipseccilhlllang_extiptablescilhlllang_extirccilhlllang_extirqbalancecilhlllang_extiscsicilhlllang_extjabbercilhlllang_extkdumpcilhlllang_extkdumpguicilhlllang_extkerberoscilhlllang_extkismetcilhlllang_extksmtunedcilhlllang_extktalkcilhlllang_extldapcilhlllang_extlibrariescilhlllang_extlircdcilhlllang_extloadkeyscilhlllang_extlocallogincilhlllang_extlockdevcilhlllang_extlogadmcilhlllang_extloggingcilhlllang_extlogrotatecilhlllang_extlogwatchcilhlllang_extlpdcilhlllang_extlvmcilhlllang_extmailmancilhlllang_extmandbcilhlllang_extmcelogcilhlllang_extmemcachedcilhlllang_extmiltercilhlllang_extmiscfilescilhlllang_extmodemmanagercilhlllang_extmodutilscilhlllang_extmojomojocilhlllang_extmountcilhlllang_extmozillacilhlllang_extmplayercilhlllang_extmrtgcilhlllang_extmtacilhlllang_extmunincilhlllang_extmysqlcilhlllang_extnagioscilhlllang_extnamespacecilhlllang_extncftoolcilhlllang_extnetlabelcilhlllang_extnetutilscilhlllang_extnetworkmanagercilhlllang_extniscilhlllang_extnscdcilhlllang_extnslcdcilhlllang_extntopcilhlllang_extntpcilhlllang_extnxcilhlllang_extoddjobcilhlllang_extopenctcilhlllang_extopenvpncilhlllang_extopenvswitchcilhlllang_extpadscilhlllang_extpcmciacilhlllang_extpcscdcilhlllang_extpegasuscilhlllang_extpingdcilhlllang_extpiranhacilhlllang_extplymouthdcilhlllang_extpodsleuthcilhlllang_extpolicykitcilhlllang_extpolipocilhlllang_extportmapcilhlllang_extportreservecilhlllang_extpostfixcilhlllang_extpostgresqlcilhlllang_extpostgreycilhlllang_extpppcilhlllang_extprelinkcilhlllang_extpreludecilhlllang_extprivoxycilhlllang_extprocmailcilhlllang_extprosodycilhlllang_extpsadcilhlllang_extptchowncilhlllang_extpublicfilecilhlllang_extpulseaudiocilhlllang_extqmailcilhlllang_extqpidcilhlllang_extquotacilhlllang_extradiuscilhlllang_extradvdcilhlllang_extraidcilhlllang_extrdisccilhlllang_extreadaheadcilhlllang_extremotelogincilhlllang_extrhcscilhlllang_extrhgbcilhlllang_extriccicilhlllang_extrlogincilhlllang_extroundupcilhlllang_extrpccilhlllang_extrpcbindcilhlllang_extrpmcilhlllang_extrshdcilhlllang_extrsynccilhlllang_extrtkitcilhlllang_extrwhocilhlllang_extsambacilhlllang_extsambaguicilhlllang_extsaslcilhlllang_extscreencilhlllang_extsecadmcilhlllang_extselinuxutilcilhlllang_extsendmailcilhlllang_extsetranscilhlllang_extsetroubleshootcilhlllang_extseunsharecilhlllang_extshorewallcilhlllang_extslocatecilhlllang_extsmartmoncilhlllang_extsnmpcilhlllang_extsnortcilhlllang_extsosreportcilhlllang_extsoundservercilhlllang_extspamassassincilhlllang_extsquidcilhlllang_extsshcilhlllang_extsssdcilhlllang_extstaffcilhlllang_extstunnelcilhlllang_extsucilhlllang_extsudocilhlllang_extsysadmcilhlllang_extsysadm_secadmcilhlllang_extsysnetworkcilhlllang_extsysstatcilhlllang_extsystemdcilhlllang_exttcpdcilhlllang_exttcsdcilhlllang_exttelepathycilhlllang_exttelnetcilhlllang_exttftpcilhlllang_exttgtdcilhlllang_extthumbcilhlllang_exttmpreapercilhlllang_exttorcilhlllang_exttunedcilhlllang_exttvtimecilhlllang_extudevcilhlllang_extulogdcilhlllang_extumlcilhlllang_extunlabelednetcilhlllang_extunprivusercilhlllang_extupdfstabcilhlllang_extusbmodulescilhlllang_extuserdomaincilhlllang_extuserhelpercilhlllang_extusermanagecilhlllang_extusernetctlcilhlllang_extuucpcilhlllang_extvirtcilhlllang_extvmwarecilhlllang_extvpncilhlllang_extw3ccilhlllang_extwebadmcilhlllang_extwebalizercilhlllang_extwinecilhlllang_extwiresharkcilhlllang_extwmcilhlllang_extxencilhlllang_extxguestcilhlllang_extxservercilhlllang_extzabbixcilhlllang_extzebracilhlllang_extzosremotecilhlllang_extdisabledpolicy.kernpolicy.linkedseusersseusers.linkedusers_extrausers_extra.linkedbooleans.subs_distcontextscustomizable_typesdbus_contextsdefault_contextsdefault_typefailsafe_contextfilesfile_contextsfile_contexts.binfile_contexts.homedirsfile_contexts.homedirs.binfile_contexts.localfile_contexts.local.binfile_contexts.subsfile_contexts.subs_distmediainitrc_contextlxc_contextsremovable_contextsecuretty_typessepgsql_contextssnapperd_contextssystemd_contextsuserhelper_contextusersguest_urootstaff_uunconfined_uuser_uxguest_uvirtual_domain_contextvirtual_image_contextx_contextsloginspolicypolicy.30semanage.read.LOCKsemanage.trans.LOCKsetrans.confseusersselinux-policy-migrate-local-changes@mls.serviceselinux-policy-migrate-local-changes@.serviceselinux-policy-migrate-local-changes.shmlsbase.lstmodules-base.lstmodules-contrib.lstnonbasemodules.lst/etc/selinux//etc/selinux/mls//etc/selinux/mls/active//etc/selinux/mls/active/modules//etc/selinux/mls/active/modules/100//etc/selinux/mls/active/modules/100/accountsd//etc/selinux/mls/active/modules/100/acct//etc/selinux/mls/active/modules/100/afs//etc/selinux/mls/active/modules/100/aide//etc/selinux/mls/active/modules/100/alsa//etc/selinux/mls/active/modules/100/amanda//etc/selinux/mls/active/modules/100/amtu//etc/selinux/mls/active/modules/100/anaconda//etc/selinux/mls/active/modules/100/antivirus//etc/selinux/mls/active/modules/100/apache//etc/selinux/mls/active/modules/100/apcupsd//etc/selinux/mls/active/modules/100/apm//etc/selinux/mls/active/modules/100/application//etc/selinux/mls/active/modules/100/arpwatch//etc/selinux/mls/active/modules/100/auditadm//etc/selinux/mls/active/modules/100/authlogin//etc/selinux/mls/active/modules/100/automount//etc/selinux/mls/active/modules/100/avahi//etc/selinux/mls/active/modules/100/awstats//etc/selinux/mls/active/modules/100/base//etc/selinux/mls/active/modules/100/bind//etc/selinux/mls/active/modules/100/bitlbee//etc/selinux/mls/active/modules/100/bluetooth//etc/selinux/mls/active/modules/100/boinc//etc/selinux/mls/active/modules/100/bootloader//etc/selinux/mls/active/modules/100/brctl//etc/selinux/mls/active/modules/100/bugzilla//etc/selinux/mls/active/modules/100/cachefilesd//etc/selinux/mls/active/modules/100/calamaris//etc/selinux/mls/active/modules/100/canna//etc/selinux/mls/active/modules/100/ccs//etc/selinux/mls/active/modules/100/cdrecord//etc/selinux/mls/active/modules/100/certmaster//etc/selinux/mls/active/modules/100/certmonger//etc/selinux/mls/active/modules/100/certwatch//etc/selinux/mls/active/modules/100/cgroup//etc/selinux/mls/active/modules/100/chrome//etc/selinux/mls/active/modules/100/chronyd//etc/selinux/mls/active/modules/100/cipe//etc/selinux/mls/active/modules/100/clock//etc/selinux/mls/active/modules/100/clogd//etc/selinux/mls/active/modules/100/cmirrord//etc/selinux/mls/active/modules/100/colord//etc/selinux/mls/active/modules/100/comsat//etc/selinux/mls/active/modules/100/courier//etc/selinux/mls/active/modules/100/cpucontrol//etc/selinux/mls/active/modules/100/cpufreqselector//etc/selinux/mls/active/modules/100/cron//etc/selinux/mls/active/modules/100/cups//etc/selinux/mls/active/modules/100/cvs//etc/selinux/mls/active/modules/100/cyphesis//etc/selinux/mls/active/modules/100/cyrus//etc/selinux/mls/active/modules/100/daemontools//etc/selinux/mls/active/modules/100/dbadm//etc/selinux/mls/active/modules/100/dbskk//etc/selinux/mls/active/modules/100/dbus//etc/selinux/mls/active/modules/100/dcc//etc/selinux/mls/active/modules/100/devicekit//etc/selinux/mls/active/modules/100/dhcp//etc/selinux/mls/active/modules/100/dictd//etc/selinux/mls/active/modules/100/dmesg//etc/selinux/mls/active/modules/100/dmidecode//etc/selinux/mls/active/modules/100/dnsmasq//etc/selinux/mls/active/modules/100/dnssec//etc/selinux/mls/active/modules/100/dovecot//etc/selinux/mls/active/modules/100/entropyd//etc/selinux/mls/active/modules/100/exim//etc/selinux/mls/active/modules/100/fail2ban//etc/selinux/mls/active/modules/100/fetchmail//etc/selinux/mls/active/modules/100/finger//etc/selinux/mls/active/modules/100/firewalld//etc/selinux/mls/active/modules/100/firewallgui//etc/selinux/mls/active/modules/100/firstboot//etc/selinux/mls/active/modules/100/fprintd//etc/selinux/mls/active/modules/100/fstools//etc/selinux/mls/active/modules/100/ftp//etc/selinux/mls/active/modules/100/games//etc/selinux/mls/active/modules/100/getty//etc/selinux/mls/active/modules/100/git//etc/selinux/mls/active/modules/100/gitosis//etc/selinux/mls/active/modules/100/glance//etc/selinux/mls/active/modules/100/gnome//etc/selinux/mls/active/modules/100/gpg//etc/selinux/mls/active/modules/100/gpm//etc/selinux/mls/active/modules/100/gpsd//etc/selinux/mls/active/modules/100/gssproxy//etc/selinux/mls/active/modules/100/guest//etc/selinux/mls/active/modules/100/hostname//etc/selinux/mls/active/modules/100/inetd//etc/selinux/mls/active/modules/100/init//etc/selinux/mls/active/modules/100/inn//etc/selinux/mls/active/modules/100/ipsec//etc/selinux/mls/active/modules/100/iptables//etc/selinux/mls/active/modules/100/irc//etc/selinux/mls/active/modules/100/irqbalance//etc/selinux/mls/active/modules/100/iscsi//etc/selinux/mls/active/modules/100/jabber//etc/selinux/mls/active/modules/100/kdump//etc/selinux/mls/active/modules/100/kdumpgui//etc/selinux/mls/active/modules/100/kerberos//etc/selinux/mls/active/modules/100/kismet//etc/selinux/mls/active/modules/100/ksmtuned//etc/selinux/mls/active/modules/100/ktalk//etc/selinux/mls/active/modules/100/ldap//etc/selinux/mls/active/modules/100/libraries//etc/selinux/mls/active/modules/100/lircd//etc/selinux/mls/active/modules/100/loadkeys//etc/selinux/mls/active/modules/100/locallogin//etc/selinux/mls/active/modules/100/lockdev//etc/selinux/mls/active/modules/100/logadm//etc/selinux/mls/active/modules/100/logging//etc/selinux/mls/active/modules/100/logrotate//etc/selinux/mls/active/modules/100/logwatch//etc/selinux/mls/active/modules/100/lpd//etc/selinux/mls/active/modules/100/lvm//etc/selinux/mls/active/modules/100/mailman//etc/selinux/mls/active/modules/100/mandb//etc/selinux/mls/active/modules/100/mcelog//etc/selinux/mls/active/modules/100/memcached//etc/selinux/mls/active/modules/100/milter//etc/selinux/mls/active/modules/100/miscfiles//etc/selinux/mls/active/modules/100/modemmanager//etc/selinux/mls/active/modules/100/modutils//etc/selinux/mls/active/modules/100/mojomojo//etc/selinux/mls/active/modules/100/mount//etc/selinux/mls/active/modules/100/mozilla//etc/selinux/mls/active/modules/100/mplayer//etc/selinux/mls/active/modules/100/mrtg//etc/selinux/mls/active/modules/100/mta//etc/selinux/mls/active/modules/100/munin//etc/selinux/mls/active/modules/100/mysql//etc/selinux/mls/active/modules/100/nagios//etc/selinux/mls/active/modules/100/namespace//etc/selinux/mls/active/modules/100/ncftool//etc/selinux/mls/active/modules/100/netlabel//etc/selinux/mls/active/modules/100/netutils//etc/selinux/mls/active/modules/100/networkmanager//etc/selinux/mls/active/modules/100/nis//etc/selinux/mls/active/modules/100/nscd//etc/selinux/mls/active/modules/100/nslcd//etc/selinux/mls/active/modules/100/ntop//etc/selinux/mls/active/modules/100/ntp//etc/selinux/mls/active/modules/100/nx//etc/selinux/mls/active/modules/100/oddjob//etc/selinux/mls/active/modules/100/openct//etc/selinux/mls/active/modules/100/openvpn//etc/selinux/mls/active/modules/100/openvswitch//etc/selinux/mls/active/modules/100/pads//etc/selinux/mls/active/modules/100/pcmcia//etc/selinux/mls/active/modules/100/pcscd//etc/selinux/mls/active/modules/100/pegasus//etc/selinux/mls/active/modules/100/pingd//etc/selinux/mls/active/modules/100/piranha//etc/selinux/mls/active/modules/100/plymouthd//etc/selinux/mls/active/modules/100/podsleuth//etc/selinux/mls/active/modules/100/policykit//etc/selinux/mls/active/modules/100/polipo//etc/selinux/mls/active/modules/100/portmap//etc/selinux/mls/active/modules/100/portreserve//etc/selinux/mls/active/modules/100/postfix//etc/selinux/mls/active/modules/100/postgresql//etc/selinux/mls/active/modules/100/postgrey//etc/selinux/mls/active/modules/100/ppp//etc/selinux/mls/active/modules/100/prelink//etc/selinux/mls/active/modules/100/prelude//etc/selinux/mls/active/modules/100/privoxy//etc/selinux/mls/active/modules/100/procmail//etc/selinux/mls/active/modules/100/prosody//etc/selinux/mls/active/modules/100/psad//etc/selinux/mls/active/modules/100/ptchown//etc/selinux/mls/active/modules/100/publicfile//etc/selinux/mls/active/modules/100/pulseaudio//etc/selinux/mls/active/modules/100/qmail//etc/selinux/mls/active/modules/100/qpid//etc/selinux/mls/active/modules/100/quota//etc/selinux/mls/active/modules/100/radius//etc/selinux/mls/active/modules/100/radvd//etc/selinux/mls/active/modules/100/raid//etc/selinux/mls/active/modules/100/rdisc//etc/selinux/mls/active/modules/100/readahead//etc/selinux/mls/active/modules/100/remotelogin//etc/selinux/mls/active/modules/100/rhcs//etc/selinux/mls/active/modules/100/rhgb//etc/selinux/mls/active/modules/100/ricci//etc/selinux/mls/active/modules/100/rlogin//etc/selinux/mls/active/modules/100/roundup//etc/selinux/mls/active/modules/100/rpc//etc/selinux/mls/active/modules/100/rpcbind//etc/selinux/mls/active/modules/100/rpm//etc/selinux/mls/active/modules/100/rshd//etc/selinux/mls/active/modules/100/rsync//etc/selinux/mls/active/modules/100/rtkit//etc/selinux/mls/active/modules/100/rwho//etc/selinux/mls/active/modules/100/samba//etc/selinux/mls/active/modules/100/sambagui//etc/selinux/mls/active/modules/100/sasl//etc/selinux/mls/active/modules/100/screen//etc/selinux/mls/active/modules/100/secadm//etc/selinux/mls/active/modules/100/selinuxutil//etc/selinux/mls/active/modules/100/sendmail//etc/selinux/mls/active/modules/100/setrans//etc/selinux/mls/active/modules/100/setroubleshoot//etc/selinux/mls/active/modules/100/seunshare//etc/selinux/mls/active/modules/100/shorewall//etc/selinux/mls/active/modules/100/slocate//etc/selinux/mls/active/modules/100/smartmon//etc/selinux/mls/active/modules/100/snmp//etc/selinux/mls/active/modules/100/snort//etc/selinux/mls/active/modules/100/sosreport//etc/selinux/mls/active/modules/100/soundserver//etc/selinux/mls/active/modules/100/spamassassin//etc/selinux/mls/active/modules/100/squid//etc/selinux/mls/active/modules/100/ssh//etc/selinux/mls/active/modules/100/sssd//etc/selinux/mls/active/modules/100/staff//etc/selinux/mls/active/modules/100/stunnel//etc/selinux/mls/active/modules/100/su//etc/selinux/mls/active/modules/100/sudo//etc/selinux/mls/active/modules/100/sysadm//etc/selinux/mls/active/modules/100/sysadm_secadm//etc/selinux/mls/active/modules/100/sysnetwork//etc/selinux/mls/active/modules/100/sysstat//etc/selinux/mls/active/modules/100/systemd//etc/selinux/mls/active/modules/100/tcpd//etc/selinux/mls/active/modules/100/tcsd//etc/selinux/mls/active/modules/100/telepathy//etc/selinux/mls/active/modules/100/telnet//etc/selinux/mls/active/modules/100/tftp//etc/selinux/mls/active/modules/100/tgtd//etc/selinux/mls/active/modules/100/thumb//etc/selinux/mls/active/modules/100/tmpreaper//etc/selinux/mls/active/modules/100/tor//etc/selinux/mls/active/modules/100/tuned//etc/selinux/mls/active/modules/100/tvtime//etc/selinux/mls/active/modules/100/udev//etc/selinux/mls/active/modules/100/ulogd//etc/selinux/mls/active/modules/100/uml//etc/selinux/mls/active/modules/100/unlabelednet//etc/selinux/mls/active/modules/100/unprivuser//etc/selinux/mls/active/modules/100/updfstab//etc/selinux/mls/active/modules/100/usbmodules//etc/selinux/mls/active/modules/100/userdomain//etc/selinux/mls/active/modules/100/userhelper//etc/selinux/mls/active/modules/100/usermanage//etc/selinux/mls/active/modules/100/usernetctl//etc/selinux/mls/active/modules/100/uucp//etc/selinux/mls/active/modules/100/virt//etc/selinux/mls/active/modules/100/vmware//etc/selinux/mls/active/modules/100/vpn//etc/selinux/mls/active/modules/100/w3c//etc/selinux/mls/active/modules/100/webadm//etc/selinux/mls/active/modules/100/webalizer//etc/selinux/mls/active/modules/100/wine//etc/selinux/mls/active/modules/100/wireshark//etc/selinux/mls/active/modules/100/wm//etc/selinux/mls/active/modules/100/xen//etc/selinux/mls/active/modules/100/xguest//etc/selinux/mls/active/modules/100/xserver//etc/selinux/mls/active/modules/100/zabbix//etc/selinux/mls/active/modules/100/zebra//etc/selinux/mls/active/modules/100/zosremote//etc/selinux/mls/contexts//etc/selinux/mls/contexts/files//etc/selinux/mls/contexts/users//etc/selinux/mls/policy//usr/lib/systemd/system/basic.target.wants//usr/lib/systemd/system//usr/libexec/selinux//usr/share/selinux//usr/share/selinux/mls/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=genericdrpmxz2noarch-redhat-linux-gnu   directoryASCII textASCII text (bzip2 compressed data, block size = 500k)ASCII text, with no line terminatorsASCII text, with very long lines (bzip2 compressed data, block size = 500k)cannot open (No such file or directory)exported SGML document, ASCII textemptyHTML document, ASCII textBourne-Again shell script, ASCII text executableASCII text, with very long lines, with no line terminatorsR?7zXZ !PH6]"k%qkhuDJDg؞Wg.`Klbϖ\QޝI$d=je@70NՆrT@d#;5-Ja~}'kȳ d0]%| n[;R0m+FK@W,nk5KT. T:M!IǚHSZ*` gno?×^?~*4^1+<~US5v>wڅfPvD2o}A'-'*`<ٯ92SA8-#ԸL7]ZՔo(Z`̼E\:L=4z+b{LJY~.?1,j*zy6/Q0+0ѳYVT]Xx$r;k&{L)1Ë.A~;j$~gI/ kc=zԃ=jOz2b!L[;l0&maTf5,{HNw9RMbΊqy2Nc^SS8r 0+_W}j?#75c#MQАCtXjzbأeιpQYp`&=vAUlLn陖nC/ض:9ׯҰ-W"KO Vu`9:S`"wXF~;S/UK\@"$q;.Heͯߧ7.#53siw8HROLĀIg|1~ -\x'f }:dFK= qJRw5(KIRH|)T$mꡪP; N!hc\)FQYڝ*j7?k˶#7;` alkIq^1=3mA&o@7;5=%ԱG3aQ aKLl9Oh[h۝;[OrfxֿܙxA3kRwo;SEgtku7U 2_ĦC GEV.!D j8"[ʕudy) vu]B5ԁߔOu_r}9ߤ̸^Qޢ p\YƩC4`#W=Dݻ2y(2D;K@l%s|ߍ;DG| T.G5 ƞY`yy, t\g zT¡q3Eu"WG$*]灜zs& Q\ Ű{t<se[<}Z* uJ#-8 ҋUz=-c':D" X[@dWwcZE2R]bS"&"0.']tA: }~(}!hpBS7=FQ:Yҗ2 1_O!ΈgM.1TQh}`–$ҩb}m\ f}Ȩ-tlVo*p[$۬- 0W_=@(şa), },׍8+Еs"Lrt<%dfiw0w[ot{ ,| EnjԯBmrO[kg7H>W+ebIQ+˃ T}Eǹl)( ݒ?0uډ<"T_ `(wk1VOBgmj^Ox̐eR+2Z B,:JovV }3.qj@$De 1`tَN YLik/fi?D)݂Qt֭m֢uhvij")ݣFஇ.;סJY| .b*C.$+Lj xsݷ S!'sR7y0\RzwH^tqB{\Pd)yƖ|2ԄtUw $cZ.CȠ K׷Q~j*Iϴ1MUNI{jE SWXB&ڗWy/CϫoESh=0Uhp5G$Pyᅄ?-:U=nP'j֨8k9pmnW `w܇fR=LZ2jկ1s^LsGgT3͋w 3 2ऒ|u\ @&6*`A[o{X<G-#IE §d:CznT% RM4҈k="ު?#"_Z1g#QH! V c.cxef܂RP㽬E-:j蘖2a nqν̒޴_cܵ{GMe{qRpljJ)Vh }MkJhd|G[7cR4921.A Nm2wLgz3MEzF&D5?zr@j}"imP9ڈy(ٞl6WsJ;B& 2I(8B>CX/.,v;z8ߋb!Y@>UF .̋'n9 0-%.P9c`i89y1BawONә _dLED A&XB,E=%FEY}c FgO4^tqiQ[IW Iڮ"c@3^r8P*L1o)}O 0`6h4t#y~LY. ?"\0NOBTCsϘ{Cpc#Kt/ `Wc-iy˂إÎ}| cO>S= >R$q (|AJ{0zK_(4_VD˦o  `-$"Oqm;k+z7;5e^=o.\AZEj+DJ-z5$&r$jfaMb" T~ϙ*i!dds8V1/ԏA/_}vK ?.},%h\i,~

S(|׳ܸp?V+pB>"g1sˤе`qN€*p=6dG dfO=uEw4|du>'!r@y Br%Dw\yf(s͸kZf[|qWO84WV׷ vv;O|) jU{눎Ph ̭Lw*f%z4ZKͧk_ PR@p zf}+Y_xG]\\ګ#g67\Jvk*)0*7s:i-gXnQcbj<"9Dvf?A1 Y 6V-ˈbX,h5FTA ӧ@&A`llfIMInCc1٧Q¼W0IK![2ЗZ|o 2ӭjEt.k^ߝvoBE"Lb}1GT&:"2-ݎ> KBAU$g˅V$sVB@/!0 ۤS #޲` !u78uH=b F_6 ; %=Rh`HiO"i8;2!Nj~Wo=8꩎JةxIDh#ve)t-Lh֏06$D0C)S೺]ĭ.ixpMxZ][rM)x'IXNuόHO!CշjdAu3!nX*?l~rKsI=Ru_)o !.@kI:Lc8n}wE# ;˲=`WN,&2{"+n,=jlS,^$`J;onvD+PGt}З3{]+G1(9v'vV(-pj6(20/ Jzɻ̝vXUG@3o|q>0ȳ \R?4F*) k4h_j}N* Oc,D ŋGP?k e#=qkol.LJۄ$SFF8η 8`XHju SN R06/ڿsjcut7 $:bI4Mvx4ӖJmZF`mK^Nyqiӟu(V NMuR%O#^2Sm_Ҁ}y{`Ig %hm*,KmAՀo}п7(F]\P(Ⱦ9_-n$DٷMqQ\|So} z*?Ʃ~n,HTud#ӛO=3%,$a̓|'pL,2>YJ=y8-%%SU~> tOT+FLSəlf۱{w> \itЌª="{p[姁 B |Bw!xCm3x <#8V(T4dw⾂RxkTf] eyz846+CW (RŶO[Q Ip`h]d[`t:X諀 V4nb"A/V"Ҙx[ɂA20+ÌLS饮ZŁ.At&zyCaXoSy3b(c Q[UIs;,[Q#]aZ ^Sre[宇JyDž"0Ք :A}ܦsEUdE5<PqUxQ!^}l2>b?0ױS`1H+#G)|ا95mA,B5?> i#)}1sEv#^h)e%ՙw}@EcLK-%YAb8Vy3No?ƲȬi`6BA[8zWS a~W ".[N7xCMЎ3q&LqEc...[^ &w7t [[mכvȰJέKloiV  /CCzW!p6p,Gdp(+V϶)^ |g?(_NUsU! y3y@1J/tupJ|F.$FݍҀ慀.=widdeZ"<h;COD) VI1Hknc:HŰV\uD0_ȟnM#`pȥ+c,7U9@Rˑŵ V/Oj^Ӕ}~ZTWQhd~gB+szBj.9d:|5!|ѴH8JA,또\Dѝv}7QsC{tdL\!t_~8\?j 3>)d?7Al5|yT8\j InQ=sTlj6SU!/Pb-WRUNگMIԣg:X*1EUdtea)݀lU&Vt.%o\*QRTkL]³aK~ڵb@$nb>!1akKOLP|%) CߙƢp2ʇú6*Rj;t :%1̝EAweg?i" ãKj-Ϸcӫ}wb@~1fS+CS N^bMC|e}?v!z}*T{VoŚxU\u㷚)Xe=iFtl]!CN,j(4HN/+++z{VՎl9 9aH; |V/48^%&c%tbkHU/%‡L-qVhU. vs [% 7#6H%x}W} "O/[ogv,й/B׬,7::N>KWb4Muf1#BvNۀUEmlr׎)fmd,k%NK>,%#`Jù,1k ?a) 81P:cެ (}ʓtW5&Fej4Ȋ^TT ͣr#+u%˰yiH<<.:H61(ӳNvm0eq8.g9}gfv+ IZ#sܸ-B%:&4= sլ IEAǟMܙNx;>B3 6kT/{ UWIvJjt[o=u Ɯ7W/"*EjZ& L`|d6pL"]pOFZ!o. ' h,+cTc6 o0kՈެFh_SC;fM=[i^9:0C=㘄g ,`Q?6.OD KmoA\kJ8g`DZJ /HZE2@e\Vr (hrIp`0,+8#3>^cN_oO$sWjںOY*xlp8E|ox'b=6V'z+b5ꨓjUV(bȭȔTDh󄜜}:LJ|}tCDV~/vi_`!UpmyzꚙԤO+(aI_4#J I^D$Qj~rqv /z6> #Wc? +JvÜٌ8i΁dW R)%m2 _h5Y4 @p&C ONEH]5E )8p rXI&7Y[)t]iZ5yiV`bRP'uF ޅwc._$i zrH1Z kQ39W_X&>k1!i4EPĚm2.ᘏ5iv}ӡD0K oM߰TųhS,.IG[$HtNjMA#9vR7w"jBhnvrPe/{{ʲofĩteݔۛ_( R 2t,꨷[5xr ZE_%cӮN1ϻT:M,DWBϦۉN8ZYT}i{Eyrn[ tPꘒe<7l,Y{2(Zq!5&*S6Teu0WAlK,yXc#'^x?Ty!7~!sһ=STڞ([G)XeEdu}*'lɘ"?(`!Q ܷ?Ժz|u|^ ]Lϳ $GD?:TE{VN}L$'y=#E-WʉsRKg>.̚{[V0 [>594<!xig,ˬW;|Dq< $#ÖZ8&]YH~4E9LHu=Qa~a6X8p-TGFߜ2'yO*m !PF@GOZ;adz2pG7YOSCĖ7͹+Ā_?v3" 1: üê2q^j?@s@;MyB[95 %"Q~NN8?ԀCIԹi]GJ㜃Q;8G-+&%k-$L.Ml61 LXRoQdᏵrc?%XlBZNd\Jv91 p"`UFT;>2ơ!F:s wpяVp6d\hD8zwlx6{|{O󆊬 fk589 OvU^^Lzξa'`#/'3+(x=|/e)RHhG`W_~f?{M1<0%}3Yt~fΜ"iu~X\GP{XjF҈w^Jlj"p-c#L5kD=^X~ C84>C޶39D85eC%L藇!&/a?Hieτr_%7V&~܀LnrVW>`bws8Y,pGJe #f ߗKn뭢Z)"z0d6MpƆEThda?SX5xEAlN˂W˧/?be1O?PҊdw +=?n:VIcP 1+)6M"՟`糧-ȳKJ`|N),6e[ 2d#͞,:ݵ6tP:.)2K9k~GJUV0їnn-_ ؇$_W6,Nj +kQMܳ  :a;VYڒ=';DMz{| h)1t @g{Ufe,2o`~슭QW)Ѐ'֧sBAź.W5_:WGMU+]ށe*(?lR0RQQK鍼&/~;Y) D6fjAWHdآZݡC{ɏao&U-ղeN{HQLG p|VpRa?U!HtGh1&f ]K4i!c,~7ύC9c8>RY.8廊7r3 >$7r8^(9 'o~ c_h]<JS⭝#f ݓFP#9Gj:]ϴ/QDI&ת)fsߏB N^T +Kv΀5䂧F\If 2j/xAmJ4IZ"O bk #InӻR 8=ud̸M*!:<+سIΓj 2lTrUg@5Ckkkg%'i_ab~+/eB?Ή6j*x/ `I6XJB4q:jPP;BPE Ǜ2. <u&>^IٓGZwVu#6ҫp=7Jw#CJb?SQ3)):`]c_WAs¹# ?˓Ѱu>yJcqSE#REz2G]llu\5cq(G`5R+V^ņ> P|lFXwyw-m*N:/ BWMY1X 휠ُ"MPehD7?(Ӝ qsTsxil[4 4~6Ok3ӫBQ;dN[oxY:[ވqaslnj EtNfԖ)cG0bҰ/ν_<P03}AVI{y(-{&@2rtjl ~*mpB x1qriԚJMU4$&mtq^S4Oa({I3*6[9 fI,iz<;z8']5369(Fzt70\m8=A htIG(?U",` rZ!B9 ?j0 #pf6 Iv4Xg3 XP HA bXttE?R36mĆ֫S@{#%M'WeLX,XJ|)xj0P D5q|;2S:ϚPwّ 6 '_ϾlF2]L;I2jKޛzRLg*y~C@ѢaK){Q$SM#̝w2#ܥDguuZ!T}S],<vB'?gݜH(B;甡b0^`Rɸ^eu}[5ަz합!ڐ8%;\}]ңH!%QmG-{f*'g_G&[͋vXzv,lvbOz9 W@Urр?{{CaJQ-_l"vUP; FSmC=-U"4Foymጤvc ;y/(ZrQ3Xn!IR5#$=,(eiG;8J(Qzv%!3S>GQ,6Hȿb^Rߒr ,W#q/̮/7_2řIWA(t٪ 2q?]JenhNxUP;iH7dD(!g^;^ (3^ePu lc%T?r8Y$)zn+3 8'm/VҌib}ܑR:IZ?OUpO2 kkU 7xi:0"Qny7'xT[ӁsL>i5A!$!GfV<(­*t8mie%0mְvYԋ,k6EZHT;l͉~OJP~*M!b>ׅ7) 5L?$ .ljCJ;&5\ъ\;\Z%9|]0>Q naY+*/*YaQVLY KӐJ#`V~k Z@[d ߹oVRl6n`<eItebrt$84wzg]n<N@{p#'[(#@ǦX9`Sn&M6en\  |XJѭ iԘY?vxgYY4wOq _2R*dlm?1Ӂ(kmܸ8즋!e)?̙]}gۘuPz3LﮔZ[2>hH//9{dGj|1!qv'E^cN`ά9“N:ÿ1H!3P[<0m-DqD?r5](ڱ+~wXCy-ɱ[.ٺ>n ŵ_w7.f`dqmAlipx=(*Qf9u-Vw.}'F ך'ߐbO}UtJ=C vM^BC|s,u]J5T|~-ORvOBORDt^ 9/P u Hq ~75ԟr0:HXUa, 48&IΩO>a>cse?ŋ֖-Vr =ȭ fj9z5KSh0=`2YbYѭsN:}}ZzEir*YA*:>;ҙ 8WQޤ9=QOuyʲ0ME&T.ڋ{A. .T)9y#i tR8"&JM h,]/w[Uu߲]x|(  3{=/?/bAQ5'!''>}#BFA%{&u/`!xշxٶ%15,!)yð̞mWl%j Vn_!I~1|lA]\w%@|]*|ƹ rX3Cx$;)3W a`\oiئ;49$t.>|L>GmWHQMFo>QtX})t#z)''.iX=* ?3LA0V@*9۫)bŨq? ]ͷf3n8Ε5QJ۶,W+.9?T=B ]̦ϐgɘU{PKXb/a3p,u3T(Uo&eD{RW|am'D)e"G(լO4xWJ5SS[cXnT*OT%Cqq(%)$+{ rIàa@-OH7 Ra鰑j-)t>ĝ,=3u&LY@m?C}-;>V08微MH.5eIge*Fi'xe!} ÊV"}j'' rӎKtt%_.͕}}5(XaoL 8o4 1L)rEo*(g ?JlBJAyTC^ {4}) ϵ~s8YN`š>XtJ=\Cqi\v.=;u-3rMP:j=[Uc$$' 5 P)2e?4dҺE_iywOvFA#RRv w?ХZpo cs,/JfEXE4JȔr+^Y~O,ƞ;T2 | Cr~I;J$QmC 8kAe LzR`b>ײ]~fGdO!F.|5Ʋ}[Fؼ8vO<^nBCB,m>BK ifQKC=rBQԬ0x6m۞3H 3*B%d1LXAX|L[J& (°v U-u=f mJ5QMPr9.m_J69; bP{_ko(Aiq0w EРwÜݚE/a+U9/wŅyyO:Eqb-U/8kVD(0fFin 9_ unM蠂uY?aavuD uyzy0)Xn=+XejKOHPBv)~8DG|x7.Er_*/o_p?Ț@«Q"3?Z}:9Q I0Nk?G=3a`X+mRq 1+CX}gw<v<nv.dca7QxuXlb1t8#+?ۏf脊)2MwHhU:h-}:ǁ'#ּ[0gbεߐ䁱Gú{BuF|8 N(T~:'mWt . +&skj 8J,@|kh+B#d6#kLo%f7F&quiݷBY'K5N\sO dLT|߿sQTEpV%qP>d ym/yP ,aK+BbGZ:mb[q/աGP= oᄵ-M&+n+Um컅3>z`b_{"_F'Rk3[ean.4#G%o3ϖOp:MHM.UFGmT{}zP>x{k;LR"oɏ}<>6mXjL׺5G =J(*m)2I`j9", y'e_'L]ZX@|9H 7ۨ?X3VXD'IF+b?^m̱_ZATQ6.Z< ϊF:L@/@oRmGxb=7!7>XCoT0k*I]]u ̰NzU۲CͅO8 _dh5-K\ k}9+ ҥ?n"@2FBNl<,wq55xQڜoʃÝT@`b$.(Cv20q srʉj㌓1uF0h7wpc7Pl?ThM0l7 ·爂Y' *2Ymr|W'7A4]z eK\pt[AB*^..js-F[MY,:( qBAH,t|%$0v aʟJ|j&-M'|R0wQPq)+q=cnp NUz3H'meN֪gg Zi=^ҎQ1GC^8_C dKVe3 *2&3eN2RάZk]k_~Q !$eX2Ҕ]x s%w]˪Sᘬ\ XQ߂λCG-y6`'\H]t|^JKǂ=Zu0k#,vU~ݏʦ!}6,ez^f#M%v2t9d^4򦯩.Q-_X%wƗ@SH#7eeANr [oѤ\?: .-] q;*֋p3c y8 Pzi[JEA18$w!RN.> FKi gcɫGH#M8ke׮=N;wC8wǤokxEgU>v[uK#R2ӂ9 C(W;X?"ib- ?Z}BD<{&_lY& !d]=LĹ:5@ǝb>\H) @ӿp/ļ\Di>tQQƬ`CU|XT^5R ۬P jgԓy\Jy|#&Bh%`g:W]E  GE-?v8?2!@:ᓹǮ{H(QÂ~&ӕLxKA@g퓔kiU وKPQ'Rbۛ،kCu`!?$U.).м[A=k) [_1_SHQ(4/T,nlB?ZKZs1m1xO k ޖlMxK?vVR>m.t<}a7മR;`]t6:/{(@/ΊY$9ߓZ Ƞ ^[#ێ=J[r6tkAn[YjTյ3={*horvtJbEFE,45 ",}#iplap|C~h7;j"F܊sRTԁۢ_lV}9jsnLo+ˣU',nَ}Ȝ}͑.Tr U/w؋Vp{@H'abi+6F(a?WW=Efs8M@ 1FRurvKYpeu-YmC[_QwLl*^޴Mv96h_}&m %z_Ӯ2&~WP~Pv lF"+}s)17_n҈/Tq5hJQE?]Hܩҩpd)Ah+LyH9\NgKbfz V,8!pe쵪MEB >X^Vg~B#ŽČ]G9 {RNz8t>5&EC5=ut}}m=^n 㰊GA<4ݎ ~{]8oY @Z 6xB}*6ϸj3A $bVP@ڴs VG60A T)7}w)U6rlwފ=uL7{cef G~j20q%3*<oT, : 0OA 7kwfh `lƆpʑqѪ:[Bsԭ:O|#0`j)YBx^E#,ryQz<_4bOI&$L7}0֭;zO^zr ]ejRAe嫲Ϊ~7f-c]Nˈe=0Xvέ@$3PDR)0 {OsŚ (d_ 6}"1X%:12Lw{UdA"];yr?.Z;d_cs=L*J b > M64L艾M;]؏',+/O q}!?ra5oA`!X_ a%Yvw124.7}p.wɂ8ȳS~!(0D5*{b݉5cctkm:ƬGՅzzbq='WBؐr5R/dppG~?/"THt'~kp'+Bk&ѣgLS^`;}J@ĔyH1s x}{ŻBC{(?SH9n%t&XٛCN>ލ?=cbUtQRvꗖ;Hɼ+_۳|h 9!hvC7j>sXBtU;h6Ux%3f1Pܑג7s*9p_'11gTЕK`~zM"u<(ͦ3xF&ak\/HSٯY,-UBu}c T"k0{,ol9UߝWguBYv ` W;|P4\bmA1]?\/C~"ͣP8jEBRLK){JKj"ESSw4|O>};؍,[2$i^JxhAGף:~ex5hV{e|*09 #Ut{ ܬZ>x!L6f LU(P%T^i"qK y.o~P*R*c19ڛ7e+L7e1/$'t^hѮUJSL-lF%w!_·,{s uJU3XiH #BNE%huMF;kb*j/u<`Q v'Ӭ,fs43b3+nk [nEçjJIx(z @ڼoDBۚ<I1 @>Ӂ:h ) e#D%(1T0kпpX#z&ަ)܌}υ=]4kFC"gɏGrҾ{r~. ٗ)7VI <BQR_U+cGoKw7 eoְsvXr:O:tJɭldEoA6Q?Jpa9&nb14WDn[:Io'(D?l70Mv2k1Ԯ++hZ (g Q}%8?s;{'nyaЏ\TܫB%M>+na(TJy@-j.Qd`k{<~Ivu85 F\[e2]3ā>ݼyϦq{)d Vd9/?d'/ ah^d%"8>{ a]L.ɓ\!f}feRPOxsg T}/t&ɘۖi&83GRP-HTs F9HZ |q>̟mBy<_遲V5 ֙@!iZuvJL 33>ŕf'sxXқ f J)\5c٘NWWXBrۚu~'~Y%O=CƠ|F ݼ4T^T'YNDM [Ŷf">vFJ`Elac*Js"/-R*ru:?IC߹dVP@JP˝#[lԧ#$| EE-hV n|uG[0-{<7n㒿iv&|$R)l89V7cxQi T|R*?Fk/C Σ٢ 1sjOng&of; ҂K'wgōY2x$ u7;%I,0k^˗S 25-ÖeB\qO*n d̸3Dx,}S"bz9q*oāhhZ:!tC5-%Fqz+? 7ŖgQ0ohDbxI&]ݤ'YV`o sd8Se/z_x} 5䲑y=3vX2<˄ ~P"\ixSZ~u"} ECEcYLP< ┯r`U J僲 "}H-DD10۞|v=ؠt+IIsApoї˜1Nvpl#=Z RBt|J/@)TQSˁ$ l 6Kvb8gZvKBm BpJ;aâm`9|z2zc4 V)v f= /rS˳|EE? ]%jo=G?ސݮj}TS,I7UJ~rYi!,J+=sS-AB:(>qyզ^nNUnEJtr_+bz=lοd\7\SPsfbd)</dK[#-v6SYJښ29 8w FlS?|pNw w\8#mU_k/ݺaVָk%qý|&^Q j8-?}_:_R> FEWozԿe. sGu떔dsiȣǙ Q:p S.@6t|mUתJ +HuM78e#W4%~CcTTQ{YA5-[{ݵ|;*{Rh\X3F;B JG[P$K8E FT#Qj#%N0O]KZ_N yd@[v|k8Z>; Y$` "\;6ȹףﯠn!UMeEÐ\'P3}Ŧnf.a f-n)Z=';T:n"˃t';RKSfA݄{ÁYhFwh|h"EVa3PUL@nIhvۋY<]f8'Gɐ@m↵]ڇ)M`i]nJF1JYMJN^@)ÝԅbHrXiy .{QM>TwXccx$ᏽFa1s~M6(`*.ʑ JQIJdzK1Wqo%z9Hz.oPcfi]$?QVPYs kquG'Ui!S¡u?G\GE#4;ΜfS-- [t-hhw=Py4; lT7/D㉤+0jAA*4e1C lmEf#'[|0cq6 ey+Lmnue*fQc!{}(Gy(} *CwfvXBcAp X{wIR'o^Urv4lpʠoXm)نc>r/Cr yl&@$j䑿I8ѽqM}h Vw|[L(p4D4--(k `87BeQ;uj+fgާ(+13}r&BIWRGhWNuy ZKTO4ҵ٦]"5F_GDJ/:P0s/9NPb)<( /DOsO_iN'RgʀW} #Y쯎#vCW{pie~5mf);l3soWG%~7\2_ 4Όr,+`Tb/[!jYH@6 3R9:Lj87bvis[eX1s`6 Gn0H\30-B8}inpܾVi*t%9vʹJ$>~ " o5_'pݒh<99Ah2Q{v, M%/T+i9\lnKY狔Cc"&dܙx͢ Ŭr1HhCW"n{:MibIr{XSĨ;@;.BnO$<{K/dcᱚGQ, @Ve@i &jHڝ9L$b~GNhM\!d/Ӳ,,عZp/ȥW4* 9!] y/{}nڎF4?u#N~OøBC_72`DP_*lwvRx(S(ttgjx쒏DpQfK@|g&/ɥ(g-Pc@͢pnyWARM#{S؟]}9L3a0ͻO%b->Ӧ߸ n_gHRRͳ/6)sY;w7Yi/CʾXpc]ׂ-/J޷u%ot&=%ϴ/UHl_/9qq66~{uxTk`TV i󸣟A&xg%>D!')4/9tR>sHMK@tMoDЭjuɬA*G2Q.Lg<_mhs򏤹˚\DJkڻ4 9ڗ$ѺVPu2/XtJq+eW ܜ,Ypͷ] ƪ5U1qELhxpߩk0wn>]J)ulyi?/q^[5gƪ$B(~YŏU׿n"L^ܟG W$5QY3Rt7o$ eC4>MzeZG&eo[gV\I}egx^jOʼn1I-doMqf@6DW :%BP&2h˿?:fLÙ}&}EOcwh%\#şXr;X {%oƸ N-P$LɅmchys;k7Y&vdԄT> }vw3c맷|rp1>5&w?OP$yhۦ5 xc]E0ZAìD.ZQDZ˕ };NĆ]A 9!pn߶/<ϭ R ěO(o\ Q;hHkuI77 eu-#I)Wq[ )K:GQpZaLxAO1#ĬT{QY7]" qVJ}}.)7sU#jV~ED.$Np0M1Fk!?J%NK4'z f`xZurU}FѨu^j(gb~n +{a*ayޝgu5!,olߴ57͜;{5e΁u/CfN;=3>4d~ B#.Bkx*pX GigpGGӱIg5]Ajc_qQ2R$>11J9шY^  Φe VL1ԈƸ0nQJ =LɊ"~*CB&9G )Ws,j i#4DhBj{׭ "aR.sjM44 zWDhsCr9G`GɈ8jJ|Q :85rb3Ά*.^R D%9UY*~|۩;̳`%d>W1@[#yB\NRAuZ(aAMK f.Z2=lC/}iC؈i]˅w9#!]odpC =X><|4j)@=R: Ji'_@Bءy$ kě(0֜w)=prR".*Rm$w3po@'A+#-7~PQG4>A8:Zt/s uuSlş+yo%]0׫O;MY7V܌A^@c,[NVrb(.ER%JpU$q v- \i#&ZǡT }Ѫ!V`V~>j|_"T'_ࢽ挈? p" j*DWDr5ڵ |@~g+_5qH'v.'2!4.h{2).7D[6!nf׸j;Y`]և)]6J>-ժX-tQpXO}g}z~$k* ?kmzJ^|wK^ o?31vgOX7O Y&Eko 薇c)d l-Iij"@os"`?B#luX quR׌4n>!o9xNl\zrrۨF -1 TGt<.ݵUJb]nx &/NdϰR%&ωn^%̅<}1OşpB5༏AV2)W6!~r\5-bw\:QvYF>M"_X/&Pab&S3̹~8wc{/.Ը?Zz6.(pOK0zqefUңXfu.+D2Ԝ = prLn2 h`E5tS4,<J^93;DytODg4-wAI FKl+O5;jrW 9:|9x$ ˂|}лrQh8$tz,z9?brG#kDi517 { ٻMr?[On J{ <;yt R'hb$ rh/Mq#)F3E %$MY]V W`Y\0P+C$I17vT^<2Gav邔`LXNtkQ ^w8!(mB sZ Ln<+0c#}9!TX>bi~z::;-S s5E+O^\89DqyY鳿ӿToK\Uagh|Ud B8t~dѤFG+TQ(}ܣ$W2 kxT9wweKjNsY@ԏn>%dɩ!/O#}nYw+ñUw;H ڼ}ĉ|P R;gV]r8AՏ4=KU >.YcrA=2Ptx8}H)nS` 88YZc *Aa`ΥHCuux_u)]!n]˱|D3x";TĹw?6w_9Bb⍨cW+ JԱdJ!J5+@rZˡzQ5P]NϹ/6\ ^9 kffk=g|XY)`ӪD^kU^ԣU[ϴϖu'w[N8,оe+A_}. Jy8 )#bC,p'޽&c=׉6_x$a'KzjE.gYE5V_!7_q|ZČ]?ܬp9(OF[cJdwE]^ [|92IlL}Bxzˁ O}o7]_F>u7RY!iU h"19-X4i`IWY{nVflXr2sD$Cle. a]Gt%Յ-j.nòhPvFB8q$L PAn]lY4jVbPM_a^Ep놧]W!>; x)vTZ>J3QpK rlz:<`61ծUgg6[EOLM[ %DH \(\#K5])̭);+ހϭh3\QP?|-ڦ33GO.e7'8d? }tC:CW˴%nRUH=jA"҄VJߥfgQӌ7y{ViQt;Qjn r mʨpҡ͆o 6$0SR"&9yɉXtqG(}xL,@n@'@/dsVk՛!JA&&$%2q(BrNwR'@=AoWc9o|T!K4YDl*?G1 BK(٢.0t[I_`ɏ[@ hX?߆S߼ rL0OU?$WpgP۵LSe7LV&mp@ukB*@&W;d? f?^sS )';*HFͧ];ǴY,xH]-V asOR>۲guaz.Gɖo'Ώx֫/Fƻr8L~SjRvRaGb""el`Zs=Z!2^¬H'4>R&49[ϲz"}9Ӓ,tH"ܱDm!&/g5J_$f7]fF I fo|NS 3̹b=`!7t"H+MB|5@"r&H]culsTb:=Sâ(C~K7 !(Dnw)ՋBiHzBWP8=HsJjjoi)3A;j|!T.ҙ[⌆]MRK[]VjJ&`(GinSww1Yi^/c8v ?P?`Iφt 82BQd-YG6r<,Wk5&cʈ{{Riv/%35x-A#4nJ@#pN%EBlncpDxhhQn);=Ix^dv\ ӕ=_Rl>3FZI, {\@)h^y5%VLjGhc{ A]˳/@I -|4z},?h>T^qRUEx)RҐu/ѐlck~9y g6 UTS`}PbB¾7nu/YA }>{k$05+2B8+Ո}!%K8e%`?miEV)f Q%EBTt#H=8Je[/{%n-Uc!u4ِ-~g)vTh`bܹ$v>ɝ@t&ʘ.y4f3&KEj`%~oOݱZQ'x _1ܨ/HgYC}?̀¨p'!8c  *YcI`ٸ1(X$eWЇ=3 آ òo)}O*?s"FBnbձm)|JA=*Ri7璷kV zTRKժ*?/8X]йWVuEl̈YCr>ps4bŊlaP.c'>$Ek1[ .S`tR [%MY*'r- IœTP]ҩn l "Y3DrUFTJAYi$NԜp|ڃ[`#>O)hX>7C#"^=Q祛o}I֘gAޑ3l=v;!v9QP"L;p'@q&[$$˃Q4`3<WsAx? 0?KRz*5cnԏmz/ʉa<4e*0eT; ;Kp<3E; ٽ8򻼝]Xrqء ҁnB7LiPAR]ewtLb? vQﱗ<'p0JJ$"z2pf}JJzs3C~[\NF_a}d =9=9i;/i"iC3pq6$L ̖;;8FSSGekvaA (756\jW fWoU[ (ANvBoǎ'AAa.smq\LVH ( T3VsN?"I󃕝R9귬<6 +=|Q6#.r=FEQHJESIHNX%V.GZ50{',6n?|+IԥOiQhp +2&ohru!"ce , ;m?.9g_,ZM|"h ,8/Յv3=H&sSnӋH.>f\laŴdt֍{j !O.oVطCZ)дcfSb ((i})|]#tM+MabWP$S).m5}+9 l/`"HԤINK2$˒ x̋K7gxRX kN]egt9JGqBw碃K MI)9u ' F8 La0w`N5g%8)}#=SF `6HD.+L\PSP0w֡x1ؘy$%:J3dly y e8e8gɂ-\_#vasi' -]eܭh9Yax5A1MC& =~@t*dM!ܪayy͌ߵO]vAFBW U?ft(,7ڏl8Nj!H%3v50W7ߦ|şճP v0%Jd3CI6vhF!ROg@ T~D|MQ ^w{fB)!ׄ:!l oZ 87*qN0{Z/o8c ˜m9u@#LE LtՅesGggO9NmdȠ cspl<Wie]iVf$/F)X6q''few8ty/$M@oCw?-k͘:ҜG/s>-(hQ Ti [wE9_G*\XgD7YȨe &Ud)]0~^ f|,Y '(1\шhׯze!Y p@jm ɕ/w[&|kB!0}X||KVsC= }4yy\,P\R -ol} qo,d(QOKYČĉnfST )H' ]b-^J״*[`M޹Q{(D+#yyYSEkrҍ͑{^iNtU-y|{A+d~F@+0G>H=Q3hz; 'nZeP 9"W`_ȟDVbWT eJ/likળ_/sяbל^WGCO*fus^^Eة" f9VSưA]yǷXq #[6ХNy7<:UW\&F]x|pȴ^Mzz[WKH 4ʛ211Pdn#l{^FAK{J^ )mȫ(7,r`f;VArLDզ]A-"ÚUYlC;9r rp6F\wZs[a  fY%}K VpFuuM.V&rs jQIP1]JԈj0uiN?#k Hg?X~*G) <*! !6 {C< 7\4~A<#c aD_Ю`QS"0ώPvq3yMOu# F/%&4ݶ%5pOxXUi й`f!9>MiNf5}wcc$sj ^q9|Z6Sϐ? Y D3ut!_Dh9;r !hh#[;HÎ]F x E29&Q1Iƭ"qe2aJu5I' HˮLͥk߻{G!Is'&Xxyj +gwryʰ_mvPm>e %\)*F=0[=Hh U5l9£S=FUϽ_1WdgS@I ?T3‡P\x- 3]OBͦ,m݀|ǎr/Hؐ/`Sڶ75]2gvtfKw-LJDh;RjcxKeh@`XhvuvwӼi8/bBI+;keM^KH |FyT'}d gG9TŽDkN'ƏeLJІ c؋ +p?.. ùY$lGz-Y9N72e{K$wf"T D!_s:z6YM{Z%}P!&)e_T6MҌ|0rDyy H쑪4?Ie\Vr[M: sˑ)?˼1S X JnXVݑ1otC3 a TtSN(ب1M Iϼ[kvEowgV11A2=Y(3vgcɓfsΪ"3[;xQ,S?>oSHHzͲ Qqy:R$սGtmԡbk? ^ڗBReN/[CiYD(?s4- u0!WkGUIR\>'gkk:Xm|P9'L [wP&(?CټjϘ;O$`=^z9ض=ڱF߮H !?ƕ^٬BۻpUH8>h@d3xO^AlË 3pFe'[ 0g YV|^nx ߯"ީ@*@`cxJ:B ώ$Bٽ ?Vi6ܙaĊ[SͽChK]J"}!blA}oa[5i̋iG3%AW12ʷh85}#r6i Vv/8SݨuҰ-W ,OV/™˔IÃEt+n'F5)Y4Ѻjlۧ.?=?cf?^4bL[ wio0YW&} `kQ۬"˄1hF-aN 1eTbBp]BMA.~6?Tk|{dQ@"):d ' A׋A(SJ W#y8EL[+eq"=:Q_4.7LN^V^*6Z4~et^>PSK.$̪# GSD74XRo{Ĺ=O>|)8ucGOt f-Z{ũ:Jxx\7slU~HLY}X[7kT0y4`#t7h:[gN~Dgof  P=gr*䟔l !LNVpUiIz9~&ĕ:Τ%R7n|I{I TPb<]EM!&pQUIULXm>2P&OrN#Ec}PGY^_x;kچuf߻G3 cj@bHfb$({'1SBЊŃhtFwϻ ]t7l$Gfkizƃn ^[d!"LŶlZ+u /^QTJ_x!HP&εL?iqOWɖU<~#R iUzAG9x 9Z 12e{!!j3#}134Ps Pq=׵/ip~AbsBV[{A / w4%[k 1DD TEo1zɓ?^NҘ@$!i6YCV,"&uKd;& 5gTx9Wb؅ aLd>Vw;.Q'UÌ4H*Xphd-ֱJ S}# 1dkQ\ ErPk:HDA $s-[Vdd"$F br&xKUCAcCk|[LDjH*"mv2|[d0[j*AK>&V/)r g~VMMh*lȍJ~_t]J~g0a&_4|VOb >FחrBܝ [ZذLxi[Cw].T%h;S(K*0BO=8v@Z^S3Lxq K0ł j\;]tJpDCvcKFgK6quRiI8Fw1y͜<}Rn鵑?}#t-M=Wat[C*Sj9Mܧv H>\@W%l6wFszH)CrQrF/0)x. v{AҞ:\ -BvP> ̼0#x&=lLX'%#z M"Ǎ zjE$)zp?|4XT;mI=05HL aP:wP=%}xot"bA]7 ݊xNsiPNS Ėvގϥ.wL(` `ʱoɼWiPTEVs"^Q@c&Āy z%y!v l*=pB3H1ȎhuyoK?-lUC!nꁌDKm_k,W7 sf1`;s@3^gt~vApu:atbdx6=3<1-[j=w\;6cWama ^dL3g6ϓ[IGwZR,뛂[Ym(\"/x|BZ"i1PrFAw1#Rh}#< !q\^ qV:~d=Z,͛Ser<3asߝ؏WXxu̱*8U(ix.}ZJŬԧڕ-G1Y&CF9h,r7402ǸV๫b Qc2T/(GmE,Tp]8f""tL =02ʨR&SBx[mmk7=>، M&qlyGL7}l( ۧ!G"*e ߆7W]m~hb*M &tHy*"LkO\I`nJKOU!A_ 벣݇Q M Jw/jYLX IӼ +#L -SL3!-5}`kS_"(( Ql%x DuDE%N!O eXhaoh >$YLo-3rs秬\6)ΊxM ծS( 9=BgI]͏[r5/KyKI>r; IZvƔ%a "7mYC3YTahX;ΰq%HN| BgH!z[>WDkL$;-ڋ] <cuT 0g py( i 5URII$8 |\K6חһƝ8ԮٟҁVUeӎ;G^("JDj(Tr_ Nޗgi&($scZA+}5T\tkL39{XJ pվH8zex%VQjvvG98.\ɇT aLPF/|_E_[Ƽ8_lU䤑fCJƀy ]7]@ 2XruO oY,24ǔ]94(µtQծV^j0!.[YÊY`hQ KDx) po@$95 eЇ[*kN;BaC-@uHkTBjv!Z$50RQm.1qVU#I&˘ԟ4b}$IoPNp dWq6<oZFtwƩv&[מVyFd3|xo 1_/Au 2|HIUFw:# b \Hbd4!Y: '++I6MUpZq ,s^!p{% M ›E*XeˌtvwS@9;J^ȋfM;#$CZĂSm{xRKF؁|K%tDK(+rՊSO < 3쒌dc6(#b.rmU* >S7ȾCYhfsMK 8wo7VM'[[%NssQkjW-mNGpՕw$2(m̼x9iNxnIXlf3vŹ6K`7,K  A(Гo*U<q8;wI_6Ә.ƃd ƺ4ҴQ+OR6YP(y!f}F9@w##mT,k+]^N/.p{<d7l_ߌt<= aYX@P) z E'w)kɋr:=\zlG= Xa z2<ǔޖ=punSI4nPUzEQ>[jGz>S2 /X8&,0yNyiN}x-^&#@W-3*%b5yPG#$<ԭdTc{?wVfp,f+kBpt\6DZIj2\Mh-nwDc\)oSDB\Gf]f;:ge5Fe4  K`ڞʈ])aU.7Kjx ۤ'1[ُ{~Pح=->BܝuO, !(/9t|^0A W%C"B)!q:8dAިdƯoP|`xr XȄ|9/@G7iEc':VƳǦmN4g2 !9Y+y -^<14EDz,Ӓv)l2ORZJkGQH FXv+LRHBfzɪCI :y,р 8!XUoʸqN(bĔZT&yJU"4cC:}5nD %"VxZxU2{Բ!80p~O*"^6$Ӣ&}-0`~mYk,F4){"8ۘ.OXI'IM?uWBf=FL)Ho3" !{L{^h FOT`E RBG=?W #f,NC4<&CkݧrپbEz'LF}+`SAWĪzVXF\>dg%1Hwa}oSi l(%m(( },kޱuKo8h#!Otk.r QDY3ZV:s42Z~e ǒ-8*{/K6z(lhT2jsE7_XTN,}R +iH ' >R\g(\C?Ȇc욣c}{ a2sC#̈å\Zc2dZ0)kfdG7 Ogk<B\'L5;F3X?.S" "-ǷY!YiOQKWkjx*~=t|1p;FJuJBl X7ҿ iIxqD͒٭ Kt.$JSP~ʡ+BiHn `‚XմrƩsdrH\rŬ?z/e1P-y,q:!tHW A=MI`7q\l2x.X#+adzvzA-vsۄ{'IN GM - 'hNanJ<6Fb(A7QǴo>np>ܶ:&Ф9B[cEjZK^ b ̑OQ9i :7jcFN(pw5u!y˳!5a{ ]u8o%h%X1'8#-dTN=~L ^i`wtmD.ij`+`z}n&&ekF iS.:*#b'T%z@@fPPejGp=: YD_W *C񧔙 0r뷉@4.N@^.H eC g?0mTߚ zD1pWNfPsR}j\in WyH$Vt;ۄlhWNЈ{!t MRȕb`U>o2~0yV/L涣ꭶAVEV+)9tzv/Qh!唊;.wg`Zi* F`&VI`_b*rhW(O,bmݑ+eaVuE;0An/^{AADN8مdCgt.s kcFNLgm@ 8Clq a4=kFTkqgz|#dMt|а܀P{LΟ _gY.*!d2ųb媱 2gO܆өW2(0~X ~ĝ]x\fN`D=KP`t"\b vd~ n&oN>VB (ꫂUEˌAܥu2 01 Xd ͟;KՒ:CF8ZlHRʭ ]]\AJ`D|jm|QD}`}~Ⱦ#۸]AdZ-!iF>XC@f &,b ծ3' N%FcLNSy6maErA@hON/FDb9E{hrvyQb0ׄcJK6tw D*@+ߵ+N sA<>Uk)ms-"bW N,NX@j*/A׿zb Au"*;TYDkxVD{|2K ®_* IܘM^ФdSjG14;Z+DLT5_.jͿ[ _diG67byWd90KZSӥ#E,] ʓi1#_M>>t>C 'G4r+NfE=Tu^3I #G hiQUi>R\|$q!j? !H {urT}$wZѲ!a@ORЎw7EώǃpN5ObY0Zڲ* TzAGc3 -B|^^nE|OX`hi I|P(>a7 B5b4L9|mG&Rnn%^Ap3#/:;*cek1nz'!%Bmm@6Y -0DDs<' "3S$H]Xw@b@*UAy.qIIR[ۢ}ķRm.X(̯߭_T7;4nmJ^C(fDR!eqvƤ AmAuϟ4X#bV4~Кnw{%4ٮ0di(Uae=C5>X *H秌wt¾1=tBj?Em,L|Bˆ6 k.x }p>nFIgxS -;4ǏuQP;!ǺeC'# n9ː#\.ЈnțE!w"nGel`kܝdy0J&}T'd= :2T=%(AgP:q4i4ϖE >UQpzٝyU ^V篬^(ˠNm}4(5bWFC*=l0Vu'{ <=D\6Nvm}00FDh*܉ײW~dw!ٜKy:xX c+䞸n-0J3s7X# 4M5vk9%bے_l%I髁W+7ȇ{5?E&$ *ya,ܫT﷠_n/E+7^f1 ð1Zک.tu]Qt.<'9&fRJUcQQntS&4J{/~6U<;%O(1T0+/}xxTh4ОPqm r>d0~c<Ew!gVt~NCG)0Jgi ԙ[Y]FZ`:7];vg;VX&^+j|ÛeJ!yN i{CzhVMI;mR6;Yz8) UNA8o‚B,@x}~cz֢ gzZzZ/׎Hfq`O zM^'K]"jTl꺦,m'i/;-Ņ=^rl6 My%9,#S|=$WƒUg%CILb D@#%δSHM| QQ%ԡ>dMriԹ/tY\ɨVZ {`>[xm x$Cv&um<FTcBcaBC A΀zT;MoJݦߞ0Uf4l3q-EٮЦauPmb:yl]G/;vԙW°yIB#ࠓjU{r9[PyR::՞ sh e~c d<2d S[X7DMR7 A/ۿZ{́^(]V AH!Ѯ;ȯ(@J0zFCPWG8噛-v>ih!YmUSz2zʥgmT V \b4K E"F8n4{aL,(k$U}Ń4JW4J#}6GԶVvT Ao(\~2Sy5"L,!F%uG%q;7|oV6(XwPNQͩHP/u%I|3V~zcZۜɽD2+Zǿv3݌2DzˮbyLGC$k9&EZ`pQ^wHFgOIHzKx /Afw9X`ӅpwR5(SBK07?!&R'H>~1(D ||=~tME3vQ+dmj1x{PH-.H6>t)p`XI!2k*Td3mWqڤ`"L 3j$09!:1O(P}` _H1!#ZuoiPE-I ?_d}UHsOWBynC<\޳myP'F0͸ólO%F HHYAhnX@@M@#yjSD8WBZ"sӇ}:2. K+=Frf@%bJz]A!: /hyUpoBcu[]B|v|N+ ·j㣙DJb" w'9Lvrw pZ_jk?P8: Ay0x5/E(x>Fb\5(߲8ׁ %ak^kMk5`EIۇ M,хP0ܨ6z5c:~uCo*)!o K] Yҽ@E"kq# `Tg܊x$3*qX.G#'+ GG~<)U|ׯ3cvjCl^L$X-( ݨ4)*z d<|kI 2E=} e&Π跆Em S Ғ0#UcXڪMɕ}\J16VnXl\o\P[{ 1WD*>pCm &#P%2Qdbuǯ;57So\lSygN[ߵY6G~==r,/ j0vx|OPISgmc{ 彅 +[LX}L-/&"qvA8t2,gom@!.ke':'wܡ1| }BMĵW?Q`Ox)8b܇(,\QƸթ]o23n~Zx૛+K_=ͩ` u)_ܑh22љ/!߯`!~n8q0Tת:O#9_lv‡ 3m0GQ3۷odO˧:)q;pfTu6=pa!eV|_j\qnk3Badi|JQ9-q]U5jFZހDd0>»3]0lCr  "XSJ*zMa&KHqw=1dGy4"?wQ̢\36t^W$3 7J&bO#Lw54iUt[p{ҷƨacz:!)!5-xbێrSzcoMix@=7F˫C#c"3lӸv;@])Ǽbrp։78EC!q!`q=8d~>0FJ7u7?">< do3( 鶺-Fe)FB~5,ELk>FFpzIQFJ̔7vYB:Q`5  HV":eU0-pf}BNA$Ĕ$c i{rdcOI  AFq0%ƽ}ZucJ_K1F8,%?X7t3\0rYV#/&^4"pIBz?~Fpӗ@dWLԨhZβWRYᙔOf.ֲ9B.0|އ/DIMba'9xc҄պjF¯@?1#E.1GՐ d{ qlgx1I}s4{K'Tq ȵC^$=+bs>ƀ%Tqj-uI}rXdV{[ L&n"*:mىHJ+=K@ u9ِ%dn`sU6H59>!hl2adFa>bе [9;~s.@2wIP.;k _&N- ~1Wqb;`8 Hj^D3;iDBLDW)-]q٭Vg1&KJafeG )vUC "POAbqgw_'e wJ`-O,y[f %®)e;d r? 1a%K>N6 |9LʲȐ(F:)IiHVqSB o3F2m)5OI4lzl(PM-8b8exb=b4|(+hט{D;w#;{Q F]j. 3hT<,qޤXȼ귤F&go _T]ƅ\ &ac7oHӳwbd7E x.r6<'  xhd[l A Vtղ݈Z4<Cy%U'&}ԸkoB#CLipybC#cz*M$BHK:f.8LLjЄ1.~,q%oJGdZ@FB4L!یX1{rZA.BN%鿋cbmc2QHf6b9R.[F19SF⍀G,< yS ߳ -0& SW%/ | >To(_j`}:2߆3"-n ڮS-lqmlH<6Zf zB寂ƞpBmUԇI&'V,Xf+ zzyDI=C6:IBq0ϛdVSC]c2AuPU(\7 L#Ht :ɯOxvQ1v^%̫V ]lPАuxw:TT-K֑pO'SGs vP;)yڱhREz?g>Ո9$13Cƥ:}_)n .I9skzXHޗJ=U}XKW)P1G7bTQ .J!Ԕӻw'v ׌ESD#8;[I&mlA/ :iq2۲9tTs>/@>ҽWFNjtkXǮGَr tjF2ALˍ☾)Yօl){ݯ D*-)3HExH6,obL6.;E#VȮ7SbNq/à P6֬ZB׏%3}i6ߑ"h;)J|pP';YJG̹nwŬ0᫆.jSim.,Fvԭ$ ߾[%_ g nڍDŽ3IL7j i?u*m"/~7j,[ *BH!rD!UTZ*wpG}N1ߓ_!kSm.@V'˕MipҽdmBNJDя {17V- s.U$_R0t'+M>&BTк&@i֮qډfU$QZ,6u8M5u"- (XN܌IHPu;gƯw  dW:Zqa ҽŮMĨ)ƐY4T 6׉c.0,$C6ʉ;iC-7ت_g9j\mB!JUn^aHlBݔ5+=1VFdB@7c7~1kq`,ot+[Ҷ~ġYUUk [>ƪlB,{p5y()G(p 5x&Žacېzl* 05}rtpau}HYZϘEJ R HGWEr홀%k $h~-.|`\StY=xreI7y eS36h?c'M cƸ/7VhX,bM8[w_e*yHf$V Th'PNL!1R1V1"(NqJ- ,,^3d! xX]CFC$ r8y1*iH(z%\ qKҹ+=+%:@n׸Dw /z l)"RM֗ yL}D3zQ]zSz|yز yCc6:q4^aL\Ѫ~?q8$E(i%EVhaޏd5k?CSp)gf0]o澗jO 0l  N :<γz?kj95k)&K0_ʴyf)piGh>WDz0XZ)Y8Wl<X"XF>T/6Au Y$9p; -3sp ҷ n&^up8@>#{=*?D/\jvxnEsP礎ۡ}d#ֆzk$Z!#\uT#ڸ2DB >rq nW|s m;_t(E5>=$cO*̩M('Ap UH`W'c6J(+ u 609&ǑfSb;lآZ+5Q[MaHH-<[8+ƻX12GtTZ qx{mY5<]m9G}o]%KpsGC .-a(֎e:<TKUԈudv T$eAZ}v4\ %pZDŽnr A_8LĉƠlmd,ZP<\d45 QYM*u z.v<+4q/..e.k4TM1]|9B<]q:< h"Q".gYAl}pTWqLL %7K8Zy+g2j6|7dXÈ,f6|Wi+PG:ߋ'Tݕ MK0&KbnYw@^ު%3MQȀGU=9 R:[=F!B i3F$:}ZIN([ǂ=h;r."М&KV8veZ3:7(h]Rk`b-A⾧?<]~*A#l]qq`ƽ{4?LǵTC?srrd%+ie,Vb6rsBǦ+yޖfJTwɈ2\poi=Ko8J=w)A"*S3rqVFͼ$\.gOdrnbjpuF>Km?{g7yd:j.saA ݑyl&F~ChƃldV %sX^87y5xOa=i(/[rj[ۣ %&Z KD3wn!O,"Zmk֘j)f/ѮDaLZZaQKo_>G_Nx\J"?u;3a~~'ūLߕS[#IHpԇp{RBP :bmMqo)H)u_uqV)њZ ߲Nz"֤L%~tj"skmGG-Re8):!/q`=|@!]'= CҤ$<bwݐ^9l, 'c 鈭ō&mǰ:f_CO.oOԀ߈dX*:hCZVX =X"Iػ /2k/@(J OPv_S ^TN{>[A'|~T FpLOmXvXW"0*o} (HLϖIzp[2P<7o"oX^(K^ D ,u#Un5 5 KC&i.$"iU]\#}$\zV1ċ֥Y5n,Nb = Mclxs9z7z\J]^ $Ms֊@tjvpRky<[3ࣻ w:ء\=GS!V32=\)TϮzz݉7e ni֪F? ߷٬p'%䧞vJ !$_ߜ[T&⚧AF" YH{I :͟l+@*(lܺ8|V""jjn0[VBBqTgGqE'ҜvQ$ǍKZk"ma^91NF\v[975r1p%.vҹ_S3Na J䘣eʎc̯TBy~ |YӣksqAIAS<;/qFb2!SWOG9 _ţyKѿ!yn@j#2TIQ@ָ}#l&{El?lmF lUn6ƙnb"XNQ J(r9V0%}1! 4 RUU\Ӽ2:gFY h}O|I?5(8DBq~+|Vq̇WWi2fy8ٓX豇!g,^HqU͏Ts9Y!.K>]0ꌑ\AOigJ+}'m{_nxZY*isG]^AbӘVu8 {'01^YݍӃ -_ӣtp-C0H,vhhʹ=Y=b`7h] E(\#S:6K,nS QPVTЈ* QRX"4HkA _2(ttcX%5(Ha(pQm㗁h/qmH~]O!qr1Q‹Ǵwڏ`xف1df? j'wF$;1]s>E] Ů@mZUPF|xj(^ۻx&ho'E p JAU1fxw*uDĄƙ5P} w}T/Qp"5=!9)#{O(h֬PLl\B q4+V[|:еQh#If ̹(UJُlP+;%Vjl=1xx^PdJ@49֞".Lgdoss, ӈ|E!vhM %BjgBYv[22^H|I^xs'2mCY%+g{.۰Uolb_ڸLV/i}Z*[ҿ3*۸ÂP{p =w2g+X>zzpi3^{A_/ +Cϵ)0|55]r>GHؔק$zyrLv Y E:dX)ް:L=MQ hĠ{$EsAA@_}DSt|rZ02J4Dr$Þ.F|fXIg.%|M UTY#&Dnm};5{E8yĚ#';!kQPbŔm:msW^3I[tO6BӸ43Uy'֩z:߉?,Vo@ܒ?! SBe ʉgA2L[˰E NF3^-q]%m0s"L}8_Ui<cJ06ZKg}ts?bD VW$wSgKFcYe%h#i#B1^DB[q<ƳCE>Uej WG ܞLZ"OԤiB橹QAJ'\/_um4=e(YiH/X##izռ'8ܵm=cs BV;giIm!$>vgc-:9,pq0N(՘sOH_Wy3geʗ^g7abA.] Cr%q O qJ@K`U[Y#lz.;~9a1(5`Ŧ7_}3E;P0َA y%* +F b#XAjKJ>O *g? ;8@ m xhvrm jl4#Z>CU [0eK)PV&#B/}3=>3 >irCcJ r  {gZt1)ē 6݇R'M)tU( (1Ȗ=.!Q7mt3dbO1]8?ಙ K{\&-/tL@8HpVLpjrׁy]bYb")U[O2^B7{6Fo9L>tY;uᶄ/Z:XYak퐀A(HFsTg=Z#A6vO5Cw񝀨W PRtqMm+kx&@c &p)+:7CN'LwdU?XU2ӏwO s6{D4K70 RȰʭNZW GM?W㒀?RCU@s" c.(2$+L;ZgPl8:Om|AwLRA0^Bed%[Xʮy%aXפ<mf0S<T*wvNsz0ثf JS7GhqA Ć*1,@x,RO:|+Tg$J[(m'ݶQ_ f3v(9BH,CӃG3m%ڑ:jHihCzk"&8[)`ͥT,ҔR|ʟҙ77f$\U2#G{kՏjwfӷ,Ф_SwZ Eet vHl$Bj̓z܇tzyфj={2$Sd{hVpʖ(u60c~['| V0' .Xÿ^dܿV3n|Vᇾߣ+{W# _i$ 'L{_E$F֙cIJ27m2ȵ`_& u3L4ԠFߡןFq"[Rrn&I]YY't,S:ަd* NF>T_D?=\RYgP~l b^Te}:N@.vQHÛ}=31-# >$'DևYW_X8^J0paJ9οZ3wNjDp?̦$)j_BbVΈɛЄ1_4<ىH4~,)g05"8{4'].ǔσP*0.*:]tˋ$w?=uEnP_💽wxܱ n5sԢ*/$M5J#(Osl^@t-0#;y |_:bo_4pne|]@S'xn8mq"N%%ٜԢͣ9O5h$.%-'IHԘi38 K=arK"~К1R'YZfD!y3!Di#R!hp}vp !&G~I}XY"L_ ? w:;0];<갨'žAQ|"?1x桿; $J1gi.-H]u[;d 8564 'Ր$ʩ|i!IjuiZë˵$X; }hϵ V*/py:}ԎښeI/mSe% .d!=wd^*c%dgm8uгX#apNhI.T{oB SfLxC{{V&4Z,,H9i[nqpkҹƑ BGwK2{|꺷mo垑~6kT$2fiӇ`eS%KX`(Q;l–9tqQ-, oVẇ DwuGq-W5FPEэٳo ؽx\Râ=C""txrⷵVbz!g1gq9G{潵qb|ڥxHwƚM %.4˰sj /yq-e>ICɜT`IMfw. )a.CωHelh +/>O>,\9ƹPa;иa5 4sPI1p(nH9;YRln -r#h N ۹c!k#eVZQEyH-+"1<@ OGI25M~MstIH:l`orZi M=7"X[òO٤c(d{hOjև&3h) 8!Nblw9-IxGum;)e96I'H`]Xliւo~pnDQH^V ƴ1{{ z_)&p>|7m=(@`K=p1N V%v#^a0ւLhTszЗlL'"N+!/qka[f"zKʪyN[X-vݾ h`iLx_-S!n]nwbw%!Gx+]툍` Zx"}`-3xbdL;?*.tGעp2мt$iw)E!Bc.'a/,uLgG(PQ=/ 5& D!dEwCk^[='+k~$FkN~ U&פ˅Npp?Ԛ-u9L!o &}>cns*w 9n+-e&R]u\%ޥ̶ :?Jk1lc`fv "ߖ{PRtW'XJQL$t2FHħ8BTֿz& ;f|̰ЖZrɽ^Pqc.QW蛁Ŏ82*FZ#23DuἈ-UDs_mbmg_m7Jojeуs04Kl#i]siK co{@75b=JrGRG4R_'fmSo D'Q7f 6P%WWƪ;C{5*b;oPL lT#xՈX,f\PC\ɯt 4 ktոCM\._r>,0I0f\IEj@$aIZ9+6qrZay"j!ΏDf ]q6Gnz4t23nM\j4W@c4!`I5FZ6ysAWnTOpK_ "ݹCtdH \!G'B%2Y[Ty3v7FSдa,nՅIK,GEaSzs5CϘ/$~BuӘ9{YH{HyqkMfIL֒~cୃs3ՁǐJщal0On{ Nlm:Xbg̹ijyEJIl|ILߞ:u _1S Fgyt!aX:#5GlbmAy\5s|%?`]@:FWf&ÓѮ(_FwOU b=~D[h!f-@b"QB%_:6]6-#QU6k`Zƥfh<7UB$>8LU 8?NUB2`gBB%Yyr9cF\*vj?\98 )PUZƻȋ~vnb#]f1Ym9)C\gNlEyؗoȻ"СB-}<g3'ueOZIՐ""# [-D9j]cXҺl̒FBP"c ΎcV! }&bxm.1Qj)cݱAaa'UyVFlQ4ιPFf7tnڷ"UAi !+Β~,{5D  7u֕7sξ-9 \h-:jJMjqk d*| X;>;<}Eʈ{H牅Y鴛Rqfr11i}.\qxBcqQtUdia =~nmg.Woqq? ќ?@] eL1pP &(*xYOp&N?hĢKѬ:FcPd5%)e!8ՠǦz©ڛ)[QnCsdvŇ3VlՂ^!iDuQ0pE S^RB=ȏX_} [rrslyI˳(0w= ls @glsk_ l+W83?ݺ*_Ǣ偈Fb~#.}|dϳtmh^)E2IG Ƨ=}G:v-4|6HXD9d237$D6]`@wSݒ|dsU ^1)Nm3.{K'6oZY}0e撾c),#_=LRyS^l>8ڄ0~KhhOZMgbF}σ'oᛳdV(3 ig70a*pdEwt]^Pl@kLL3相>&#u;ㅱ2ӪQ]՟0ٍ1̬  ^:XP!N_^\Dcyj|ű3vl w`&q*yY{SqlA#RGCs6 'ͣw'\Q'afnQoE_>_]! (J0JQ}P\d00'tEt5Zvv F4SʌH]M,ͩFy,iU:sE1zLꍬ<oZlɓϱt!:+wk"EN :E'N4N åW=wh{6Qho-tTZIp2ȩCzC4c$&-A’8sLGv:+($OC-OѬ‚\u3,5fM,\c< :tg۴}8QʀTlZ`u\ڴyqmNT[j px}{2w$ŪJ`]+6Sɲ۫ie>.Qɐc teU>SI}:-{Hd|2b ads]XI=-7nC\xR -Qc&}X~&%1o9xg䨳j%OI>Ik2r]jRk\-#RФ#vYg ?Qx#Ģ G0$|PFbƍ =$uYʴ:^ȇ~Aӱl~ !rS!LڟMO{&`/"k0,rY.d0)ƲBF و֢ܸGcbI8%^b.Izdkϕ Q_b9?ưk 4,叜ƈ\(_qp ~/Ug8lgT4l"rL|6U'{Jۅʴ #RuVGwɅh,LncRo[aj Ƴs9Ϣܩ|3M/oRGؾ0=Wa Ij-.b?swS}h6&p-KҭO4B_1^:Ai?c:ߟ:fHBȽ>y/Ia:#:1Z`k%;x1 $y5ĉHD7$poXnj . 467+>pvI0V6A.բb2C_/uK6oy. o NdS/dҔe]"$i&0/DwtȠ6sɦSa.Wj8 X3I@#IlS\\eرNֶ.zK ]th9\Mge[&%6D(|Ҫ6vSͲa>{e׏$-s 퍷 c#;9xQ [r^eWM1_qHzgԅ.z.$H2V/͜>f讠:s6Jk3TEKX+է(DZ7רPҡ:'pg]^CWeg!ѫͫr +(󰗆熾Gȯ Vf wd}Zޜܖa~Iؾ A.5"wy+MAuc,;08nH6}3{[*HIX8N8޾x1yVaRoH{iLs_pÐƯ !3Bϫn{B'w&:ʕ4"EnuIvpEvLs΅^cNYh> xA9ejc)&hChѬ*wo`^6N1P2!Bc^҇ǟz2J?NKѯz;)ef1م(O.ptW#BXd /|!< `x &Dqg T]t(^=>,5ib0$y搻OOB3ܸU%-6#: Τ50KE-|g(!7p&; w}U!7C )_p a.ˬފF&/ն6Fm ŧC1gD;il>b2#kOޏ{gkFB¦6` [e8v2t6LT"bQp)Bc}DWWl{ (]g?dX5($l>"4XUT>'ʾKRQ@֌.N'{-Ȓ=W8~:N3dʒam s\G\q%G>пgSFu%';Gxsianp~'a5B| ^js->t׾c_Tw.rZrEeb & O\#xPk\P8NuIhx> o 2*4@f~ Z6͐<%@Jy *B?Sx-A^p$Y)SY ),_FC8P.\.}LA6i|}N\>e*cV^{ 2џD(c$Z0/^b*Csp bgqXzJzN$N~ * 'WȣІ7pƛOGK'˧톛%IEWK-l?Bύ_p5B**?:,ª#ֿLMidlkBfa'a%o0ќV#ar(l# (퍕@n'dіpɞdRbN'iW{`OԶQ.Au& :Ame ud Mj3}նhpfz@ LFn-l]W=+4>1#}QrJ˜[Go]Dq+FhP&ACY.Z^-ں8V<5=/[9Tk6.`ڮ0]~:"-_!TK҉aJ_,C?,F+B̌п+%vxF>4zR/= INJmD' E׸E+oXQZ$pL/f1 >ӓ<'R^DU㩾56`~9 ʸ+vAM"NS<Q$'y=M ;(FyKqC`a08|ʵmkUiy2fS~gZPO/n3)Q P@mދqbMeZ-) Ҷ_ǝ(W9ܓ (flT,˯TVeʯHwGIJNY?>YrKFiA^_ e[A0 (zhʴBsmGCk\w?T#2+B7y3<ŲRXW4Ei}=zsrۏ+\H;C|MN[6hT)xVs1.xvyP[SBa~x\% Q(I12\ Q^x5W}مE}ltb0o ݉Xalne.veɎlBBHBO$ |Z0۷Ѻ|(+2>GfA< @us`3{K.{@d{1+hؕ.V^D'ԦyU)&l *FtaeypK;IBGw&y%M63ke}62v< |!QRjvۻ1 k$YGZs)n~'rhU8# R10Pz7@)[g}CfJSgV4JN}IVxIGmCH#|`S9ɕaC =D(|R {<)d쮴J`7Gf\fwKFƳ;JX pK΢'XrTzEC0 a:l(g`03mY sc#}B 9J:}(*P4Ɓ/nEV%V }#V4Ir8";8>qZEGKfG԰[kg|rUP~rϱ[512hoecrf:g^tSmV-?f?-4N.JVThFZz\dGHXZ-[G0}M.^boz@}2dr#T@T&GDl+א.R~UwHSD_"*.Au8oJe0)'4( ǩ2 >\i w_+TP.2UW[/TqWa3XL`'Q6\uN^ {WZ/C0Yj8Mn-:{@O7\'@>G6,o we6E"s?"S,#m} n-zsb$5}ʍvI񇓩*^cO{2LB4|R/i,{5:>ض],e` ]ŵ|L{C:\#Dw9I\֮&9`w5ȹ{[ (4ew9Mzai*~ӗjXUEKV @y['Lc b@T|fŹ}XHaϾ3쏄߶gU{(7iIwd{8_;%ӫ!dxKFCfQvd TK\{|?ըraڥ%.]ΜqH }67tt 1`뢢W/J Oj"x(1 p*gb4у\RaCQD4BI.̲CŪDiK?Mj[v@GWHSҁ<]ZK\}̏Z}Kj(#5Fh/n֣s9<uȔ5ӫE7OWlFpӮQ7LU(uNRXI!ugV{=eLD.+^ҀHaHuʹ{% v3qvD$a7W_c{Ck[ ٵɋ&8O_T6MB 8+;}`CoI-s\D:i8*ؽ("qMٍAKQDq*м ?ԨYmo[=p}c'!( `~ Ms@߾p(T.F2t闓6FEq ͠0q9(*|#I#Sݯ& πsRWȃW#^ j6cǂ'y}h ŵ"P)]{+#O'DŽQގNxO-S6 v#|8U ]-@*҆諻P۬&C9A?<ܠ{ܬ3 4f:@TE$fZƁ *ƛY@[|UWڳq@eELL< ZAbee.=>jFҵR7؟yJ"fRR0%q9gBpFwX?bv,lG_.ÌORU2!O=\7G-$K\m44xbYWP &։!H hht+scW $=鐪raɥB)]*c#Fѹ?h]΍cĎ7u,]`·{l퓛sge .d%IbB|[fJ3z3iƒA'c4!_S Y["wƽ00KG{ݞ%5}Tl5in/A{! 7̺eGn:HZo[}d#&Mc0=4șv>N*L]xLi C78\Jv(ڇr,gOi1֞+"4n$ff 6O3y? (%` L$mqk R&jG&L>uyȼQVo\sw}s3 2L0VY# "IWTmE5!q#dxXw²~{)D6Zsro ^v+^f$ u$/Z3$ Un@#Dss7 6G/tKGSw3LjNx)Oׄ=b]dxexF7*9&v"1)C"\]/y('dаGM9bgl4 p+uJr)KM E$3'yJ)L }@狍~DIsrY SN/k\ֹÑҶs)`ĵL|Uq9:Bj# ]z zcnuT1X#]㑌~0g-ǺW4PW~FbskǕ R_,`揪-Kt<&4Del j툓Jv|V`;6㪨oA6Ymm ~zzѥS^[!Ilhp>k$![<U`ӡ;RF*`qӪ.W*߰ONPؔ lݻ87fn&h0 ?mU zlٗDhU}6o\hb[c Q01VgJɸ UsҤ+eܿ/nc&&>Vfe(*)o{1A2x,T֭6nt:#St1j/2˹=BqFP0a* +,SV-=ED*\QA;a Meo`b-L$9]L4tuR"qK+A[pOj:N]әv`~vKЙռI؝&/"ۛP;jf$H.G !bh: ;e?[-Qf7ԧNq Z^2U3`n? U Q\2$23;{oa3?t(Ʉm8=%8~ԙ͛ ن1,ecE܉?#B ᢐ LPV%SV'5A)uF~/5˅$G,9iV$.%R:߸͗z raƵo;=iH #B5?!P_n\_PN@`%~:'=MG/^FwRi*mλGGaM>ChF L>J6 6: cZ "Wnă G};w0X1x !"%UeVDU>Tftt~R|pdΫ5ƐβmžP9oQ]nɳoƴM{y-kT %-; &kfA@GۓEڅ}s.EQ_DDp3]_vqtDڞ?azG\WP}geURa{T=]1Ժ` ^X<.vcISȡ@?4QrPA1oNIM8RXEBEIi X+1x-GtKJtP:-u3EǔNulg9Fj1]i9)R'p=Txpo*Z!p^`ξqgdM _hJ?! sΛ+nIm!İ _8P]a b2Fr[dCbXbpϼs$ܩk ,4laH~R(@Z,Us 6= 2g>Ɖ$C;3Zɰ!] 0le~EN \U֣^B'4#nP^ VhoYR3?B7pM<,˟ًv>6Ia0B@ nō2_&ԥY+R;U {GpHojClvIܔԔ:.Fl7p Ё'-!;LK3dYxjUkmhd;ҒOyD4rSֈ,o6p"?Ōw""g(uJOv*v5 )G`)#|w-M2Y6\\g8v4J4Nm%l,w[jYpE\&P=&w}:uvg oX:&5"g5gs u&d;ؙb13Wﵗa-QC jfxNx&&3L~@糫3=󜇀( тlPVs"dyCs9/qO]h%֛prUvv\S>)^܏aG@#Sc8tˌ.!b(lKM΢bޏPrg/?5O}-iDrM~Օ6Wy%'&Q7e{V4ɥ>wչvjJ&ᣱHWNРu=2Ke. omcKx4,1PΕd .,@\4rTmV. y "R5Zq-~^ Ҿ'Y4^2 f !AI/Y Ɗ|tQEA02/v M {-2;Zh*[)8OT )=].@369SE6*+ZyČHMא z5}Dqo1ӏW>}y+7:dr\(]JlE05"=2oN"^Sejχ"5/"~C`݁C"-}icg&,oN;R+mi1 CJIYT_'IWZutNBNZ(`<< {DRVR*ARcAffOn:sd+-vw˺V Sa?Ƚ y:D{382p ZH.0 ٚWHi)jGrc湺icMRw9ˆ ی 7R w_4*}0Z9)nLW .FB(xsqTİ5gzE8" NzބR|5*Pf'χ/IO>sSّxA}j[3 [%wF)_>Pcd`*!IiEݧ7i#5@nkt ܏4fjv+XSլ)G T@I}xLaV3e~eeF/X sץ;G羑2/~'ZDZBmHkԝmp}<JxjyQӁGǎtVڋB e7$0g1_jjinuMŬUeS>6<10x44XK"gscY1sXvDWnp#ruSG kQR{@1!vq@ȶhrĪ3>E~ ˜录 ULq'P)$DœX~_Up޾=:>Fz4zgb \3_Oz~vؿK$NP摛8! -a3P%\ޑ4K iE%tMtKc3ߔG,fۑBs$oĖ:u \PIvj79 D23k}"n2:@hf3TXhg+w/<,k_%/.N !F*O4IMNoֺ%\{[7SiM9HD+ed%Ahzݺcu| &EM>S"{>$RE"q_%s>pMĊG`Êa:%Ȝ6((cwB8G.;QHt~7"  ,zpds!L;(E8tS@Ew?!3*_ߖ0H5i4lWhp$yb*DXdޢ}Ot{jcX_LF,ݬ[z$|>]7 8?p5x2JnO״O |i>u+5 Էly1`}txD$`kiDl2ag`ԜE[U *ci*Jo1Վ^aRb_egrVdn*h$XA,~g=,Wa |h+vW96D8!O ;ޘ?H.Aa6J9p+;I{cWT^8Q,ގ <"52 e=Ǫ%9Gi1#zp"?]/f'G(pavE[d eHa-1S!s-RjErªD/^1) EҀs0"NMnp,ܟGmQbU LR:|ϕ-0|ޓA0akI ugNǫWM7`*SBBR/_ZP m_4 {?=S yWef2ˎRPpGO49%T.U9(Yhy|ݴaR\ÂKC^hIbVbdZ/' BG:s2! b:7y:+5OƲh( r2w}wZȀ>аJ8z[-W:9z/ h?%[BK˘u]~.mb\&TypLJc3;pF.bI]s0k/ء /vIFl1OnLoStg/j꿕O猔1r1/RcRDvZ.͟d* 3w1P~-:,6|uTa.4zԚ?/sߒOPoi2i{y2!Z κMp)pA.u59A $yFRSIRxFˆ~ʝ5vZ.LtՃ-JID{jh~E6M>,7Zh_h:`Rе' Lzx1&_[$q^V4_D^e?=kｈ9R,r|JȧFd13,UPH9K}e嶣*C@..Z.Njg0hxAЌm$Vsےt'zl̀Q7Iԉ3Q7mUoiR:=e w6whRшΎO]&ɖ_8+ZRT|*?<',\C+kTͧ8XQ=iG֐^8.%/GXhr DSް ŸHӠ+9¡ y5)Sٶ3^l; s/?~SJ+\X"6YHgs?c O NPkcmqX2̐ nH^CKFi\:圿 ԭo *+$!jOaioyIp *i_ꈏLyyPJa(R[N TrX6vג;0Гb\hrZEk`6YRF'@ g5rYM}j;54 anӮQ*$ =3$~.ų$/#ܬs Dy#68̀ZTv\E,`>Q̏&VHZ#z lOL(-;]&0oϙ ~Cl3Y_i8Ɠ 6:qԙtr~1eU2K%-R0=AMº j{@ NI Ӻ$ ˬw^Q[/G,JSו D>9d=վ% {eMT.zp1 Iڔtfv2^$g;# 72@Fx?Xd˜"T:ummdxm}+@;38\l dz.݆OVK#Bp@VFYZX)n#,!>=,Qu--=БT킔t_:Æ8Vi_[e^wHs@۵Q]́u 6zp"aoy_tQT\^F&+niM|[ hn^@D)+r&!x'A΁bϊխ#_c! O2(䬬5M hiqVCOǧ{' jFeDp(,~fE4/c7pOd -bJW,>ۼAu.R?+hP.Qܠl0<WcXNNeZhKz|g2*gY$uٿ9˓P\]v8IT3roWoQOCְ呤ꃌRwThe;?əpZ: ""Z6~|jpY??Ǣs0_m zT|Ӆ .O9|IϹ>sCӐ}6 KqӅqM13|΀gi"-aw>\h0HVDI#>mhaBy6rL:"nN2o tͿ'a  o >/=he=y7*%|X;.ᅷuš`"Qw/2w\`F-8 `i%T4 ósxp%RhljG)GǷdٗJ05s%W>:zoAe/ku|KH[6+rS+> H.C3o~=Xelbko`XN)xۧ&FAw1OBɧQ}Ȃy =ȂnD3" c-!8UX=OqyH w4;:Oi*5"2.JNh/`D+熕|_**m@C=K SqG)nژ#sՆxxr/DMoEx#ly;]bдCn|/0ea m2}1O#mu)]qXW5K+BppuGfM< `Ci/+\͕4 |nFc*sVx>,诣tpS SMsהR1]˓7i@e{q«eh/g=P|rE}Q*o5 qo7m@6Ew%|&;} [WGģE .܄zãVhR^@ղJccduKh&#Dog* Vl|ʠ2Nt+^~01xdʴ`6)]{j,'1§\ W^?D<,<{pzfE'"+E@o463! ⟙)0}YQCVɂ;nx,y TU)5;"ݱ7҆ܰM e>xAb\~eĞ2% Rf}:,{V"]'sd {/p! 1Mx ڋXZS]3FB/0oz(J#>Txv$҉:į寴ȿDR?5QV"bl3~FL-4ȇg6+stzrU/2;+SR#eB4 c[y } $X0ݼ:JkE9;Q@fTPVq+[C\Vf/)Fh%#1C4g!27MиU~^trkXZvg-%=>@Џ USNQo \Q;󋯈l':p,L.~|?0_:_aAxo!9xxnQ?W,A Fjcim_kR9*+LcREk0 eƜq$5|i5~!??A(ez kl1gRm|L3:Q|+0[ e !Kr .REf'ʖT,Z.Pg9J 5FP9>C;B/T ]XC>~bKfqA0;g/s{aBTxR3k,{_:zEoyJMp&ƵQ"x_ҫ23]e ll)Hndhzm16}[=8j[4yFWM}v<6{υ$d B$oL]gsE Zv #,i0ʿ%mf SaX|,Ѧ\!-eMIRc./ Z.U.O2X&N-t~ܼz?.hK~p1QJ$V{,L_x< 5:m%֞^d5 ^cm7vұ8=SتM:,:@(&8U@oR<oy^E,meStHOIǦ/p\VeE10,,s[+[#+\4 A%\5Ox& v jTBd#d&-{@]Nc7ƷYN%V4r`p/2Ođ eG{ z{baCAd<XYR'qn֓sAO[vFnSBJRĚȡ[WdqB|R/ܫ}5G"z|aYf6J,ۆod \=1SVq.w\T|c>:D(0\I ~qg6LMn˫d؋hll7-9sZp# (l+5upGI q QJ+hUmlN7]nu=˝AiѪ&qUv]n3I&XkRmQ.WdٽG9]hBZZ_U MܳooU` 5i*>շkvp: KZNRU>KM2ΡFYM4:ځՕqvRy:=tj8 *;(cR8c"ݞԷP\ iz) 2#x0^"kg_.j |g+D#RXC"t +aY|p2/CV>GTy +?KISgq:^['&)c&M$e#{@CFGԾ^0k NW4|*polܸ% @xXxٌ5䥫*_^劬?pDlݞ(CS9YL'Bx 4Oٕ v$Ѫ"Ȍ~y=uL5xWG~ue> -ZH|غr◄?;W k "t;;_=*w3z(ǯg=߿-)q T1O6 3vZt}D_?:k_В=텱w_rAjKvoO(95[pom0ZNF9dj&9`8Xi;ಗUϳ#>㠋-B noV KjoШG29 8KP +9 (RSJ3wJhqjP >R4,0# ?RaRA`(^ O߯ʁP>Ǧp Uʙ' T|xUݕV*%.8e3+/@4ib&;eNu+좭 5؊P|Dz} \I{ f|?X> vkjAQ&D?L& ky5RZR٭gE"}3d/d!~%C_ =RoW8 0rO[fYUV9Ὡ| ]j._iN85^fq, XhJ=_?ޮ!iA~%cx?O"6լܘ% !^ |%[qX,<d)ʔ&5Ƹ% ,e g4zbf-Gx[WbLZwY\qZbjN+yTpK?Mι:<\ 3܃r[e>\āO9={Oed*E&jTkf ThKp'Sݠ/،R_ l',˼Qv?Y8Q^$in!kF>tDj+yObЫg[Ba38njEX[۸eKS[pk55=]y];NB2+@LYz"R]{Yf .7[ՂK)ܼk] lYY@pP; nbA1dv~ / SơRˆ`c?䈕Pa&spwf+J+[A'n; /",UXٷ%l%sbBBվ/F|%o٣V;<Yj3er jkLQ M4kk eЫr)kt넒[$Y@2u"WFK؏܇4)+8Wov4gU7Jz#A} SL״ua_+W&Kwd-`= [:/X7{$V-M4 D`,<~PMZ1/kRR2_鳲2x%AQU$:I)ߤ0#V-H\ajG{jcA w@|*a Ur.rA:?!X-r}XCpË=rv?~ iAv]7'FR1{3$g/DVݩYQ%i"T$@ <,LnQ>=rDvfH8SVK=ߛ^k垲y}T4>NK0,R΃"S&|K" czGŇoÝ f:!:WBLJ-[ua3]aT<&mO76~ݢL>OH?{Vb~?9]f5t+A1K}u?_C,m݆k+GH~oI5$$]Ɠ1|]e#)yAf d92_} J_%G;{1o1JB Б7rRڴ/F -74M[̡H!1I-)-b""Q9W꤬efa{`Ϫ9t=MZxy r!Bs'}Z^xJ@5]ehk"b1Ę4J} jkk2 dliUS:%v˄i'3=sf M M}SR[G`+m28TaI \7-[PX Xcm^HK\H4SvOɊ-m𽁂Up],߻&.g$pwSKCDT I<',=N>\2m%Tv%PKǹSr7` }M e?i6aID B)N~31 PDE!L/sϺ%h/Bd;i)nn`P$ׁʤ¿^PC;t_{#[H-^g ~W VZ8RBIAԷG#ԯgw@OE^nz=GK %5^>!jZ/XʢN-IލcK:VJՄpУ7njKAB@::] zkAM3en<""pʩy_|`OPG>sߣ@5/hELa 툌F Y,-ie'Yu!'ژ]wh^n4Kl\?Gg! EK J\8ǵ>ַ#QGg{-!@~d!^,!tBTŁ~[\m'Njg~61٬RybY7^1\Q e(Ǜ&B_7@3@GSRUcG*rE7rIƷg9$^m*׃BU*A?ٞ 'jBzy8tҽbb ݛ12庡 WL'@ˑ-,lvd-XA1eU/G+,ҹ-_"SotJ$\Ҏ.7{tgfF6 <'O @jt"6T/e"gX 7b`k/=[W댟% ȗ;UH ,Vv¨J rat%>i+ʅ!G Rx\RՕJoGnFaZd{YcF-*U4_$^bu<3m7wW/3d@ wwm5D`0-uS1uG~9[h*}kMHam I>>3렀 }ү|Otw{?=z~+.4>z咳PMI'9~E4E775pLteIJ ꝒTMIt̫TgBTߟշ[,sqQ/1])<ƽ 5LWg103Koԗm?" Lgdl!#ts"\>JH2h=@.+/ו1y (g= Sl Gm[q򼵙55W?{c)"?JT Mz2]B}^Z&X`5X6rtR= վʂUьRitp{*s3=HC_p嵦EkfakTX>s!5؍Rd`C ™;jǻ^ԯvSRDbzqvi !@[* A0{w 2ǨLz+U$ K -~LwߊDv1/gxj@ !M0}-a_ژ8d~<kzc`ؖY_젝j`~XJK$SC*Mesߍ&`W<>|xӕ"HE9EXh #~1ۙE&ֽMU%_#z[s@p) Dēzmj;uGb[cӡZxIv'P\T7kk!Au+, AЅ^^t6Ǵ=I1oc>c4T# ^twAi#jeUOZrrբ#JvTlߠ-`&\+S c$給8ʿ_!{"~)b W0yЂ?/]>e&Ϩdx5+R2HE ۃNWƤ͉ g_Ͳa)g71.|2bc+jϤ<Ȫ067/NhUdodCHɈ *wP?}m_컆>,.8X`ج`'OXɩYԨV V<5,ր;bc䭄?e N_B=0* Ҫ y$U%HMLּuVV Kqq2rk>{t91?!a<ɕO`Z,9|]W,ˊ8vMpus5FcC, QS?&m0ˌ8G9JTx\#2b LB>KJY$[9yڪ08V7%Zy2Av]F,ZMq4!DP rQ? 쯏'P|ZD*q"ZPc{ϨQswmWۼ>p2ST%m2DD  #M=%WH??sj`M$(ujKޝoCp|Dpm;ݗSlg q 1aG Emuisfw$VπŘ%4\%zKư=aA}IY1ڨ !um!gxtkzB,Ӕtau΅|1yjvPP[5/C3,v~^Y*춝LVT$z{yK[!1QxUx7rmO QImX?|^${mSI4-dxߚm5+gbW`!X)xUyօDuɏL roWF1)e E6jSk&k5LK]Ul @;LgGaYYI'1b*Xu+B `eBjUu4HF|b {)p~wzeEZa*S~5O8`_n3Ev'aHD%5d \cO p%1κ ? nrYs2ͣ$7'?:5#m 9D%=t\턋E VJ<\FkqR m;i3}Lf>R6y PAW uPӮ0I((C}m,4#zrI7GJX__`J'EN5}bq,miL  UdԴ?{Ǯ&-X*`sj_&]l4>WT,`z9\ 0q sn 34XPWi1o#%/'!9a>Ăۺ.) WKV_qZp߶nV(4{A De!jo+?@x\#j3&z.|NcזCX6jsmrɖZҲBUK}k=Rc0 }Z#~?;@xpUoRH6?Ro+b 5 ֫=3K5MV_׸#䛱âH屏k oL0j;$Os˯ysP`؎QAO%쌫``@2B..ƅ#!5Ιr):uny'q`ә#+a~ .{=?eqd_ƃ"v.v6v0QV(YaTDlu/l!㸎t=C:FrK`k;^<tu6 N_s& tEET,E UaqgsoD+{5CqY-P: %!G8_F}P$dlZD]oalΎ؄$V"yrD GϬ)7\TT^['.0^Tn.ueMpXIbԭ+#Vb89^GQKH;DfYK= Ț{n6SCkQe 1)P "dI|_a9b'ٹ7Bi" Ņܧm1yonSJkbrι;P}wZ%{_bO;a8 k0ғ~_ːd1K%ZRPEX&8SKɂb~r`If,(ESc;.*"./mn;u><{y Y[Ў^V-z.*Co5S?x[{oH b8WIZ~.8@o}<\:EOq?ѓ3G(*?0岻tXJLB@D-z{U<L$Ȑn y6^Z$#9$Gh_|.a_u!pQ{𕍓9Y/(֦ۍ[]tO 6D&kHL*ՖlW*ffS78lYt ϬZƴd˭ib9~מ'ls"|y*<7[L%#^q_ MxsnE* Ԙa H >Vt;0ruP6CL2&좑b ;vPzaľLVVnwi03c2ٗ;OsdXE7 KMSqX6-TOE4]*n-7f&H)$WGh5'r7R x|BX<Ҝ71M#dN\-̯#0QX &>J1j XA[{Ҵ+x9:+8J+]L/{pwFX*: wW_/V-D؁@y*fp:Łz`br_`ہgHڷR^੫Yz.W`*.MEH<㋉>D0efCEQzS*yj=!:]]kE_@TE:m#1<<ԲGuba eCM;ꅈGqGW2Ӆ 6!p+3RXux5W\JJl15SØ)U cmN2M` ^x~}Ho)&~ui#6nrfGRZusV{kH;Ч;P.mE4h AD~OKYuTy<uU| H儗@۫*"FkT1"2\RNY Rz-P(1C2xIEIfE0gOgα:P^Fr.c DoCݞZ>_}PJng@^ȾU7S}4-˯k/\p2ׄA`Gv^YjQ᪤ܝJbjw[T@̀JRR3lEWߵ$ŷӅ։2 Gȗ+sw.Cqy[1ec=PZS &wwV\Fc S2deb"Gw@$nlpBl'vѻ bB0_ޮ~nK%抅:H>nIfw6gN?2\Lt.Yk(}v,/8Mis:QjvQ'[h.z\B<f]?CF*iE1rM:m5˚#񣋟vDSBaz30mDCa-i2w и.vt[&W3-U07(E ˦YKy^aY7!#҈u'BQd([FJmV~ٹ2oG׺OC| [1Y%ό5HPӣ(Z /0=aT˸"YӃf}XgYt2P:Qօ %"p#jhneat9t9~<Œ8 6 ͅPs)f߫69eHΚrq-2y4H6_c ԧϚ=Z|6 $K2کmpWga|Wo9aҖN?wu,BTAĦ7;.'h’f'ƃZp0CsϞ۫U\5<$;L*fYY-!PzH387 /y71CS-7pbY6h22$EH1)w>00\L4ɫ]2JsKgUtw;"9S>\ Ǻm/$"f^V_܂`R$ЫBB@M}SF(؛6o~.Hi GY^U.L =5(;#Ӈ /R4=ߤ~~+vPW>1ds?M3!ǜuq)*&VǢi?q牏ŴOׁ:e7pе,g߸O-SҴï~ [id :c2.!66D;9ͮgLYyL4m}5J貆w# PfЖBy׏SKeAiRMkt3i\IHi\XE1'O>o wA>s DsXˀHva7a Ae&-Ն@Xx;%PIyS{ʞ7W%)2 Y_d(q1kM"T V)U7 F'p~(̌MǞNN`t2K5I}@ݫg3  w3 XBE{ 8& !n/{l%옒.Ad[!F mw| ~pjRo0mYV?-fŝ_fm!Rq+EK CT⹣=;UۂPi67Xi<}U@)$&hXΰ)Eh̆Gm*F??0UN/{o܏Ϡ_$'ˀwtV̟U,X;nСmYwc~,XplCרUS;SP7`9L=<-wfq(!AIb$% V٣FpZ>{n'kO(0}sG@1S_Ȅ˘)3.Ҵi T?Boй O4b$N5 ܧ$$>=d<m1$Ĕ =bSw@ׄ+&/,,έ{vJP/ 2$!UAR.~~gqdq#Wb"OQ D\J?ګ!`~㴎;WO{%C+fW iٲc7N?"9[yP5տb!H~)jyh|hGAr\[Ȏ5 Y{ 'p` 棬w~̑/ $sg;Ey&tj kJMʝ89ⴺ肧-690u&^&J +ƴdjܐ%"V~JspL}rWC+q)Z|?.U_wl"7a7 0 E<Q! BtAg n#]VewUT%IǍ?}Yǿnq+Z)'?m* m9 @j|rL*x(!CP ~ەf?ߧ{t}T* rl5ߧ>~@2 7 Zl4 Mr8g=Nt n>^-PM eo#`7Mbg^7}}AdOW腰93) +܌{7wm=ZOʍ~qm%'oAۘSG8u1NǯfB񞍿%=mL/zc*uqHY1B. (|iџ!kߓ>3ªf2"E A0S ޮsy%8y # l\db.ѭU hpكۺkcg9褽#Tm1FR0\LhJ@ءkg cG4`>O1[e R10o䤳84\.|]Ql`FSQuӌn,4hl<')=-D~sw= ZU=\^);#֑w"B(YuĨ9)x!mt!$?w`<} t7z~P VC=W><biAyw40Pc7z)n>+х MIҠC_OsK8 fGId_Ы6m [-nNMmQ=Q# ma,;GH" 1J~UcNWĊrWPPR=T>񤊏gViNX^}h&HJ8/Zvژ_@)/ޱHR%&3W@ǵ?y?(+XU{llקC1癏Ge6eKRFV=RY2ӖYRkO0cm貱 GƏʕXۏK{7yR_>{_6aǩl.4W-8]&;t9 j\sSjIY- l.G24?xBsUf CR˥jD|$-,dDܤgN&U0QqbHϘh;n%X}_nbdA_|DI=QŊdD^X񺯝dd cRo[A\N5IsXtP l*2$j( XеS S/J xtbCN\g+U[R%=:K.j:2~йFT>J]Cn7ЉG<-;\%`WxI`oGLvdlw8P$5ȩ{Qܮp e@M6[.Ělv%lEe1FrpeuXzénY1D/JcC7h|`B}365;̇_ѦgQٽ+[J7ǖ.?|C;7m7Y_ZهUÀ@Sp+݀Y@<9az*&{C'XM9|/SYe(5<7AUV6 Tva(-%L&NkU[7 I~訌Cq,tјmr,h:%g ̙ꗀ@Ł N/ qCFI #7\0{<ޔ`/mpȩ1-"bbޥ8c8xXJԢ$$0 %VWE#$ꁯJ-1C<~F%&A|h\!Z J1b/ܾtr-cbCAȊN-51HHg 62 ꜗ5띂A^F|t- d[ (nbԭ0%3xE#V8`-&HW?2Ip*;qc_[R#L*eB, 'D fTV /|J>A~O#zƳhg- *t7[e5db̟op'i/CN[81|#a/S6 }=.,Z)V f/nɹ:B7,P. (v=%qB`c2Q9_Mtڥs=q2rι$dumwτC,vZq&v . P.VBK3Odq2:w~FlP?.+!\Y|X`OgȭOs C_;ǀPkw6,ڏ{PgFoU7K]')s[a\ߩ.Y}[`CQ.@orF(ļ0#.3BST= _(O1Hp'-GTJ4/lWp6jg(x7D#P/:9= P_x3jEGđEi o Tإ\9"Ya8ܛ Ugv-PÇ<|릙rA S \DUPc3&Tji+ Hh=4+XLf9hx?v_cJ FmA:{\cl6phuK6=;&+!,U-Bц ۣUAYcu 5hp Q!=7..%㖶Y>ekWZ->{x-! z;vdw# 24ރ?kʶbr?JO|5c!y #iŵC^qCG}cnkދ[tHʔ\)\j$xˊ4L~ڻa^=Qjgpu8I.ŜZUgG-T&+ۿr.kLkKi )bPYex0t\O\OK:ښoާcD*?p"H ♪8kԸE, |s;\^n?Ν+fq6 1N{,OR8yQ$YB{N P ˆ_g[xʎ?#v),p}A,7})xUjTasK & J^>RZmNpa#h!#dұbEYqK5CÉ%~l7#^Ocy|b=-znlNLdaN4j}+xS̒Q)_tDZ a3-::ݼ( uj==Þ v <}emGqKd΁ӏ#P{r'jDF\"Pl$!ǻݷgJJNEE-NI#չJa&?^ג#ݵ3HO q v攐n+Bi4BMh`! R JYӰ}p($/`[z{ƓQODm7z䴿d{ yc"^e+S¢u! t6DJ·n, i2eD?@`$+j[#wGϢjwՁv2H5mWa1)Xm(4n/`@L1g&`$֛~|(Z+BUmܟt@x M!XC{`= ?iyW7HO@Z / ֚u6ѵ!O:rXyGSx}Q'6 &.DK^ҘM k:kNЗU}#K? em08%fh1V`Z_fd4.aEv7l>};rk!爁r /ǫc6m <6{Ź"Lau R!Zxc^rji}O 3;*+esE/?~Oݻn1xb>wo$:bX M 9IgoN /nM!Z5gj; TdcCzv婹ΒjK"ijn:D"T~ߪD5>j0hKvؐ-6D=oDz?_;lY,H;ErZ&(y%v>:6Vnvx@ ǟ8lle ?>/QTu: 3 XP1<"'z0}jiڣѣnU>yh ~,S"Hy/cԤݳ%顜Ō%%ӐM%$4 BGl6J@Ê |΁<{O<5 `v+Ir:oYT# ıWV6RM rr<=ui,=tK< }ᔼS.J"J#ДJԵl̳=}\ΔE (V7-#EhVcf\c!X $L2 LO')- aze.^0<].O_LBuZyrNCj5W 9O5"3-I%1RWO(="ns%*; Ht$,@ Cok"Q@44*,|vH/ruDy6}a`掱Cw&k{jr]Q\|0}EY{nd} /U]nu(j {ٰ])(4𪠤y? t#+GD'_/PGԖgx AwZQI$jڶbc1lpZ4ctpV&=1&(cƒ4X$cK(63BW\,b8ħ50k%s'Fo;S&{?C+="t]sMmwrVL[VWmAJ#.<-u,{=db8t2@wWhԜHOs5bµ|}Ei:7e;ں&/^YC}/P}:h 5aKt& nP.BSO+8_,*7>B?dVڟyM>0MyWJ!yў=o/ U* %8Y,M!* =fn9D ᰛ!cH"y_,ۢ}{ 1\֦@̔J8S#SR&@~]D\{UV/}B#c:ЀQV|?( pG1,7IPUyNBap#j̘K,Rs|zX|r] O6YŤlb:F`7y ߤ7uT_G8]J b("̿Wx}#'@F#bpIC*[l.nq #:k z| I)Do/j!7eY6|["mumLgD ys^DTrxTTS+3,N!V%6t;Qc>)X?v lF}¾31{9fOl1vgg9ɟ ՟WVΘ/T?ډHʫvn0_:,t>(TzQ%fq`b\v7z ;em#k&Uٵ])ژ#}'rix?y.y{OP|O)x+R >؋r],~ɤq:hRJ,@^(P.hrZM-=J-)!k;v}P^XK7l ۨ%^{>՟pg=Zzahs4C0iњHWm:MX>O^]^dfqKN'[5햺 yOESNzL4KTKSIRm3&zTj?H)82*sD4msZB^:ԵTbNɏVf5HU$.y>bRHʟ6Z' _"{~P6(/JYROF췬(bȫpp]e$l3 Y 5)K?KESA%N/(U{[S2iL~|#")*l AiEgN&v\s}rg.U$^lz/,G K~1&Rt;rV{ߩn*z>`S#dʲTve/ $& MsFM'YF]-ʹic 1(o٣ rOĺ&XD`mF'PkOn%t?#$5Og#xl96:bo Ehxe@ 9?8Q>l6҅URH-"C``NoGю >1Fj`em9M;-;X.(Lkڒfs9 McCaQ.2T^y*dŕP6]qR/t$zT FNO3Id_s H4[$΋d莖cC^p({Rl_ R FbY 5AiT/䩈s:}$;[+j 1Vy\ q?"&EíDD0[ A`Tz94?)Th*w=SY 8a7Q}gf@}-d9?ľ e8Z ,۴lphw\BEe+ZQ%j\*?-ZwN)^ 7K)6+݀YTifQQ[$ [uD~<'ǵԆY4!0 zlC6aQۗQ }y@,3{in]R`+e=-TZEHJ'uԠ <ԒljH%+ cQUs΅#]ي5B뼄;x?!Bs jGac ~.oG6ʭw SNax@0S0lg͵TIXhAf ZV׏RyF'9r@cGY>q3J  QBE xGxx!sLpD{V UE7mr tk"驩>I8;UnO>47ӄ݈ƙce$6==\o\Q}>?ݝjQ YC-CcO|kJ K20d`hxZ⇹)$<_>#ؗ~s~o?W)X@Á^~EAd"U}0PJM۟mOœC} r#:dA<`kRƐ ;N{~ 3R.;ڄql!Rm1C$I*84.Fx-sd.s:F^,\^*ȧC+e$^5'NhepkW[R tg\b5bLyptx-L:H@U՜@tMWLxZ) 4)wU&n򁢔oj0w8.{d%Q>=V 97܊6Ib9 |*ofRv2,"9Swx=Fh-nX9i%92{ä|F-BP3.p*:7)N&*Hߌ݀g2j # yfaZj㣛\gqᇂӬG/D$|9 ـWzz_jETVe8Qob"+hQM?(NpSL39+2Bwc<.n4Yp7r3$!5Xb?N0>ZԏXm<,ixA~ )SE)D% נ^Ŗ\NVf&6ii/&MxMHmR3%HZX`0_2x[VΤJa&i`B-g^ +>-2S=o/(Hn"V/hd<޹V2V3D2e1TЄo[4p۹^lrʘ;G ,'ͰYagH`AHCoq6~& Ao滮h<95s #ckp⠩!lA-\{,cw6v>tRlWCYFvWpn+ŭ^sp[MrbD ץM-= pc],Hp'ﶇfT#I`-^C%b1`Fg4C !뺗^^^gf),U}>#<|,o l vWk>k|;;M`Y#ehs-'L HG2o6hc"5j)f~?l{`F>˱ɿ5}6҂Su͵]^7Ews:z*nRQAU| v.T|5r%cEZ|0C*="H12B!,&>,JB2MY7kÿ5`#'|eZuqB M% OO_X61zIM"6!ž/R-DZ`m8ۈ}}/=݉ r1W`߶ wΚZCR}fF=AQQdAiC}Aksq- #r9:1v$7 R yThQ\Y TO(ؘ_B !pQcI{TAuOl&6h`W4/5- )) 3s G,^+߈D`KWr03%fD[U ay^Yp+Y,YngL nEB?{4 ™DG6I󂟂p!=zG,*c]%DH]Y\3Y75rxI|<ם?̊jY"px5-U ;$ t?lL*h)|<e)^;f4dߏ>Юm6…U!䩮7X؊Jܨm30e£ 0ˋGU@+BTQR3 7NZ m!sth&m__g CCU-mR mN5ji\o9-`@c֐Pa NWԻ>LR©a|h[ê>\WV15<Wh0gfEcr>"F0H'Bu.m[cqītQ9Zw *9J3<2rt"mR[=1HwM2XY ViuŃ˰ݡG:pVYbr*|3"<2N+* fΚ},a'1cmUuoV%c].ԦjgL_J(Q)<Ǫfɪ~8'*ݠـPTfs%*,]+:h-.fapj{3J+ 213B@CJ>7Ԑ,_+߻^ {:UZo' a/'goR:jdj,ՉllAшb] 9mPYdh@Xfs;PV^Un }I%CCGtUQ<j>N!x( U0J"Yܨ?Pn,=f?+"l ڇh,hr!%pQא-d"~CFYx10yltοgC؛~qc}ۏRQ.;Qn0W{A%aW9' W[6zǝk?B 1B tff[ E]d3j4̜Q s [cv}3+NɔLyzt,mB9oQcY_.kZ?qIW{[ XV;ճ\1#_8a %V0u#VT!:57I./rfV3r 7g JH6x|ܑz g{LQcv L26 69Cb>fvPMZ #ތcP50mʟw-d<0$Mxo/?8J~j>c74Xxǜ4gY(:4Tm} [yA5 PZx\^ٚm$PgLKkX-nTdM|<_-[ɷmc-Ľ.a⇵D+ugg=Ý 41a.:A8eNySpgnx&}DٛK+Ӽ!Fn~ meKAo5yt\tGn"L7 3 /\ f|O5p@xO\,r$oԺkS8\BnT$7 lbysah̊f]# Nh@+Ծ)HR$Zu5QnK袀oFJuyA_7Ȋ{]ԶohoksݙS+1K[,V~" Vg|MBH,Wbwt_ĕH/+෇%/R8mt3<˜= )}<2=>@6uy*qnr 8M5la™e ><h$%߫>^=~cJJV&)zyTMrWADSڑ1R t[ B#u/^ٲ;z}i؊k6${݊W1!F?$n+4d+6.NiݙHP %-C'f4&-|HS^۹TI*[XUeGNXFTWMx)eE_#_/1'%35{ŶS(+6jsBeJ83?3od" f6(w++fSr=C^fcQ^+Ed2+ ;7_¥j]HuMUzhFlr1]$X;%;aQ@H)Bcklѡ_!zQG/SZ5r CHp|&2C>J&]xu/!k4(:LYk9L{Ͻ[}irDXk}Xtק jEsPZna))?_@дo: "NT"`LXc(@~WV.!8>0ޣ r!J'+y2E-&:֬e>wU(W4ye,Xjs"@4w0. ;ɉ+>-z@[>{X ;=+)e < C)_[%>!*dRR^P\X>|\ʼnl-g2IJbܯ Qw}:Ő9,1{j*OÚ4\ ۫OsI;'Y;=tayDcR"*MK#vJhOW}Ύ:Qeݢ!s%GW^am bY3EW o)oѪU|e4.e)uwkRtNQ|R]uMk& -o|,пQU!Ӟ51K{I>sR)I5&n]LM.6PĪ0&4Z\5ƀw? 2[z%$@.,I*£`& :jQu,v[ϩ0%%{bGi/^}o6]>6a<%&0hETǔ°ؽhoJr:EVt|t3 70ax'_A yI`6C&³FAHM^Ly{!Gr7 [@8JK ϱ'%pu@亄d,ߕ_;] %(ɔjTE3.W^8pæf?2!!F|W̻yݰV/D7cˢ/taƏB> | foz[tpAufd7 zNb'IgX2(VQ"ymq5+heqyV?D׈Y0ڲoEQq샐*"72 7_(>V5Ұ[Yy>pܘZdPB0iٜ8; vr)M̈RBJVon~<{ iFr}牉)r//'!҅af'ԭeμY![ǸqY: фxsHr#opd䍎0G Xb&D!㳉?3JA}M6]zO)˽0mgkG%wUx⬲S򨰲{!xHQ]yt !_BO 9EBHF=u`=Pl_$=`\V@5ҜW8L%1TIB`_y <Ώ,yԪ\PlC$|\u7<$};v'H8FNC Db*Um(ֱŖ؊|hnP^i@S.7tQXo6;6CkΎZv /)AXݾD>E,*{" ;a*u$`!k+7o/|\0YS|3[(apXV3Sd[w/:,/.'gguB̀bGJ]D<ӆ0T^BVؾUv9S0b {}nLg|ظRzGq C5T6#AP6Y%m#.OeFپҽ Ќ}78p {ݓ;4|v)v%Ƕ/7jhg1cmcOŬ/͔Rh!9L*%~] aCu4#O`uCȜ"z< ˴G-q1jq(;;F̈́Q.vzTd0ءi q!(<}K;.)DMQQOOYpzNqsoau-ހ'f ՝vcQI_Ƥ>R߾"BWj )@jj#lcP.GɋS=PRd]g]ä +N&g%7՛>#mVŠ&BNnB!eYԏiz5.+N謷 Pn Jfg& }zϐHr1_y*``,'0;Pb;6?BH8"K ' 2gI>C&ԭЎ XrC l8 HU„D!iK(}Ū4Է/D;U TdKΞ7'8 wʻh(ʮ@Iڬ[9-!3k|Uc}-jł_~8V_]G: U)K@9!|,Ug eG ^=EPb';"0 @=D(2R%*fb1V3 6ZDaC$Qʀ?%Q+ Og@> )}:J:"n~8L]_4{tE_5c%'WH/ 65c}/eO3Ҧt8 [5vP O+>yd:a0yuR,瑱D0V"r:M;T46~ف|*7(g v|5iv;b @t-ȋ5hHkRT n}e폨3sfIq$piy HU VQKSnѦX=ӍzaM6v `! ƣs_+uk'J$>Ԯ.vTM-'~Mbi5zH~ Jxŝ뚑`cbb~lb]q.A" ~|ҒADrzK h{Tw|;kc+N0~g|){kY[ED)ޓ406}!B6R\r6ѿDD GۦO7/AYWpy7!Xg&!j& E{HJ Id& y6㐸A(cy2\>Q<Lf\5usJRҾܶk$o'ŋm̡tJNgLU/3j:ߐ)hҳ%zȫX_ErQG K8 >D+"«\> W#D4Kl%_/AosnJn |CΒIRYѺ))ԊtOJ)n&l|M9{sKP;M c([ (=0"?xоd0D#S^Aa3~#3b7CsҌΤ]3 V𐍘Ҍ:<9Kj} H( RY'c~ٳiPaV '+9hv?MyD#(?B4U__ӑ%h}9V.. dO##[BR/#u'muK0dC0מ  p Y9z" sL2]e\4/)$g,5Ƃ,^&U:t4/Niv ,ʅHR;tgyGߊ֏JtHmU (O:%2!:_-,8Gx=~,jt 4q[ LoWY媳@\^nsj T $X15;[@>9e#7T21+8mKRDѣlך~¹cFEw _6 JGixg/vΨuR_U?ņ0>P6[BU'kfl9JS1`29侴@f@@4y̻DguO`R] ( )g 0. WpPnCc]w)ZU/%똽Ow| FcN0~ȰRhjV3rዯM4}~$4mAm+gy Q$Os?qDf(jU@YP4ϗ"RD]"9T^K0]])f/r\(,g"Ђk ?$\beX[\ wl6Ou*&J g:~4`+SB|m@y)B -Dkahх\t( ]$T ]_5Ӛ4.9SkeħJTy!_'3㬪9~sz٘c*YBc ?cBB:⼞\Q7h3%~vmXߵSqP4Pf`FnHe6_J*w pP *@WrC•Yb \p`o)nd|4Nߺ2_ =kQH1MouK1N}awD=2SrIXW&kd;F?{&`!(ӄww1 njM anLHi|AblXG@OO|q:c؞mptvL=}JXXhrgG)5( T^T7?A8#FS<[ȶ+GA7Hd9I׆EP2F`.'Ysz,8 ,ZDL}29vw3= aO* ##] Z JlM)j뽧X^;@Zzuz|g?8jLNN}ΖiN;-M83N'goz7?uWwlPS((Aw2g-^)X}^'f\?_HH<|Gh@N*yRrjah1tv1̼5##jb6DJ,)P# QTQǻ|wAOaD Y4L :窫gf*Zr2ODg ãjkUzrU0k;d*M ݂ 57'nQ+rjjL r'[9qj*b (lQȧoS(KjJV#Xxo5 KK9|kT[^~n>!d- ߗn}ڭz O&3l#Ġ| =:Q<:z;QѾr HDGQ%IMa2rv՗]3-$rQ#ϪnԏPՋظUF܆!|d.$6@=zd21J%mnp5.r{eRD7t]C;Yv#bm5g bbmGF]{Y9${4` )%Ţ$x?d _3hlvniqwvj*\74؍}{GɂOM෫GLTlHk2 ܸؔ A oy+&%b=ƥb&VwU N4 Pաm\៩s;^?TV_!>"ZJ(NkόGeDM%a~Z`p(`UaХW^m_N M6( `) moE*"F01FmaXs]ݍ_jTBhe\mWuHV}J=OD-&I'?@|b7rTc (_N-˳O~Ss{=oX KW8\[9<⻷ d5ӠxHإܰ0"'H& >nǝt)ޙ*ymp.,z>rֿT>V4{ %3f(݇n! ,J\$p^M݌&,n|9tCe~f˅ _c&(u;&S.5mb.hDs*9QS,:AY]Xm^sXO7XVHmzTWa:_IqL nN,3Дm9K2|]$Yqf}a8LC:βY߬,4MbBwnA3˟ĄRȑG+d wVe>-ȕh78jq͕^ʙv:pUƜZwEU(AH%cUs3Ax?ӵơmz#QJ&^Tux#ePcy1+;w.?D0: ^s,&V?yVhӶK0$kQ:14#jՊW>x6Fe5e+mwMc']izQdT aFKoמEDjF -0}f8I:`N%2HU;$PF#+ԙH)nMRa Ơ-+?yM+#:/S;j6љ\7SBcaqZ]>yPR./. <6Y{*NJ]86uN.yr1<ֺHԠឩŇeR{N xZYPHt )ġWyP>C5vZL39ԓW&A ;zB(TWvIwZsĮglž)v ;Җǖr'|‹DY(]ufs QQ(;'}[,tNGkQ۾|,:X↬W<6.0€@'X߻ '# \Z9FRSB[t38L` NL pVOV V[הEAlU$IDtFB5A3_Yc%h$qUD;e &'ýG}z|51xhl?}azqZFhJSc &vMl eC XَfUOyw;jE G耊WltUTaSU/cEm3=f=΀tlhq8ORpQWUCgGه Z5'+k?A7ff18C)z~)bNҥb\0gQ ^;Z_n.|$A>UUͬ6y)d`&1#Qg|N[B=;OEUYll̛QA(Q[~|T hs#V0;G$KAJ]{&$t಄d|MfI3O\_uf WE$h)Ď4ݼ5 ]s~RTMlo@o(-0@ڇvLR\ر}: kؖ4kF\űx:IimL!)z+q\a*[HX*ӂ {'Hcr5]>eD@ӜA"_Lt=/-mP=!"EfΤ[22C p_mYK@2k3D `"/G4C- fnZZ] !;uAX%]W6[h5*aeŢ1UEYmR#uiđZn^T}PΔ6@팟ac'X o[J'J}?)ň_B Jڪq=Q A[Bw4Vk{w"+%3:u0O=f[х_@/t"6)_s1j⽐2NAn'5wUsi>,$tKqO@1304 %osj8."o$ł`r1-.6=e4H.k+Uw{!fZq(򚯷M.ٌkc?/zrdNwK\ۢ,JR=VI./e4XFNҨ˽[_d]esGB 8q~ ! iU`TU}ś)ѽu0Q!l´sS5jRgrGյ(ۑ8Jw.Ç9sRs4$ޯ[5b8}a]u HAx}bإAk4J輮XԊ<_@gqG}{3Jg4iuB⼻q\yhl=W}@fL_iNr?lYe'xHܼF3"M">ƹ)٢ w1P;7vC(yxll}@S3-O'V(_V^uEgٜ!+8A2gw0t1/bX>hD4~ֵz]MydFT 3Dj2.d6MWHks.MF bw~XJz ཱུ|> P=C>7j6pCZEfHWM4&2;ɚBL.kxx@+6Bi*Lk{УeYcLЭ_Yoku,܁i,u|_n:KrrK$ $MVn׺JA>0OtOrzOƔoi$TTI;q<4kY5v5!Ok`@/u#GT BfA']U|X<ҒX 4,(M7 AJL]E;ʻ/IEޡ#TQ[*_ ͅ ӁLIԗe0ͅ* JWDy;OҞc@cB} 4%uEN$曉InIfTxN$zK+rʦvE,!st9*XvMr Y"À!a 0-/ Q?@êfsUqk9_RСf&idGj,Y 雎~A/N4Ĉ[gC.fxT$58bt"P/FMN_}& Ǣ~|~kT/bn}QNS'Jۂ|Yd+U]϶zs4ѳ\'RLv*4H= 74ǰA6;=߆q{I1jp;&AͰ.70Mي0<2*yoxWHncM աds\@*zMCi.D[W\q;XS7P=(M乷oC:8.TJ>gX.΋_^xn*cgjk+H|kg+zi`&]1iaJ $ Xϱwpa\nZk L֔8~.w~_ZLK=pcmv{pI`K.o(wf$w˩*ԙ4ыug>Hs3,MKۡi:LF2Cn`-1ysro=Nȩ!ęgpb2aPYQQ0}&pO#T]!U#oAex.JGFKNf׃4ohrd@'!z׭RsF/̠ v&F^:(8'p/GmZ8e\6x,]k㽄D10l} =^F1Cڨߙ<-EZ7#BG/ ~/Zrl M rL^)'MiRAm:Şax*;{9srCs~{Wu' ?Ol6 Dgv D ɹ7gv 3,-y̹2`bYT+o 0|w+  ~f7 mWpFo"Os-~Ep o!ţp{O(sѫ fj@ͦ۾B/S~?9GЖ8m6,{ςT $z%f(Kysy)]<~Lr2Wg4O1,^̚jEy=Yg,dNqh1qTwMф~Lv%`xaZ&`qxQ.Y?./]G>ƨ0~‹_/*37Nk"NGH9a@|PB* RoUO\˝hXAFqpduGLE(M~IJ;d[Ah\(2AqhiULs˫BwXY|_D?y ?Lf\VcXףv> T RAztBcXAqjaQ\NRd“2q:- - TSL`@/6@RBZ$`ZJS|)m /7|!pV]YbO4QvfT  Pۊ$΁<1.Rz% SMPaGn# x%R|UGڇh00k' S٫{NbHA'|# 7E7@ZYji#',zaK>{ObTx.To@Sģ^WKz.MZY=ޟr&NH-\qIZx2Oba& @ZK0dduC/}9'<,kd ۂ8:L_|p8*V4d4ţլen S4sڰzYzXZ2:^kD̴1Y_YNLJg jpɚ)R*֋_s8y ;iÎ-t`_[U&"I,([hĽZUf֝.#8VVs/5-c]):өWt#A=3:].'fFϦK:Z ՞w9[ P"32 n~q QYgOI7@QHAhd4l*fV'@u>(ͪ{O: Iä+"MD-Ձ~ǿ2OeD@7ԕنIWb% ?:'G牧$"ާy #AnCH15ۅ9?*a?WNK-~BT x&uKQ^Z"*e+&~Ewo˭V:Mv>J٭أcDeR@ךNj44Y`!t_pw)h ^MWiMei5D769GZ5)"cyp В\=wI6 7+!AJc5*R}k7ߛ2JNj,Jy5$$͘uDX} p83 ܻ (n? JB>ձ+P~ܵ[qї=MKpv2w>??@J/1[)¿$Nˈ6Ե)nejӼjXm"7Y҇Lsf9sWQxg_8>>> tk'pPq"doIC3>,nu3 8gD$"37~lovzU&[:8{a,sVZG%ȞntYuq:%k((5EkJav{8o W`J7v; Xp76/*Rǹ55ꉞ#]{TmTJNwg2 7sA}LWuĮ5<)g BzZ%mUriļk>* _ 1l܂Vm.ycs.y$PN k>BR(X5XJ~3#]D#챩.њx6VrCyv4Z/oWvӥAob Sm^"CJ|b8Ԅzf/(p(G0}<8eID?6rKQSF,P<[Y~- El"aFCU5Y;;Vf 4TEfvTa}K1Q aL幁NW9txk>2ďp $=~=~u9/'1@U<{Ofi M璅iHE v}ohGb 09m.ٛe:{I}2~/[xQĵ.IBPOʨn$s̳\ b4@5q%wĎ j+RƦDU!4mp6gSj1'.Iؼb*tBTyQiͼi; _v"@lH~9>wȀCNn;ַG΄ĸ眖>{3nAwWl#4[bct慣]a28Mx!Xt(ǨEz~C(Z?G3f9 tOA&:tɼe8zW/uf3z"ς+^0V490C51Y3)HL`{2M;er 5ɒVf+R Q/ZMCVwB` !Ĩa.A J׹aK*CfvyeǒLȪ!^,GB# %)R.y ςIp,LUD&wJm2 tM[x U|NqpƎ٣%(cSnCT}Cfk{f[*|rwum& 1d9@X]u7îb` "W| ^><{*;^QRκm zD*0VVO&@9a0Ye~ ݂ j}P5pMը\ﻸʾeUBlmr%@]5<$tIMȦ4Y:o%_,tfʂT"r_>"fL:xC^9'@+|!)ٴOyi}k.7'3@Ex4R/N&S7ug9jq@Џ|ev =q2̸*%WəxXnj)C4Pjr|#X Cu(Θťt'p\pxjjq aZ: 4iU`@ED j7j~j9oAI 9fzjl B|k`BcHs"1|xkFU˦ix[k k\] F΢X.gԷ0D184T֏&"o*˦R-{@췙GTOі$ɟvx ȷ4zTtKυ=Ev<$ĺi]%ɒ-rgP@%4CʱxX1SXR9eަOJC+9>\O@#C Ii!@F<=_H`ob`P%3&R NvM2d=-s9 קY :Y%$9%nnw#xtck U^~k;KnWpnxzЮv@J!XCi[&8vGp8 L9} .lD52#þ&os$9 ?L|#4Ai}Q:>%{XrĢ&'$<J$XOcȍB$o\PZۓ;n0UjKcx G| Ubr>4HWXh8/AK!iaJjز9C8e˜}Fvzbf,٣4Oo][=G?);¡~oy9S7W N0k')'NL|7eO8|Á0;5wi5?/@u[ f=}6)pCyg_ecM2ͤ9vaW+te#?t;HOwҕ]"dW@M&ã{rGfYH:?c'RZ~DD5^I㨾i@&5x.Zf` /XYbKuիoAc"j`wq?Y@2S,o:Q #yX,v@^mE~/N5~>o(K@'3c"$3;@{[ֆTdkjAŹ]R]Ioڒ^PB&SR8Nk=}2usC})|׿AwPV JOyߦ6[!e Uiƈ+U:w t=M#i^rsr)-h΄Oa[8PLG52B//YmW9>n '(-AwOXE7q2^b7zv1n:82pdB9WiNwKDMn|BaD {:=]Xa;d" %-dz0ӽL ߻g8CX MBL˘Ѡ7ǹ?WNjLFQv|bV:QSm2 fuaSD S4SV/F~j.\930$܄m]!1Z|n7F:204LQplxE@kA+ToJZl}O/ kU!B*LlIڀ!e!H")lD—z>W*\yWQ$PH mcFd0Hz5v#;]ciGsnmר-Vd 1s9`#Hq%Z@=<,J|Jk~Cq=zTJ3jOE оp /bʈ3 LĬ"HpM78]^G{dXek*"}\7REU7rc%D?we p,_ڭaz)ۈ ]-|փz͐RvSqC}D Jz52-(`Q0I^NcMec.;Jl9Vs` [.-1,G<. 1ۜܵ_\(kX80 r! 2nWZ.ǕJw9j-Ɓ"EzYkvXHzGv4rDZAw@P!vFV88`&vA;ݪJ}qmpuRx҄dž{ G^}^=y]K %c7ik9ܑY8An[ S^S$kg/B]if9`^u~D»Ns_NX\loi~wR}!Rկ [qڋOFQDAR'%q#(wؾ)Ka#;C,i“Ӛqz aʟ B/ * M^]|'9+L"Umg.%-ryys*k׶ILjW̃c[ o+s0 !rRzY;'?oE'LE_QFr:*w:>CAt |aW]JAu:񂫀n;WҶ`yU{~zoojC(sHs*PM6x,w;kæ~ڒAAP^DyH|[=1\ch4#`w2 yeE! Gpd l^#IQbY4wNN"0\P\InFˊ7i%h> ޮ.>;ڣbC ~vqF,-x, _X<%*h~wCF޸{0h.iA;ϒdPՕZ% DLв =n*JШ|Mz "PzũQK=#P#:@ypPww0-"~5{vY!CP7R⨅RRR0/=z+%ٍrXmCk aBT @F*Jp*Y3ksh& ĎHxUt;G#xddD5c&G,9kP]$70u*y~GSOYa˃U9erRLĈS㔇Y>]= s\O #]9(-4a=-zI?-^y]0ձETgn0#A h^`9 ]pUA3~3x0Yzu,G{`~GJOf_S<{&yM&kI.D8⹟M'BBYZaP 0uw,8zs(yhb]!nL|XBbKݻdPA %}Du;cOzՍ D %cWvIL<Ǚ ~KΆDYrC~9zW8[,[Z b~9\[H?e9Wd6VY6Do^B a]%vn~# S y⤉ PơX4Hd @~QM RrpHHfkL KUҕx-[{D%|mݾR%3@pkb2yRx ΰ҈g}[Ѹgdq?L :Z2 "sIjFCvޚI~eB@E'NI#K!gy@!X&{pGq^:E=P}PL4\Zr\ȁa4oxᎿoII L{8dWOw8 vkWCiW30c864(q`b1kYP @U$ßD<и譊[MAq ALނT cyWmLU4~wU ##\t#_zwqDyG e"Z2K 1 (+n!HPyAI"7Xࣞ),4scjGD6%YrJ˛7MJ01{qvW;Xf\ a 9z5%eF Bnt >T~؃~ZYV!pWӭ?ړ QLΧ&@'Ɂ캹Uﰀoz漼)¨KV16/o О0Ǔ(*6qX::.uLnv$z>$JW%_$usn<h+\ 8zmYځ^X*6%axK VrvQ/%qNq!n>vQ '_t(*^4WڣPl읕hYR-h\ӷve mXh^4.-&ha5u8byB>bzl5u!n'VZ"| IxPT8/^;J뒅OաGcἜ.H 'P]xSZ9B]Y!l&D71b{̅%0DN.9 @ S5 㗶y26@ecWjE_ZSɄ> ݍրyLp=xOr'ѫMeO ޗC |]ѭ[ݷOcꉍ 2 I@']ƃ$st yc|&J/y\*ca,2Bs"xuuuC\pEMљ~PrٌȰv T0dUj+RA2bؾT=)qZ;0S|aڂi_/df@;ŭY1~hNȾLVe6j)ʏ)ճ_~&HXĻ2JdTDPr[W-zqMzN>"hE -=|hω&'JyBF(,'ӎQv'VRj{炖t|Yng<{ ^R69yꡦ0R񋑐1zk0]9\yB_D|7 aL4Qrh (r6Mi±IF<5rqUO{{(P2'ao0S{y.Cg5C9 ̒'&a2< L6KlJ yP~7cS&UkOOVB)x]UYb3޾@{ŋL}cDu'w #xDU1.مY5綸ʚՔkA+Z|arZu, [}te~oCay4pXؘ՛2Dcq66 S= cS=~zx.4@/J8o&14%pW٢\}vaG(r$@)!(ho[iV@ȈQ܅ށy3%Edd´+L=)̬uL"%mp; :0:@>gEZH'z^.deQz'.N% "]h<ɖƕ 6vDZ\/⧽jqG +<:q|U#6d9QCFCH+gs{0DRg;ZKk3 o \ͯb<ȃ$ݤ rC0=UU'WcQZoEi,]D%K;E|Rw,,i-RO6$,EKǤ{AS,8mcL>$,Cm52 |j]M 4Qy;l⭎:ĢfGڏTS6(:8+E-I,!x;;~7J/ƒ) 3r V7-&j63w'%MS"zH՚:J{uB©4Z7BBD,5ݨf?}W0{%atk@1@DtH,8ORbڔ@ ?}#kELW**눻|>ت6,bzt`~z +%]Ȝ{5Yf6)+]y&\Be½- R&`FLAn_t[{Nt_hR!7Ő0$Xf]l鶍6}9Qi. J;S쳍*4Qx;VPǧr{Lcҳ( 8 d_Y0:̦foxv&= QrpRey<,R_8ׇCuXESZ}c>v4SQ 0nDQͫ8(TG' )G[z}6-65 N UA}b d-9IQ&-aPBԃ2 R(ߋxhưB'd$Ofl бF°٢愦F[w TXZE_fMamn+::4 *# 0ԆpD8}NeάLY݃I$A7SA\凫YkZ ʽOidZ~ '=No>; Nr.\֗(5^8\h_cV-:"A`_]Qʜ&!geJYrͤj]Kz4#yLe+1k8f;~"d;=1D,_<8IَEbt)Z()SrI6 CN#t5i~DEqMO6 .)$XM{q5'Lo2 +ŞBYԻj oFZ{f26~ْ:g)+UJgRnsz|xǼ%HWmjGnJsQp);EV'kN_Ϯ*MAJqDf @e{Xh[/}.s-xJ8v]cviCG=e2K Vw~Rf\OGy|R]i4c'Qsd13n%۩([ROz$&31XfwQ1|?]t0ţש[dJk0 *el+b]6q ޙyGw;q_GUo1%RĨ0 ;Dm!凜l"oMd >{* \}J4/ Yh)I,^m"sT)߮s)e=!A3,Dɺ:\z̨nl`1aaJ.1WOt Aچ<ԋ=B٢ƃЈ?#}["L}lk"h)0ʒJM5bAlC@83l&񹇽I *-K$u]ˁ`3568Dfc_%z0;10U;[B Q/删ZP);w`-? sr' Qn c.$.A¿Ty .P{w4J]z3CveC>{[I zTu+Б'چ?j<$\;[ḑ4M`Fxz5>L`?p[LLX*] R_-$RQ#\=*˦~F "$` `DălŃc #-W=^)xH]%Y , ^λ3(}h^9BZR!j!J66Wiï8®9jN Nqhv w y?>QO'&jYy3WNU=R@)*=xԼ)\#ӦiMݯ:|k(>/V!&Dܜ9$5jqffY5gMbuk u7 vrݸD(rr~s+x \Kzjgl| S l JK/js+ru8 i&Ȓy%su\e krNf ,(Y VmDRdVY/ZVlHU0W=&Q<*3i YBX _ Y2lJgBʔG#&OulDy9.~Opa]xo<`W8PB p`BO͘ơarx/mU]>>b;nVn )^`fw=[ˊ&YxjTw{(\ y M`ubpnڴ4^eW)7PB-ƇYxY$ Y: i .E"+͍$snHdm*V~gde+%g3Ǖ Ee2i50}+:1}l0 |#&^aA}95#XCdj6kb(nEl cǨ<}޸VK@Anr7#K0 <śӄL!5J ;D8}3od9u4-c(]{΋"\P~pPmB2''\OZ0Ё_%6!ŠG&RUJ;,`V,aO"(Mv 1MYf|"ZLdrjV/%ȓQPAF=4|")+GcjmHI Bd;nnSN)n.XRJ\B'Q2+ )g"cU鸋.d. &TUҙ0j1m<pz1 Q}&qi`XHqϬ#>k.z|6Iv'3!EG {Hgӳ~K;*7)&(8rXs"hҘK,/\.wE{3 k w A'%=%)\1)PTڒ_x~ *e[fc'I`SvѲ4fC^wdp[YK0'q<2 I,$'Cޯ'(LȌsK޲홛(b{L75|1x׫m9ɼGyJoܳsDX:.Ns][?<ڀXX/J,1A(7|W5S)e_$6H5r'$zcJ"#(!:[rAr>*bgR4~f'˲tSCKF8+KJNh]SޱX%HIP0UKtx8!jDe{w$3dj̼:p=Uu.e(&DڏD Z9剼\l`R.}/@!TZ@R;n>tx4 @DǡӸAl%Ec\}#㠄Ry)FM]?(`er͚UC1&} 'Z &l@7B*$Il+Ic:{+'{(xK x|4Dt0݉= T"Xrnrb%4?6wu_-)p1ner|xttz4+]i7^!7v#ﱉpvْ1V>Udz? mLJ}*Q+<>BB⪧\uX К/8(1dH͊tzPTȑ,Rjpi%bkOȼf]>l^nZPS#zo{cy7~1Z<'7/|̼":]q.y/J[v[ a 1UclKz{uJ #$]CW R,I䯾nJDJY,![ð}wEJ3duX޴F44j c5ARfs1%ò8cHjYpX س>TQ **_cOr?4؊EU#:ђB5U b06nY$O>;V^nX.9| Tidځd2PအD֥5JtÊAWZ+{z#.A@= kcɃ4U=Kexg ]q9i?+NxͲJnM+Rc/V*P\֦)XnIm4Y @P2z/:n hS0KjD,ی%Y׽ jQԖBZ=|Ycӏ[u1@^ưe4{A.W2JvI q 6~{`c/S\;whwj6Lń"H띍ۅ'@2mCֳ%OY)xȈ*צ~lE0EeUDA">;)YQl$=zx휾qp|g@13J^DS+cP F߀7}wQ'ùIi,_KxI/l8ـrtqQG"Kjb|rOȯ⛨-栙>P1q>g&҇2ZڰQ9U$6,|9_L4kP6N{t@ k9АsClbG)6yO֔0OubaeOZ_lN U&|WSXt1b-lϖ!#q6-”ڏmJE1ۻ%jɫ*e=QۤKO^, {S: ]CU\ۧ={OBY؜= qBlrr|ꬭ ڞrmZ rw=1y̡}< Hq.R!W8!‡|cQsڀ5(9*>&lR|!I$z$,m,H 'xZU i}%G"֟kTGSg(*XqiFs=>dJ /x,ڳJ>6`B_QS1Xt uӰW!ڋTĽ?$l3h>˲"~v#G6|ҷ/fE Cfj~Wz툷%^0z{]`"@EX8}EUi.^+8`Χ=!vs]_@aeO< M[9 :͑p[w.${Tԭ~&gM 7Bm+Bpo:[vۦٜ'$>Rjb~ŞZ͇0J3;V8v[ݕf}[sxM(ʻ3D6:L J0xώ\Bڭ1~bBmfN2,G+Ɨ6I ƹ#1F3[gE) ,8c]pdQ= t ]ox_\;,i0Ҋ?0xZ]"4|> u sΡ<$b1`)Ë_u,#n ݺIf\T\pWPK9W:=@3B}\o0' ТCHAqpni];BQ݉o*Պx83^Qʟ6P&nݶhix\Ȫ <URrOӍqw¹ xi?9RL*ELBe K|IϞ} Jd'jTSʕMG"NFhۊ Xw=e30۪gvf*=% "U@ϵ9Y!,o͘ga PU!s.*<RU|-m<RuyQgSyHcMPYAi&'N@o]cAqyqxT~a s< uvTttb"Q:X#Ӎ`pJWeX.E$64O!EAՍ1}5lE(;V3F*J燲jl_TǀL<;a#ͪ|~tBln2l*D6m[%{Gԏ͝5Y*!/K'~|$s`xV{%Zrhl6GӡvDz0K V1Y4uݣ jI9ʱnbdhԖ5g}0C}j6tTiYa%ֲփHYkYgnTWasv^dmjSXX:6+_6< "@vz<3]2pMS 2u+1bC92f_ M渉Gxä` 0N;ltg4kIWNU*:h|4 ׎*[5%T}9I.w#i4D`4aCKWv+cCs1uP"ƩRtbUI*Zv&O3}1_ yftMI@|ɃGDm[,,B_B>sT\`DY5cnnA.f}*Cy8wy(/n G^ad8T^8tmZ; &>IӢγ/uny˥"0G6HQ@{c%l=M]!#ӖhLհROW.ʫ(Pz֗4C}yIR>) 4e"=[}:gWPY8?J_D;N;y8 ה((@cd8RS|WHUe !f#CX׳-M&/lsAZplO (Ӗ89+ϑZ8kfPpr!@&|ݟ\+;!ƐżUD'|y%y BgP7 -6AİsCw'At \u+6@s˸dSS-7|o3te*D z Nb;V?qTJԻ_vNWf 6RƠ:6ŰVzg :)Sl>,ɳ'B=WS!W4t Vv#ݐo&wSԊF1|*DC{6Q8SJD3`Pnܩq*EwtHqLƧϦuf>,d+U1_ZZnlDSmŌ,#t `x+Əj:۽>$1t\8VLŃm;iy$AJdGOSq~2_-~v()`˞l*_9 gC2XlYZ]թ̅[G cCr:s\4 )݄c5^Rn#1>yJ2xQ`mE93gi7WdJՃ歷EQQ#?o9˞Q ^)vD3xڨ(ipWEZؘR1\kܪI܍1 tG4T<дl:Ai?[! ':j&BѦk;iY.W3FN2#`;z;P7{sVIoܸa?-3#e/Sfei.fAqcH Jnsp lnB,"{k Tk!SU[Y-Q5UՑ+>.b=ή$#ٶvN"+WJZw"r .K!U&ZC@'s= 4N/"^*I0pvdߜ XBbi .=5PZo^3 i ;^L07 E!)h%ԻUy7>shr&^tr7-7LK|\2dP "&񋓐=%^ZI_GTS#T(xx8[`%ʞBJ֣E7ttˡq[ )}rv8[$`;,BqZǰj ])d;"-]VckL'^kH=tukkڥ\Dl {2's3uNQ8L2!a[m< Xjmy߫7#;0*KCS?f?ie@zSWʲrm[ 7PcOkBV g`gH=tU~EkyѰ`mU%E!3OJ*\>*;[ S$2ߔ`D|fu%]E'9;6؄L}]A0#! U\)JQCBv )z+^bu}"K~ysHKˍI->sYk?g]8DCF833M}UB3OV%WRSi*bŻ|{YsNt"g8y j4+*~Tz%ll+\4\T Ei]I+Yؓ.YzGv"Lwa.44j`c\ciaXnn93Pw[+!H@|Z^R2Gm ` 0<;IEeqO .u3&A5$y3C5@oNM-/y#Ϩˣ-9M;g(Qs ػ0;1nk[޻nZ]OF,*x3).=L7N1tykH?*-ͪtߏKx8g!5 +* i$DN\sM(Z>jE pVlwp\Di@kWz;Rrl #Q ( oL)`:oz^6aE`WV&oWbGTy=SB S,U)b|M5WeŹkz>ՉB)3]>mI<(]M)h H|B'w1MB=λ4e -Vu7rbVЁ:Ƌ[-4x'̕q{sfSӻm^Q=pן(OVl2=g S whni׋ޤV!X<(1EQqb՘X"\r% i!7-~SPg!~$5%'<8VnX&= OSbMMYh =zl8Cen?'VZ%l[HJU|yJ9HuIjSkഒ|nI+&7z;6t;܀ӡƿC|Sƃ=iA_}CpzYs<S5ś#.P-khԼ<0F^#_@z'rF|G!,J(.ˆk~8 `svQ-=kh8RX֔)w@dr1M98W@'*R/Rr4f$ i -ցI3w h)IѤre&%c[$b\`pB}1bwh2H@f[Muts>˞"bfO?sz,#R\lA0X ~R{@jqTe" pMG'$[VՏWu]bLMt5T רa_@cBHUcw{tZaK79Ed:!:']*ⵛݧw;IV\f b]2*?e'Vo\gDV_3lqJ]d0vU-;]$s+_ -w@ۿfMCC{dp9bܤnI:L ,@ubY HiU&bH7Dw$.s&$_y'Q 6WLHtoUᆙҍYlE(8f~Ҩ*AI FLf4v0 r#ϞmU߱ű4ٙ!s5XeĬp檌lSQCj8*ʳsǦ BtSpG0N'&/Cv?N*<[/lԍ m)|r)3oĕ{xm_V񯰮oo&Иmi sI8&0B tor)B*nckJ5/Iq&]0F(΍X2F5Asvh}N]Sܤb(TW9?b\6vZ*}O g"W3%J8Xu|ԝ25;'4D 漶*HNTig'㬭}ZfrN Ƚhe JcZF|UK@O-.g--} $|~;*|Y O G? }ΝLd3\=* 5%yWMM0I_=SЏbqA3!/N8:P!y ˎ3i}B|ё@j'mAP6sM$H* yT;FܭtG/9 (O-a 0NI7kzgUv, \rozP@2= 52I:b~SBbS>݌&DPg%.-H'[N5s=c%^ce-8D0 <`9gzel0}Hyx3섕TfwoHc7c$IG)F?nMV$w՗nE')i)u\3ih!$@AAFl1q@Ԃ+8U[{w9Jp̏]@אa~d @I2yʘ0F|'A07 ,.`9Svs|@TACxyxeFS I Go{jo$/#Dx J?H6z{5! UM((`O0;({2' D_Twz,3:] ʇT_1C;vǵUVB|!aJˬ:ޏ .h#{%Ec#!c8+ wX4XB:] \5 d%@}#wE68ipi _!#D+ԗ{x7/'VڸL3zi$oוIIy&~*@4&14=fx}DFV&yI.HmЅ.V-r떟WëŇXNrdF=&BƪȠjf1jﾪw]WqghR{Ӟr{ZdӼOs9cLeKTLG̀Yrda(JdͲNUj.lEu&6\5 bgn$,dxg d Pm/qɸPz("f[L؉6g=3kID:7i mΉـuw_u|JV X~#WůG-d$/Aw\"uew ?Di3O04))]mwpn$?:U[ȷYh0C>[TG2%vUdoT ڡOj)ĵ\ַQSdi:qʳ@x1/3ih{:\jsrOwvXs~'y9&1_[왼ji@! HR){m!*g,Ta-vb1{h_,tI|w?q;`H//#.&قֈ= ?n]j8qvKE eOvΞN PvH{?ll:Q'`قdy;!:PXR$5eG6rmXABN-:2:ovy:džŴAc[lo5#o yE5.RmIqDRH6zxzxTOטY ?^AGI-Yb_h6 O=M8hCٕ`9O6qGSC4V -w$:_Μ8f,֓EZ6f_mO'"zxųU|geǮJ6K+`}|&.K z-nۧ IN3U]?f`)6c' P@hQ fCէT^>$ղmK&`h?qΣ*ǫn&Y楽l+}1> i_? Z-t;Ũ,7Cqr8 /j*NB,=TIYE ̸1C#8mhTFgww qECe{_1GH޺GyG-[Jt?"5E' s_H׮,Lg!lbAWpbgQT;U6bL$ T _6AU9ſS3 9IuRi-lf0dz&59Ofq^5>Ǡ5ݺ2 aq"jA XJ sP W/_`lW؄1Bh Saɹi&\_ōdܵ oѮj,aR~۫?u4"yD+ vŞNŔtd[(k)h^Y JmV X#Q$7s ͉B`(k8=Xj?`9+uA:YƋA{ތI`L6͔"Mc%4n}iM42KnjOvZ.>-5l4 ߉$: OOd9+K\44PAͣRnmGr=h*$Sl^$~䮒s,WXdFLsJ{aC5G_2 _6ƼX;+"ȸCx`P99 ^Q?S-ZVf7A,KVX'Ⱦ5fl {J@=xN$fիYarPeiq^"8wf}pgaFgdFOR7S}kSB$"W:-WDIФ-ӂrdI ˯cȪrrc3/ٻ zk|k3<b?A;Hh+/Y@Hk\ {mTLgj8[;̌BH6a5&v͜Ұ3o4˕< 5+: ,/J|CY-^ Kktj^ŠljY2)Y+Laf~6QtY"[& /2O=u=v!n2d(CoH|Lz;Cx|( }w (Et'[$~5s_r\F.bPCpE!&R&=d1gs[P;>S{|\zS*ARbBf[A9ax8ZR.jLS8M8ֈ٨փ> z-ںPQ&S($Hg:{|ж6a-lX1{1HOpeȳ?e0Ÿ6/c!Sƙvvϗ\T ?$Y`XT45"uW)'B+uHTgZݧ<7FƱvY<p׹e>b\rFGyH L׺tgBqC: 7kA&T.qz&(.:oT`C]rw*#PGN`E(;Jecgkf-%,9_y EYӄ&5:K ueꐕV]u~8,FgrAsi.mPЊiݧӜH# $j.=y:VCzбol`key&t3LbeSVvcj TS^0gQz"8 {j $K?$AK|Q";i1ÇK0'~QvQ@ő'u .gl ίxtL.c r1,6+=vXKx(4Y(C< R)f|f{jq [iֻ7Ub()3#RqI bʐ?:^W%g A^>^ǾSG>VcE6AOǻY<~Z(!nש`"nIBY#GЕ*/>*L5!{:`N$Va{fWXS`uA{1QtpɊRqIArbI*^ZrMfe;U6*f`/5qQ*AȵF?7?YR}nEu7&S}w@ (M^>-{=PTfټkB֜;,1I@6x5*Ie}OҎL}lu6ߡ0t Mc>!G5`a\)dZ|<L{dKJy#H BN[m=Wfj~Qs TN.Lȇ^翙1?`1i=Ǻqn G~=QVD_,okcۋH]ֆIꍻ1C-T@{ +:Q9$q[^\5# ϥbˉCr:W`_scpû1&/A&p}IM7J.G1^ 7Eƭcc5şDUz?滜u:02-[gʂX:= EB0lu!o]Z"sKLvU} <\A;e`<_pg GhQpYY9r`o[*u1#mbm߼\X_͡nQtShzB,lZxC#6zA| !"?ߒEh~evWryCi&-[.Ė[ b_4;> dFpxMWPXZ9`J>"CmP42[n&Di2UYhQrU[E:~2ˇW.ĩy0;IivsW"Ut1 'לMT%֝~||]+ZѢFA X$'5fGy5 K`R$,&bA2u70 MJزDS[$h;?kA!mU`@\Щl hfjtۮ3f i 6t%\ +;ӱw=J{I8S @K/.,f^I ΑNZK˃Gc䍙OQg*3d:5εZh i[oo*["ܿ#}'q8Xh]TXA+2;ιV‹8r%D/^Zk(>?v.od$>v1րd.kTmwe]VgR5f֗`鏨gz&XEs'P,XU}7r̢V'?b L6͢z0惄b!)E^M. [[ Gtq^T>}WnOT8~:5p28@S!V8 0p`GI*FMޤ*P]ϹNL;v( 0۪eZ2agjvJ暷kktᨛfLt3a3SD/J69: |6\y%N ڒ3c5-|ɍ=(?*XZLu&o?VF}PY9ҺšZXkl NxC}k Wɬ [2yet";u&wg%P? =ͪJ>.Lhěͼ ިT}Yҕ2To;Px Ͼ.|Eʂ[8^uB?Ng@]CJh]f5$KC0Sw.zwKX$3XBzav*DZ{!ni2x3LG>;y7ƽ@zndJ iCp]odI^P{ۤ Smrǚf XSzO.eX~Mm4o"-+R rs\uMb=a6,iعFۗ8i,!?U{*\x~{zvڃl0{ZWxf|_e.ɝ@yÆ\1&3,Kծ͈\hFOMo*5A2_l |ZMzoa٥l̈́F N e-,[hALƌZӟ8V8oG+".׎2kX`WVu=: }W(d "x*vCvb ^W*;V̲{~_Gr 7κk^NgDͽp^HOQ4Q|4Sc4C~WrTf%ArDnA)!.We[\:*h(m*s,Qu&Ssɕ_G=!3^qq%9f䊮OH!"Pݔ QK@> uc S+I xskЯl] F$dS) >z\E@k/#r5 OvV,lU9X0E3sP5Y^K%z8$㋸7' 砫E+vھPo.*_mOTUB,<Yfͯ!TTYNkspǂ3jegfLՂꖑj%1d?"P*Kn?>Gဆ- |ĭ4FN[z6/)\т^ϼ7Bc~,Xx !c}>cG=w2ixTaz#*1E&D]G~RHt%[hf:a Cx%|Jl`8.(H] I Y*[f {m,. o#iid<<@tk:%` GɡO&=|Widfj􀷀* /Ĩ> 'x 2KdX(j;R؃BjoWQ x ~g׃遙bp#rS1ZbgQyZۋ]iWdI8 {WD!ʮǵhCƉJ"a|bZ)I,R\%K?ãVJv\{bC?َ"caܗ@?{l6 \yo Ab`4tEѽ5kNHFד4U5kv(d!gfFO0bQqqwBi6Zқ.}[FOB}\pClb9Jѷcp*-"!6sډ9tuq5m`"V Gq<447&}D/@h "ھ0%fA8S(z aχuigEޔ=Tdfw|QO\/&P=n>*VLmV.E_ l$b+=8@DD䩟;eA[P3fmL{AhX+ov MR[7[a>֩l/r8* &I3<@ o ;#K=/fQ\p hT`Ra>D,H:2hCJXPAirzqa\˂> ++rbV S4;]5/eꀤ \:LN5DR #)yB=yU!5g}WΈՂMCX$;57VAlNK+0?&z~;޽&1(?t}E%^W1,9m1V;#SzB3\kH_DEgK`&87 x!JsBshH )&qADyLarݿ9Н= J6~@[6=!;%f8S[=s<58uCP'BK-QZ  {gf"L@SٿWD͖ЂD=vMd{0{,.)Ȝ4⤱d(5Bؕwؓd?Y[ѷӣ=ȷӪ':^<&XEEar@9RИ3edBs pzsz&LU8q { h1njRP onL៰rUĶ>܁3"{(ـ!'р;Ku{SH0U\9/<b%2zҗ۠u߃)X t-L)ĺ U^Ͼ+ ߚsBhBx$5I Ggij`e,@ćmѪ#T髢=~N+ξc3Ȯ"T-gQ"M:^0yi1?X6a/܍aɦbczCS<1u h[worV gHQTk8\0Fӆ(QFm?_BB#n[BzYdt f o6λ^_˟oDEBWom`މ+mU"xoaDм3gUl܂ =L* 2L>]G+<~ QĈ{VaC'm>(seI, e^Ajc)g%'1ZFԒYJukװXQ,@JԨ,i4!պ]wv}Txևyɚ->ҦI@0jfBV~'bjx@>T6qt}?]CًI rfF$ Qkhf'F+\S^l.aC43g};XeYMR;D~Y21VAIx,1^*3\78oo$7L!;RLlȓµD$ S-iftEl0^̭.;TX'>Y?\C4ao2 *E6̩1o IrMգ nιڿ۾` d9'?7za)zt q&Htނӵ9&: Z "|^ 9@عR XQ!VCQ1\FڪTNRy'2IRyߩ y554#&Ih RE#!4Cٜa]+ @۝ɏB a[;J/vMuqY&8Z3ܫiI 8<-YԿ_aE:xCD6B,ΎPNs l]tsI&Zfkamx( f&~UhRNZ6 Pqy$:DM>*+5Ӣ(3NFX8'݇8?xxoGM3), { >Ҍn!E;[ڻ,W"4Y޾Bϩ"ճ;86Y*b9r#ilbSSNvݶ,ԖT/u!(%դȉSg/H~d}V$‡Z2:%欜j8a͐PES!)K`+=VQHzr_Ŝ4)_#RusI5)0EQTooIӹ)Uz c3?u.R9M=Q Z(-DžjےkLϡ[epuP qaO'LU.~E4br~$Z!\t5ĚtLO^f^?O}jLgֳ)[!Pgq3څ ՒƼնc}A]2Ԕ>"4L/ "NC9f/gb)—δ ٿ!Jv3 :+LB-1r׈j6j$oRw)=8$Y.Dž){ h\ŇK ђʙnlJJYpoA< ц߶!"%aYB9Sf02C45g8/ngEא!7)TP18y=]~rezg*ie0Z^CʝdšX&ڧ0K2l58]t,?]{s2@/ufu h~uC?T@ƕ/4NC&Sq6gRڇ ʒ&s[Mb*AS5%rڣ0O&F#p̏u(r;.&ZQj  a);2ۿ\0kDtoUvO0B,W0dQO$ňώ2XsE t HhԄ:gH?@:` cK~A KBjVU͎#f3Z4r1̫ά3bP7;fZ!VIDRhCJF׭ۍ5LV2WӕQĽ/kL\|^`vGwfmD}plRt Y;^ H,Wh/7jc i,9k`UlTw^և~?dAYR85倗C4ۡf| eP%jV{`Dk3ga-S$KVֆOpcnˁ-:M7x\i`6|΋N& /W$D8,* ڊ,LR=_3޻PzzR=ٝfVB[ɏn$ʙ jt2?3 Yb`4#u^Lʍ{!m,nu儇j>|&LU`~F!G˄^ʚdB8MX^ ݬ˷JцF Jt~-!Mخ& pH(m?)狽<h~!5%1~ MCt=5nq˷[&c쭌p+[$)[k%Co20 R3&hImZ:Aj` QH$RܚU".d)4 ҁIc/zAȫظ˒> l33r̐ H݄U6Pj#C_!INi 1 i#-Պİ12En&Osۂ -IUǤOy^Jz@wAkdepig+ 1zKܭ3ԭQZEx[#XF} &993"5q$iYrRc{kG9_9;!׭hgv6Mu Mv0g @$2쀓@q_O7*4bcl=kTҿEIr4]!L>4^}J`FK v3 GjI^b71l֊p<ɬh#B<•I[\3m>[䢃9ZYCzByiLhq$ {ZJ)пuzQt-ȶӭ<_ُ~姺TOQ?}XEX⛛]P.*e@\>DLWgMaEX^#"PQ r k BZ66 Nid>3(8,!/3P/J(KL%~Y.L jRϺ[!\Zx!BS8?܁9AAxH <_'Us(G L.U鎄_(joz&1&`ρc`/){t3+Zu-þ]9>Q5 0tCO5`_APq e9FxB@?>;)Z77f){xY(Y/]܌ F"qp3$ER2^2܎ڍkqZ*!8rl-J }tZgiN][U 2@\hLh ){Fg&cCliOPlgA) ƱSκ>\Z1p 7[ԫ&z =L ;дmjkwAg c`V`9Taݡ.y:a<20W^Sߣ@t#9%o S?c1 5r|\r(yزTQl3O.v?Cl+P|pG:]y9C$~Tw/ :%,hj~; F[\A|BS>¼ɮ0u2:snqo1.xZ2T;m:cZ#x l_*a H@#bCڪa!#fw,VB>&GjeWCߓĄ6> \Xw[OW<ڶCUg%fVO#/U`fۿ6=er\A)S(ʟX&|rWc_XimcJ" t FCcSǂ 78x;i E|-9ym-Eϳ-&f5O@gCӘv>Fe8D(@r5hϙY෽|hnkFP(+h7Ʋ _ nz6y+5䧭2rc7:ø2>!c~ο+z3SĦHxNRGWIw}9Ԣ4mhIZmXeF{|5Wi˥d gZpx0~J7Lc0$kM*qu -Pɜаlj >2p ܏p/uֽ%_ 9Ȭ Ks}р=ݬi򮽼ߩg}I1(  /tI%Z"8U6Z4 LLC[>ktUG@*)NAr5:RH*~_頖 )*AzK'ǞSh"aR|Qj[WY)uUlV5AK{I{|ycKbUYܺ9eߊKjlb@!<|lsAʀ*r/Κ6JLז~㾔JxDѝ'd^KNx횪 9==г%9˕A}R92o[:-Xx ,ڎP~9T)nǖ=-k Tau8Ym㒕@\m`TG"P S|</L^diEX g͕c^5fEPIYgFO%1QxOkܟ%IG]WѺ|I%[!в+[I,au: eEdqfUQdx,)K>c~!A"I#ލj/3H9Q{=5Z5̙_ 1k%dЙ'H<>4nͫv#8cwW]׀Ae^H|Wl+,.Km{HHݓ:Z?Y.LB6ӴIpgx-<{HϞi^a[S [_cҌK~LPPq[vHoV 3YmBhj礏s;5#0*4_ X>8(=xK(S(l9urѵU uS=t?`c.X4,BZ ؍Sn7ʾ';-oi+ketks{ZsD8H>Ƌv5l lKoh(v0ot;ȟJo:~jzUwK܍5>`/0Ybo]?];ƩM m a n^6R-5hsxy&$=>dx̴/ n: 3/ou}裪507BpZR=HƐ9Ew+';4vV}ܢp\۾bhܓ\~$R %x2%dp ګm0Bq@9^YDP] S _u }L 丰^-c0ųs1[PhD+# >ccpjHYz:%4Y 3ySBL\GT ~Kb F;=\TB:;>585Rm' !.8Z7w~]cq,q0pS ()ުQm9'e]53&]ZFwX\W3Dv:nG6etĉKf{'UIZck]c*k>gTg@%>u9q0Fkk}]!>Qd .9t(}%ZmjkMK33\V5k`.gw 8R?jJvXI-Y)#GlƪCD1^|TɔE#`B<< 7SGY;">qEPEl|D-K}X]^xqN((7e8+1A@ f;cwV"巳{$"dj[Ï=_EBQ 'iWtwC`aFs'ûS2(i 㭝>оC7>ן݂9 ]W~6?g "ɾglC H)Ϊzx2U9-#fF c ;P@xJ-'̞墟B+Fҕ~rBUDhǹt;Bpݼ۞0M !D G4G8w߮+`r߸[rTmX΃kh|<9ݜJ]b@-a)!Wz~Ԍwo57*-u їTǽ z:ez 6jgfɤ/=Xyإ# Y)p91N2u]*򇥗vVUeNV<ٺ^Xݧ`= cSVR"~hݵI/$R}7l0L6\m!7KZr#HYxwLDBN?B>?by}࿯R9b˞L\DQٌf OG]MxZÆ;T׶BE%ϨUp Y16 N"wόП힁Vϖ>% {765ZdݦX@BܯxҍгP3 "?@,㲞3d5[)>~9r܍^fYФL@Y&gCM;?)(>bGgu @V<`ә`KkkUd&3jy߁_35*jI݊O6) ,[` ¨ڧeZt*(<&O6DK.=h;a\#A,=Tn5 Q o#F]6?<~J?^bZ 8pW? j1 ٴonq4YKшeމ4([|OnT{ Pu*ଓ1tǙD4U]L .rwjWfl&0@rjmd DW CBBu fhk6Tz~" / ~EIlڣ#l¶)ʹSp;*R2+jSV-|o??62mԺآ7e/uPԁ i*|߹+הx)1d˙tΟȯa]"n(xǜwIGVIHimwʝYȐ-GҦ@w_p,Z01ͼSJgNnLu}ӡyEջE0GWxٓ+}hb"#1G>!hm{d`w7GzEzۋ@}_nESxW˂#11xk~ K|mIKJO . qcv"< \Lsʄ}v̆mneddry9QĿHX99 IzĄ6.JeCEx\U󲀘QzРd_@Xv'&[˯)\9iB|A" ޑSe \M.."w.}.J1juDωWg?FahDIX"'\wTx~&9ճLtEV:_a7q Ô:tkDJďB)R*@@%J R%}4T;j4R;Ϯ ߦ=??B#MaӨ9w/n;*P1 q@BrIi:gU[ f|i=:n%mYܰғͨK1dvqj(a}#^q:uc -M/XYUj:Zp:-Ӻfx4< ܎oﬡ=,K[s!By%,o4DQ8Q+T{]]8m䈺@qlYtlautiG̱%܌\ jc`Cľbf^8>]"x#[*tF0vMf5%KahNo#&|/ju֔2ز'mO5 pLt1AG{_ýa=09ft:$"3E.쎭&>LqU~wmwe j4bG gmEh]X+p1wNi"ռM'󮶦IBD%R$%b=A0܍"\g:9xs*J8,&13;δ ԟiWk7tͫmR9MQeQZF7#h1RXЇt% J_׍9_S+dP^ҾCnPs'N$DQ ]Vɐ4Nrq>&[vv#CQMo:kO' /:27sWDӤ›Fu'{}Dڟ*WhH[lt"??? .*\3[[>iw o1V(=|3"nuR̥Zfz*z~ˡç޷rfa=i. @PH`LjJ%XYS2o7'Җ|Cyop)-’᪋?ibzڣ8J]w8Ԣ 3܁XXGA&H?F ;=rTv#vd+:6IÑH-Ե.VήD u7Mit>mm.P"[h`26~7v ęBNP }gby`w+m`,Gi@%l[hSr>F,94s58L.oH*TD$'  S^Mԍ K"H1'N=y]RuQzʛm=tZS^^`#ݶE$mF{~F*T"4Mo@aTDĿa#pW^)?{-~nEf+DHWz_%76ʵ:^4j&KLv%ALIUA-i߹ h}Nqj~)Q-D8N&u >y[sOot*{5ϗyֺKz6R%Uģ9c[Ӊc-/j~B<\ BhŮǖiuէDQ i>[<TaXV#tN T#b/w[n)FZ08Qַ]gpkXaV|lggS}>pզ Jf)?.hE0"I؎\(35r YK6q"(4_̶8w*<+ÛF<͏{<MzF`wZPw!qsFZq@wj/Tkۿ.Nzr!`c[߉b~b7Z[  2dPj_`!qs +6ƔHr'|^ a:SiِDw"QrMܤEH)V>9!E @`SEm}&f8\OɁniE1)=q%ς;c腖-o[}m=[e>$NNHYק #QFxwW&Wm`eS~AS3&h2!aX= 5$^8듌1R9L&k6eXXGwӬ.Ʉgds_4b ,Ň2!B5b(e P)SO/oXBfujiXba1XPiGD]TU-F4ʲR?"IBMiq6GbĬ_ٞi-1/m0!faX6 ҁyƞIp "nhj~#&6 Loؐq93K9OjT/?/riҵ,y[$~/{g4͐ȿS7&*tZKȔN`oE5-dxig|Lh=[SBrۊg .%dg[O}/i'-j\P{hH"!LmsUk[.J| 2p7u$QQ?raSK2|4]aR!3q͕KqI([zR6\cyn3^r]zGK(uަYfЪ % 8ORB(뻦\Mdoh TyN4 R ay'ȸ2}36k:Jn\>ɐ;s(YP5uD#/t*@䬂wU@"Dң[vBD/3vQ EށAy`(ZDF;sT OFiWe݈NunQP"Z3jI5DMBc#?)k)+hcm v9j(?sB6N >'9|/*ɄWv#|ט =EI9 /g{cx=wO׹8pm4S#Q7aXk<ιGة YߊӵG1p"К j/p~$jjetiH E C}p'Yš&|Dn-k<,= fwo1R2>!:3+LB+YةM^;] H^ GM1)zEJj;pl_EkլE&FS$O?G޻rS(]z:~^+k}TGԁتbb(a\efոO>Z6JOKvb.pmhApʅCG_ e5`f `\PJ™p`o0[ieJkzf1JG`"iliS8 ܇SԺ+Ĝ#:2_o $aꫪ ҨD' A&1z9o ȅеУTQ^H (_e%`p8C] ǁ"ȵ*`>Ž?(﵆KJIP68;Ԝ^*-b/fsu01bRt{%(LpW#HR.p^z5pzVet0;@8 \Q-~sOJv%mv-)ؗ8o;Ub'II߯BBȀ )Ib^ !qg0ȩ;Sp+8|8[p]q kwTV[Rv6DYÐdyғJ6xj+ 񫼒XXJiepxh_¢k)$5j 5A\N-`>߷K&o=N & `vs IʋAg#Q{O^𸮀j/ƭ\3dr0Lvo)zڀB%AL ,I!-evx!^PNğ3U."9nl~>ZۚҢ׮YR=4T *x%r3/_؅`߀o`[-4Me%zvs2LH̉!6Ns# (7S<Ô/I %sH3tȆkR0O7Ih>:d0 %l_LPJkb)5]jf\ 'ˊ ]Eml" eZB~KWгµ*{g,0j[0IڻD_5 D@*ts-;`S`c_oA?r(WՌe1PY ŀ{DH[]6\T+DJiF;`w&W¨pS@30sb ylgR;S¾'d^xc)@5̋+_/?qNه/1X&sd+³ONG5SOU18h$Ît)07ye4wE ^H`%3pɣrJϜFp6GW-Q#*c)Za7ݓd4Hc"l7-Ϣl^(aۇ%M$ S.S%(&Ž}D:ApQ!גDYɀl,1mLR&(];ׂ4czબh Qr6߱KLr6 rGk;9V,&<4`oaR%=h>_`:ם;VQ؟Ģ+]=CDXւiyW_`tiW^@BU-" 0N?RLDm)TW/qx9}>ʗ.e9Q?ZVe{8Z@Bc"0fj)p&>Mor <O6l{~U0߫V ʭyoW v&G)8h 7C'$Ęۂ DE@NQyLĀhjE) "AQtZa8‹|I`r2$j @MKdp>M0LJew**Byf\T;6fl g!oPҁK󒜢oLK -wE 񠩚┥7%U˳ג!OƀLl[**9sͮ-%% Gqyw<h Ft6߻8X#(Ǩ(E- X d YE1pCAlV;.{u1C=nUiR"AB% uΆlb+֗Xn mjOзP& c=<|'3Jb~图p`.\cBQB46ԹS8=@qmfX9jI-s%><swusJ46.ߡ3qApza3{nM"cjovi#w}3Smj5$V؜ާp3sRs'GKݨd FSbK_w(RƉ!*~$vr:p=$ A1t$醥+BB}997un.5Pmn>qHYfΪ!uW7<~m!Xγ(/[~ &L +Jlg&<ל>Ƌ d&% /ܨ.Kfn֙@.΂c \?x/O-KBߡ#AG]bq_$oᮍ.=4a/@iv#[xpWbS(G;bBI}܃trHR;|v6TaKLZT[/7?AF! 0005(:}ݵo0}(k#l+O:~2 @TVW k|T3~6TOHۍ SmES//8M2)c<#tp7WV~ږhJ|Y@W ;M"mUDrEDF'ҝLц#p+뤨 9Z:g/$쒋 9ݡՈm !g¥GCSf_xk{*`ܹJG'p˥ t WQ\0&p$*sgղ>,]dr{˨#R›8o2 sHLKDU+jJgBzNd {9|GP̻ݐ+bvPgl&T5H w$s3"i|eA ݂dj7j 3Enh- q3i;D&jVҪ( K`<0lS)n2P"קE}7Kpͩ@9JO sD+ 8Y7Ɯ5h˜wd\o,Rdnb4IK9a+cYmJ< ehyGS8Ol GG@ bMオs&{_ oBC )HaiϴRodD*N{baMbT#wY |$&`rHXsERdEM@ cjkM*$8S p"rnͮ-mԘ_rX'/2'lwKe9 ~I 0O N: ȧ]d ZӠ-rKE^\YKh>anjq>6~:&`:] 7ς*A' R5F,b$²j>zTݴ(+nopd?⃅h_ כv )h=c 8c>{D>|OiF.q٧}8xG1Y2eP}Jlpl/S_Ş_V<=vcZ8wAnRFJl9ӳEH\NdtZOt' -b{s(VϽx0Db}p%`5)?tS cE(cAXwHUO 29H/?qup0!Q~G5VNnz6W XB<\sTH[,SE(X2Zɾ3 l:$?=dǍV* HJ(Ѝ>JO+sY?ͮ[tJi3;~3fdJw%' agb!Ǜ8? _ q;Y(, S!ht>m>lp2Ԉ4UNJ/ú'Q #g(⚟[`H3H1M1DIxϰ2[sdEAka6v 8Y8y#Dk4N~ P1 5""\GY#QrvKkPr-BPjU軁bOvM,}cjNYxAOscߏy8l9UeSrGfc/mhfw{*g=dwO1X>XPL6DG1  T 1_0z8đ];b+Mz4m~,+R:Zo!t_ģWP6Ƶ'+$>6_iʊ\cRzҮxT9~*VɛxAН4/;?JF h/Ѻ5Au<`N+J=w&"|#' DgBlR8Cb,'-8{?nxJɦ`-w*z\noN XW[d˻Gx,R\0 tʿgO;z `㗤$oKT:;V+-si|.B 3Q )缡M +"`R7ZbanPa@v{:c"Lx{1E-P 3uqnUoJF_ا!hj?I{.q_jԾ4HgΖ5%GϚ)١F=xU uFTa{D, za`Fr,%oh@P'"۳8$)V#o۳բ>am:V81#ʿ6t O2W~FndSշ&>=ڒ/ Jɩw+NgPf nR Cu՞ۏwdi& KeZ_쑬V7^~>zMcJЂ+Quo)+ ,:xV2z.JT͆t?=ij ͵ [i)`K4Sl gڕRz[%*"/ʀرb+d"aì3Bok@0kԄ#j5G:c\qaaꕙ!j\<.T$36(rQNV@Zf9j朶J7d0vT2VN7ߴ>ˇgŠ4ƹY+2 esGӃvWuhY0)-gK&EW 񮃠t7`)I^K"MZz:14 k+7Oo(t{cE3%#O};e]srympav,B2{ N(r~l{䠷{Sqh]ӇOOKp20 C&3Y񣯥ge;йz'&d/q.2l+hʹks5!G^8-NI踐8`1W8nF kԾ[χbb1He7VZx'E=>Xr?Vْ+4ڲN4 U .NbL4=@"7I F$VW5lOQG4F̟?eNoz%uЃJ/DpB_ ѿG'zN gʞoMk#ucbUguM`Bgc e}jpõH:`;/Pd[Vx'~ƸYYkĒQ@ LJ[sgqZ+Y?lmXJ^/ uyih(v4uWc9 00o탛jE`3ɚU4'DIw>b9] \d\́−oroYP}mOAnHs$jDS#!bz|߹¸!jow4bݛ$XVҝl.بF[ͤc#?zj%Ԯٽ>+"*(K4אC3SF[ʽP|YdhDGvyg瀏^յ"Ԭ(cSeP{0AN>?%zET3Y 7L"\6dwA1#4,&0wwzF3F=P' nKɛ%[qT1=#pOɸw7^uA,cPy;E1 ICT[[W(Cc|(mLs#0 kV _> NmBcwɡ؁}J\!3Q:wPm|n" 01$Wx|$huXltXtS> c0L/_?: 4U;aƺvO1aŻ.~B}_a;3X~>bukGGg{'JE(UJt*x{KPxׁSpJ%O;K-/i:f6])ysG_NqDiIyHݤ.`!^Cd,:_<757٢+,1[r2eXzف9a/˒pN9 x_$ r翈j1ahy()M}>*Ufcgj棎vo^fviս{hEloUHZhޝ98L+VMj;Ԃaj8Lɔ"U+ϘYH`6qPݽ sbÅ{0s63Vx6DG}#mXI ĕlC5{G{!P?&bˎYub owd 1T /ԁُrڶFOY1PqB^#1VQ͓9'bBVvWB\Rl's*a u|gQDfu"$3" ٶz12`ǝ}ڕ/SU0,j2Y`j57ZQg-5˷Yi, v6?=U!Fſ8D wG]ٻ\aw |sSKEuO*LLԿ=*|2-?:oXYn臰MՓ, Ca;6k,/^oSo0*QwP2e+z)M?`J5KDa:Y{-NG} ˞UoH 2%|{*$ʤG \uSBO l سtTmQK[ql;`WT[ +` {6WCgp6itFCeAՅ[ީZ5="Z1?1e8TN~"3O$p\Ϯ_.-e-x,2khLajveڏ8 wQYYȗh iMkJ<>5 焨{ O-꤯$FnhU'IHfan +y-{}:1|] So(lꯗFDG"ބV-}|i= yoK! cQ{ԡ,->M!<kzcj7T% bnn]7JU DWah.5d:ySCkZv#H?HBTrR3ͳG}+IWM fxL+RrFJ}La|vXϸ~, 7@VZ*__͢5rxbf!΁5SxezPѲl!\1f `kv)};6%qU^haLRkDx]lr-q bKܵ ގ mc!;,O60"5!ZWsh%,\ WRHr؄ޭj0P\kw[N2#Jz:.{?)e^: "{~4Eʉ{+vb_ 3A^8f콜8uq+O A&Hd>%ɬȓşU}yS9nBH"m0I!v׮bK .É<Ŝo6l\;:մӨ Fa׍}&*$P'{\ܤO`;Yp<魇l,#Y%;C̈́ wAFAK!||f< :8LpTn͋NvyggtFݩHA|^ 24 egU{1_] $:gvMwi+uwgsz"}]\@Z?pOH)XOlNͮmOU7mJuQK|?CqM pn cTy\}sFJJB{-Ě+iA|-|+Iౣ(n ^ey# U0ɴv _|y(Es9J}{??ιvLůqfd3ߚ,qΉ&!?WfLBn?m)%ap%3[ Kɶ.bk?٢g`R{tk ӈn@ORbWLѓjV2Kj64+{dqHq^@2-hO~&Q0.* λDnOul{ڮR kٲcMI! kéiams^FmՆDOG4dMR>.!?%9 0њ6DhwJŀr#~4<̈́9Ο_A͘I[/c/iWW@X?έcˌ.,䪯us#=skJ#h& ZfsFWqS:DŽsbk.'Ñ3l%/-;&7YZWHي{lDd7d&~Qܮ -( GZc. > *t+ L'gtLv2$ƤMKjն$z1 M"wCN\smxx~/J40 lޢ@cJxZ˘rׄR ׇ$ѯmNg:'/!K^Pl&^qdǃ C%MF@|)fʀAV=MdTUے YyeE!<,}-\_zr3ڐ+Ʃ|"ځFq.M\ (b?xP1v9I;^>L!ʥ dOh Tex!mss/<(FzPeURs't"CkL2pbeʸ:+.P; _?Ә\EDmCt%?iʬi\{ۈH`@ gPX (D/Nx+zxLR<_D=4c#IF#l~L\lIИႭ/_ռ"U4[6|oDn~;m@ђ.u4vޠk 2rUF@w$Ya?ɇBa|#]ġm| ;BG{ǒ}~ɜ]}*Tj! M2XK{jJw ƔT!jFR,ns5'ՒGL ZJf\#  +]Fc\l!TUM=(B̄awnB8 qћr: 1xhAcx0@pn< ǛEB-8H#: P-E#ZW'2>(|/}ΐt6n#"|r_1*W&Iu_SmY*,f,?||1WJ57?#2 6G]YO69s6vuG „E_Hn`ә_D25W`W_8Ă-flCDP蹸WR,Yw0Q뗏c8ΠnL!aXcJ?e_WYK7!QWwjhXyv v֎oV\DKSPKX$f!G$2Kڋ.IJw_#xxX.**UhJI` Ll"0Oē%=-mA1,4ZA=U"sj1Ub~vľ>޸qS.c>-535a%$_u_7j $&|9B[i=ЎY0睿ɇ*~Ryb7~%!<$`F jo(]gWr~zwkp†ԎQ0:?[LwCjXV?T峯|Tq){Zf`t8ɀfCHU^ҕ_Z9dbp;H[ bai'M$t'ML h4ФPF5RVDtM!R o(.I@X}BہZ]wkM`/m(h u84b=*俖,7e-Fv.YIÁC]Nިy6ؼ )xL}Kp}a;**]NY񦮍eqX)L,yA\JўX{7n: Hy~ݜ};Vybq l&lD|dmPnAK-AklZ 4 +?G:jfb@cE0qP܊}fD={ZpB14 E5w 9K'kW8(*j<3J-ekg{X.2zc) Dj4-n8E0x"3r< 96lWe1/>1l->kFW\S#Lq13.ޯyx+Xj  kS?}?~~ݛ-n>~C=yݐ .0߈Fv\\'VS,B=lFڛ# J(t*,ib.sVgê^>vs܀4Y .hیW"8_<JpE )/3\J*}[;G7cσ;ߨYx8iޝ6\zƖhQJ{baIpqPi-ܖ[s-_jY[quG0< Ul7Tܵa="" ?~(E8UZ_T ˊACzg)w: ^#lt;O )h0㶨+j ~Mt=7py[!tMi RO x`Hp}刷Jbjeq8; Mr?[-  >Ԋ%Ij|iw7;V2sd%0kq@UIjXNjszALшY-NM{"d`%,k1ׇr 9`ۖX)'dsE1#Fv6$ZMpu/[OR:chŅWxM=PYԮZH,}漹>C6Q>y:{nP"'`fA59Qݯ5;]k5~!D Cq=zKxy.6ZmK5ojd'.jS%mo&XVϋ뷁~mrNd04QbC Sp|/^HX.寕Ty%9%nnP=ߨrv]%,!jĹqhy2C{3Iף,4x\h2JE'%9%K0b.vFr[B! ro_vN'[xI7,`V7jR~UdN%3 I/3VQ"X &&ŒutR}]*^ҙE[t+T͔MW)@Pr:k{ !爼!=2swt'{a쁺gENs agL8~%/{OpUp ߩT8ۮŀ=t6*qX*~tN{3*9KN&}1i1l)tDj0>O%ZX) ؔ8-@ >P4=IdxJl)(n 5E0-E ٻۯQ>kjS̬.T JFz):TFD%̳Mi/z Sj*O73;GskpI!h?eDio$ 4,|Ÿ֜(2K=vmnXV#] @F`I0 : JJ"}׷^ ^HL#ʐ*H{Gbro>̥rl‹2ަşK꙼T @x~} s3=XJسt$GDt 'zP`df#Ɖg5*kBV߮:;Q 7HEk;hR=(uѝm*7cx)q>]_V XHEQ5ٹ |l/~ʢ75~_n)] tN&H/5hvtȵJdd7ݷ]!l-+62s s/R/QӢ?g`;Ш!mn4_ qyPK1omq8ٿi{(~8⪂]q_dԛ16=թ!ދ¬ gYvQ a9J2 Ǐ>ZwR-xo[iI!Sn*jT}j~~|9O(Z<24(FmaHYN1ઈ[7_/Dv\C 12b#.Vo@65JUdra CME1}v?3P*[X<쑞i 9һ+7цW"wHalw.6SJ?YQSm2 sGc)UcMz> MA+Bm5ȎUsI*9gD D~HL J&ΛoQ{gD>%bikE+<~.'3y_ht4C/ϴ  ÷!+(,=4;DB"Yk YX3Ҏ^"}4R9|OfZLX&5< ؈>S*AT ߼bx\p,j9ˮgf* a_gb>ѠWY6v#Hc o< R}4nmwZv;g[y1 a̲젤'i*rzG'3J-r3_wn"'rn(&p6ҜeCcy2gı/7pÜ*PKF}hX6qbl3 8 W6y&om+`B9ƹаFk$Mg2BڲoHN^2)JφOo/U}TϕiOyXr{4XWSRnjת dfWmrN<{s}z;3_?oiP~swGfw&]#F',1x>T@"΄#Mހ^iiwH"lK/;=36yaCujM~B5zsQ:}.Hg 9.E&ݴC>| 8]L@$XZP1MFK{jix*'-LL?x",6']tXʈ}  @@TbaX C]$8O4:)8E'I#VQ|a_'voѿ?X86mgF1^iv29ebuVݰOO[J8I|Ub+mZ>GqY,q@;` B M(3q) f rnVMe=sm>T e#6/bchcPD쒠rO֋ _Uk[/^t""[gt߻°o27'}08E/ۘF汙Wa?~ب=-teѾS0+~ˋhl3DڟlOe #AHI+6 En=2 gMӇ5:lnPOthqy-2FpbFªH'J`: fI&FpXzfr2%C+D4ɽZtHv`s ~,fz疋5OM"2 ^JUP)6QJG1I-,"P2 ]A^|k{dYGC̒S4/=1R?v5⌈EP=& &HF;ln =*nPZ nj>#_ U!%:hSJ;zwNkֵi;1aWNGUHbߓ3ID"0Z5[piM8}&h9k8C!U6~2Ӯa&xvbWf©I\-~:ef$r҉swӼm:Bh?o^ nHZr^[%NXiP @{`:Zʘ  [1~kiSw gX=t! uZ\9g}19)G+6l9B\*A+*q5x,([/_i:V?PõTËy*I\{.2wBqab4{Y<(5Y:](PXQti]-ֈ+9R LjG_ qy*Z.҅YxmF]oPqwt*}].Zv#sZEIpb_JQԝdA^O0Jh[4١DtyE8ÄZCGn]L:ghǻ>s1'@. F>沆9J ~mq4+g?~wbͿ,tN` 9VjaX댏ve4܄7Z4*rW}2r*i5RY>DΡDhfjnf_Y]ogª|$.J8g)aR%E8NWZV "Ee0yڞS vP <0/_?&q8a0=_"C9NٴN Lq3/mVLzUy１2dE`A{,Kl]9uhlyezPOzZMJ;I؇Orb^A\a39M4N/I?V2Fu X) !(mIq"@B ^xv1ޱ:f."iȶ Q.aC }}sLžipSTZѰ #cpo>Awl۱K _hzL@%8|#Tloa"ހO}lTS*V1?x eΑO#n)&pͺߥ9]xVV [t^i*uB{3!Mĺ~R(hg0n(((vz^W6/Hh9!eKˀ'qou/w=)=  +vj?n!.9N`^;ڬ~89؂dP]M6j/GW5ZW-Hq&J] ZF ai]fzp[ݎdy\rWLFQ!bҏ \CNUL;🀥koUM.1$JAݶ[C\ؕ6pf3>='JJ*!R;g Deȭ]9I\ySg]r22;%mxяY8  ::qԡjZgN(S(hn[:hhovX ׬Cm&ENG٢P) kYӸ=9Λ>ZC7}hxY i#$MApv֧h)ٿ`sP1瑐k_l!6*B_-Po ?P2/sP'=|YJNPtW-M5j uy`vXJ{$XR ]b VxO~mz8v)iT޸Ii_XDuA^WZ#Uf!J$ B1"1!Tc2c&/dYƷ5_M=ذl^Eۭ$Ln8I p"\pBE4ͭT m U."dU=Wj!Z?>vU!lKdQGg0.~r ub[3ȓY&CB~kߒe^|a-8v*&< Cҗ{]{` wqWN;a$rkQLA rQu `P}l8f4ꔩ-mr-DukbCju`B;v :_$l@C[*(A wBsY\MWVW|}ikYP5H[hP\:h!l7Z6bN)Ջ۽LOWӭĚU۲X,ȜIӱNCxm`4>uF=yg?3: tEŮGd&2h:ek/ f랪aّ{L-ޞp6yxVEWR+WYLTܗtmqw,? [llzfۅ'Y(, -aw0 ?x$$﫬!lWWlG9] zr.). Ow Vls+MD}Zz;xFZ}ړ_rHojڂ |M:Z>^^ٞ~~$QR4 nF*Ш o漙'UlRqgMt4]ʲqvڣx(2AͰ4G(-wQu']"]0Nsz0mӛ<+,1yP2p9xؙ ~ `kg7Mk 1:eCo"SF>N-Qr=(1'h'U*R (S쇴kLҼ yQƕrJ \:΋}ի&w}' 4 0-(%xf峂r2VxNXjKigXuBϚNa՘7f@&_vF 7keZ'c-FEH|e\L e{dDGB|xC wh 84Bl&@ɴM< LCDظh(g]}NEGo6з $;kҚ\<BuȎMqH3ݡf%_}~ž7m@)w B G{mr\r@eҏhpj5Є bpiEyG i]`$rD8xy5+6Ff@c+ܬ~͌ҳ!r>QA>/3MEum\wt*Z'x;΂o(BŗŊҰMl}|,`aI {k96HdiFa7 Bc!!>[*hbQziN1=dPx$ _H;ARLழ.?:R(4,QœMrXkѓKJk6U"qE| R)$GuzQ4X4$c}8_&0U׿9eV< GYEeNx5y_~"%k]uc% d6 ֤ *4nNnp NC}2ZziW2 *18֥/R/5W 'ļͷ<*_M,)q4s+8` ۰PEьLK)!-+ Jn:]_#p=bs\#-&RG}%;XCAJy!,LNI]s, ^ԄeScڠ* `.CCu&!u36kY[TZ)#I+qMgG,oUL,JW:es!&mF=y(  ]Θ_BȂ.b4W_Lr~T/5'Ki*P;u>QrQ7Dр1؜Ǐ`uJ%/iCi)$S0K(osˈ:5{i@w'hq&#{Qg랃?wQl&Bϑ) [-y;ҚEfފdiV mdtAdpg}2?t^D<\)sqoxz/a:(h8ne pMɼ9Q ߿a./L6&g;^]6U̺ZHx 1`#IwE꿽(Ne%qfs6Vx"~ 8GY(oS.yf!׭mЄ92u(|)_7omm#z]Րd{o3o,H'݁sY4aq\)B/8c̱>' Ek@ 1DJ#j18 `s.gcԭy{VggY>\x"g|Onjɶϩ1|ǞEAѸ垂Iqr*:8Pλ> g879\SRYe`U ){%ŠTK$ KQbɦa8J>~~խ8 @;.ƽϊK⇙ \(ra2H ؃Z=b bXmKS; ^'nvTzb .nf33y`r TҏQ*OO'Q3lU?F8ni1ӳ_Glz;ېׅJkƣ5v C46c|&m}&%x" x)i"uu]lQO1;-F%ʉz5lv%AH _羁" pLߺOsKS[Ι fd ;Iݮջݺ/`vIU?nL<D*e(nUwIS࢔9N^μ^O ~fՌƖqa8UW]ݢVC*ibit<Ӆ!:ՒblIt\h/MsX9Y# hMhfsɞU?W/"<% ETLftZꮍM9vYO2?a;Se;i3US(Ls:y"(GZȿ'iyRܼ5rj,- Z)+~ZW#$&Ik:Am0` = t`|:'g5Re˯IW +F7d1M?h΁ 5gZf>.r3e6?9`WÏ_t^;?Έ\6J@siuru`79> ׸69GH>SHWcծ!rLI$+݈|.3TcB],gG#kSx%OBIyvMiGv\T OOI%'$@gI_Wg24,{-"Ҟ8:TtQ 3t[p,^Y3tRe/ s (jfm l8ZgM՜Lcǵ5/h!$it}y<&P#W2XI*غhw͢U  'vc>%Cׄ%Mq_j6F9B;c)(n_v%3d9nݿzԮX~1^ .!ڿ[?%5|uK̕Z0G};XYK }o6us =9 \ew ]U>)[8Wu ٱhmK4YU0!Dd1V!ۭo̅g Σl_r==`iVxߓ@/<`dW\+5PPި5<A;*<͞g%NݼS8M&N6wDvʃPXO[Yhx@o6me@ aEncGjO>+z@d tXBn5BbрNp> F8xϤPQQbiȧ:u̐ja_^qH3!+dʿv7CA_޹ :-a*PտFvN(= ėg,^[9`zg7xbhi>b~|yI8qXkq<SM3[H7FFxHoݧeWDzbm jMT5S`VGΎxZ'L+=y_ݖ+ry_Ax1486A=ӪqWT% K+] (Rܯyq&倅Y´!JԢWc:CvoF׭3vn-c˩Ln)`%zPD\ /*.MFB8?}^(&>0N nWBd;!k/i3+n f 3fa9ů`+h 2r|HxuDw.۔p{IcT~ڋZE^Z +O7m^  vLķ=Ff u[A*@0NmU4w2]Bd&Ֆa,x26Qs77,* qM|9VS"mD̝ 69Bd>qo]:3`a47/Q&((P75?ߎǙqpѬZo*5~V/$B Z:Y>{y)eu(Om|L3 QS3Yf6^\+Tvb{1{o'H45>8'tA AISMQf2{bD,BDP^ R{ˀ*C0ވ薌Jj^M>1/ۗj=uN꘼"M?A|O:1UqGE@εZ!7KnJHL5Ӣ '>KLsz&} L\[O(C,HO5 4vvg&8)7]a:0:I&)^I3t4uƳJg L+1;~VWڤds. JN?@aqx??rw!R\積ZElLF Ww(WXx4Lm8H5,煑* +gQ6Hlk'H뎭(25 bÉԶ& $FtJ]Ơf8џ@zhS ܔYZBP?鐴=s/Eo -Mi1}mKzG%SY;zp`POJ>Eag4j+\hQUw|uDlWr1TWvu%1_n B;;[©hY9'pPhAJ2\ud.*/屆B?jn˳! l'On%˳wɴH\l 8fsPjGzweGo*o+[Nzz)v# pdnJ}y4er Mt{>^֡#rt`8SV!tE"ffTA`n]$m[(BX5CZ :*6"M;ѻ71zߟ#(&8ZWI=RzHͨoNtҵq)UF<.n޺cQ{FTd> 7…>bg\-Д/ WWZ찣_Ci53r@@-F2l#=;?Ў· =>%޲|>jM|X:s-.#y4"t$V^x#l苶Zvi|刿Ȧ{-v7Ra="Z'ԍC48J z(˕%;Jzoc0N_7Z첩ݜj قFp6ۢl~f-{bOK9c wݥv?QdQՉWxݰ,52^c̒а(R+r@qoq|w0bW ^}6`FށJ9r2GPE[ AeJLc]}p"ζŀ^۫t2҉?@`%kA71iH*KFiO1FeyKNI ;5լ1#7==GgFJBdMV*<[6!`Z_Z&\({ (-#؋RcIk{S)M9 6y|;nO]+3. rƫ [JL YjIaPF؊U,db`XZ42M&!jI "gJhkuoү$q/vâ㫉Ev YK_&!Q#Ʌ} m:}PLZ l;k^b`k++g5D=FNu;ū|u}=(YMR 8QeH`X{eCTڏlljd>i^787Z%2'")[1 ߈!~0K5J'V7u$72."Z̉ˆYZO>rO$խ !Z M7c]k#O{;[lQN`dX92"(U?_&XLޝ% JozQ;¼ y롎vFl0[`~+2 yw3 H} ܾr9<vZi<62QF&1X$.phݵ3#gAuWBDJXM?y̬_:4P#9Ă_qj\HDd&݈Y+VÇ%׋#D*䩰OysIz^׌V8.5(8zTdM~p_Ui wҠB*bgh gL*%CN54n`DV6d["vzl?uS\dQdbC wuV4M%c<ϬjKPuFQxC63ZV15&l`"/)=W5\ؼmIf+#ndϫTeԷѣ٘i4DPfP 5ahjM*%mАXVesW5rTuܙN +}gi 3lBmMiQnp19\+z$ۆ$mE|fK u&22Z9EO;/[; pmĺf}g^@dyR9`RNݑ>6.p)8J|.qM# @U`~)+y19PDmwy3@$46#.[syJz(ٕ+"v_K:$c!.م.'z˰7 'XG=`x>@8ߣ}~jt;rbk+Jń$ }mAՌS!riӚd0[$JOqOi()!رչ)In ɯȷuOf>?seL>3,}`XHm7,9hS3ؐ N<| acklS1k (MEdWEt`3>8(Ө7$(;=JG?+9}@NЕIgSt-Glj z,~IMLL {:)ъ-ZKd#%6;g8/bmyY &Y39ziwn}px7ā:PJ<['gY` Q] ^{]'R/ t@_IЪZU;cYߏRF;_!hq=o2 #y8>isy<Ǘ 9)D?ͧE/{X)wa(+!#*ZF!ח :"FLAqg[aJӭYd/Џ Kil2MsPlHDDРYμI0yrŧ3xa8C.pML6Ia}WB;^؄$`_q⋥y1*LQuRݍ!VROX=֎I'ؓa`/t1+4?K)I۔OD ~0Aoѹ0Y}(8hgS1PM$XK4=N;`^ĵ\S;M](my|*N5ҩ^hو(hWSD47rՑRelT譲Z:O.<p*Ml] 9T3!؎x!!KȲF䭼tKQB&P l&`Xj2[]6d~؎omBf!X>ouVinP IbO9ޮßN xCH]~@|_`ᡜ\m AU^h؆fA<(cfYRO'PkH!h|W369@[uC.`gf&Sp~ X "F*]jHF  veO#GI/{:/JS0<e դRK7.f]FQ 1Bfo)-.lEx1")V xTZ(&q k4D~~ '6EO2o,(q~oa1њU2aМwvܨW[EvL5 m_X`sd$J l=SHOWFPnwV홽VX $eq9BS$b ƘN?*ɓh)evbH3{ dhCdS>'= A7AW|/ FC5رPTFQN]Vuپ:`UgEM@~lKUd,ff΍[BZG2;U62$P˵0samo>3~a91ɄEwF ЫDŽɴ{+Yxv*ɰfqZ;}k)d5 m4}d) mPVF87ڨuE@u4$ xRrmnƚj@~Mcx`7&!7K(Y~^0=B1$_.DT´ٶ'rpweww% W|L-I̶ \=\deW7>}oVii\2ze˨rqGH# w1T f!|hAwfw>ǪY XP>]k$NG^ }5~J. f|ѐ(;HpT7a%6eAƚ;,2bpe 7Y{9^3Z&1kOU@`9ejc<[!L]cYB{ kx剓t kD|DQf$*h-TEeϋX*mk4G5vf}i_ǥ:jۘ//wäs/kp;_#yMv0}c2(2SrIх*Dsv=G+}?Ř'B6T{`=UJGv8 k{ gN{aipvBD'n"=k9{q$Xz>'/F( DkkP#qxCXF3;VgZtr>:<}5<2FtS1̱e٭o<SNmFN)R:?MצɪCtv6BEYmqzQ|oUZuC`~XW."\ga7 =܅MO:82͞#i(8?x^U>X$5w"JRgv=|c 3 (7+fixɷ 6 k 7E, C /S*|cN jᲥa)e͇k7s<@\l1ݢ-Yr`F;RǻP(T;1~ͥyGk(9"XEb*q0I".>EԠi؛2ȔfenM$i;StE ]~EPj/{SQuD$L,Dߩӷvrdy1<`A^M;Pا`xn'3s)K##*ݙ(խ+<+2WHᑋ1=K pmuK&(7z[4tX1d:MT+4p.{1BƔYfXVxRî *ur^]2G6+oF U}0B'#ku ~_Mdgt˼x?y}~ pp]B.!=/ω쾐ܓdߧH`o G{ͳpIu窞˧o@xhy.>)!_3Ѐ  x '.uYblyeܼ՛_:)XmZ+U4b%(ד\FMX,_eM/?jE([){̏ Sj s=.!ߝ\~>2d,Z=޹G>aeDq4b#ᩚ\r?OPՓWn^,k5_ (6 Q^2 3U2]x -E/f.pe6j=?o-ajFWHw Fev4\.4R`*( ܐAmO&u^{k<'v9 9!3%NbY#@56c({RJI[qsOQ:Z-ֺ:2_ۉzCEtEeVd3[V!̧ܶqfg&AQf2 ;1!an3hZ FB3s#5kIsh^QЗc?<49k `Y.IF3""1RddLD.֔Sk]_ G67*5 " F{z;Pf մ+h=Ԉq axJSrNG?5h/K荱*; :_5+&y 6 !h S9fmB\ۓ`eڣXB0T$Q"A)E#R~ܩ\ I&#ti~L:z{Z7"Q\Vqql.{[3-:YTB)9v{:]K u$>phx~FKE&Ұ8B 0'_浗g{z4M||*d`GjHJ_&>`jLf>ʧđ09S퍟OE5֕Kv`]%35V_dOiK&6!uˠ7֚}}9$Y`fB7 /!({de"jԳmm{V9Vg>'0R,uc h:#8]s(D^Y[[ͺ¶47:)FWG̻lv،HȣN~8aa9~QRPYNͧxnh0F&fW:l_ ӞpB$U':((k1l .h~¥k0ourW*sSEgOMs%1?֡NING:as7Ŗf^"Ԏ;Bۙr@"ڍp:2 O]; K.H?@0i庠v,/ذFۓ141wX=aZ Et_Uۢ52J,zAA2[jm: )Ip"붴ݘrF)7@R#7g݁ kGlP3щ nq u\藨I FsL=IoZΫn\A 'FNa9רӼn 8ښ3>'dNz#2٬حޟF]%".‡we=3p59c7b {y|"pEiV^獴vK(J ~W Y_t:F˘%+ը]nGcǍ>/~8wH E-j}wLAtO !$raMpZӛOƙCݰ^ 8[Vj*IɹI(,Y JЀZQpJA@rfa8տPjw50hs{l:ns{>?E$i,JCbxyAuNU6, 'ųcatHi݈ HTV!! K\*q%.ྞ|,#Ip Lf?@w4 R@U7ȟO|Bcbf2^ZB0n:GsԦ&BIؑN//A@9Q̕fN)l ~ŭW)C@C4rJPc6)nidGey w0 o1F u)6<2@QLԳ~5*{ e~x&sYN^)ZKjCۥhUxPDШ@N7;b<0Å~Mػ4:i߹;[PSa!ۆJcY tL\F&jMfDI6Zljo?(|_l2s%X̬B×j{s3dZ"92ZɜbGφmSp-vG=S 4JFǛXQJ.7zLܚGE90%Wֆ6~ hi5c> l0A[C>?mw5n䛽H!x=-/)j 1B=uςUK?# i(>[Yp};O4Ӫ $pR1;6Ԕ>Rr5qځ==K ]LA',LUt_!#Azt7F㣩&Г4` ӭЁY뻰8ȑؒ YwLб/q)ce)L 3MA4| u.Kp xad6#I _!R4GB C‰8*-̑hܓ,`n5wadt%(lc%l] 1F,l\,_wWdi~ 7]G^I-gF1z#F nB;r/P;+Epg PI3Zօ.4u[ x?)fPIj z$K3BFH,I 9~[YfeQCHWW~"Z<(Fd&8vXK@ױ&+Nw(("k_i?E.y`(7{1ՏxBEWEl..&_a0ScĢʅ۝%9\ŞaNHg·w/'ʤj]b[Gk#jєr׀ļ Y3ZEٚSCHMqdY/34 wi,=dFMMXloJ}FE7ӃcY퀱Bom{/}c{||Q5u G&H/$zZQSuE&F Cӳk;:-tsݢ"ivO`]/%Ejq=XlC\$*wI~{y نVVd?kOJA \zJ5Њ 9bKD(fo.< knA+/(Vmښ4?%VՔ#kR!cn^8p7ITв_xþx()hŻVmn-l6~]9~e\Fw2)qORKe z-,`ľyeǔjҚk<|,\ܡ59\ipa=;w,ۨKƄm*lRr]Q'w qVe[/NvsykTyUyzNNJ&H YV@i&p4lfN5xLI~):0tzESwNobj<(2ND.F:sϿYυdf$E# K-}-wsKEmd%@LJ,G[ͬ{iJ``Y$suR½#H76-Җ7]8rhYH𓪱Ds_I˕9,.c4z3c˷{τxuHy͈TÕug=%U ,#&3IYW0lz#ۘPquFw;ٶv`z=yu{ҐBfXІvEnsobc_^}ZGUsaMYw#2x )][YE#BXV/i uY>+Xxx.鬅@+hXwr n%'TxWT=Ê ǰu1ŶoYxyQR8˵ϪaDS܃].Մc뛸6BJ0mX̴LgK~'C%o+*zY|Sw[ȃ0g]AOvCQ2&ЕID ]Y2'Qo2o msK4S^u u3(͌gzhg\eIwi&ygm?Z9|cmQYtpaM(i] ]5V_{!sFWEf`E2$+yWu)>܆OGelTsªF1V/Uo$2K <6Q'Z4SPuP`˟̻5styM)F彣!pb:lQSDa"{Q &!&<΃& 7 US^ <~ lj1U3c.e)iZFaCO&4LM}MS{qyљk9\NA.c4EWqf+O4%gw5}FhD@nTvէ)ږ0QčHh04M *huCBvV&ZWu. '7pKTIqmYN'Qj #! ʜlym5ear>ró PVVnv8SRLI8cWGv1mSv!YlUHnYVL%gnledNy'h'*f;V+]Ƭ[K"2˲bZfso6BM҅Yp&S-$Wʈ v$(1'Un7̾s8}&Zw?I#[ +/Hl\a|.2֐::uӚ/c+{,pq!m^ Gg/π2a5p#U, 14w0P6veEӭd}t[*VuJ֭/$Amx0NFD06 Y|Yµ+;xY83P?{,aIh+$`p*R6DÜݾ;H e(ja]ZʠۃN, 7V=XGB g >琧 3$0na](@(ّ]I+瞚n2i?uwG2yXKNOErgN]t~зZpؖ: g)X`h&y}'_Tz,3Rj)sQU >Tlq<g|TKaJW !$u @Q=_șo9ߙҐ7'Pp /jlaNЉP_TKIEתP$jO+]Y|z @ShًZ"/a7ofDLϪ#l:dBJMNB!c@lIΡ¿KOHv7L UE279aksEcLȢϾt(1lEU%u/S1^J&bWx$t@?EyXp>Ƴ7:x`އٳܱ>B;m+[;r0-(ڧsH7EV\WJ #[ da  Ƽ,U~k.c14'wCܻao:=96>XOo\k/M- &v(1(,Dl}@0hdzT,'^IM~%%h=r$q_ݛl:IަUb8 @'YId/aoAʜ:w!I1``$pEV7{moзb#Bw ײ^MTV%阠\>f^B~t8#f7#oL6! ~-#t-g9a,`A~I- @"3G^Bk/7܍GxljM2 9蜦4<ʉKTvf}-d8jh5nnɔ)I3(DԴ1$ʱ>q `J鳔\óxL>_Sp*ϡ*ԃ#V-?PT5ɨv\q[k1H)΀01|&y`yi#MOFzi8 R ߬ȷ6݉!&0)iΎlAODKlx C׆IɠrcuMη&T+PVkovsw߼]"r/$8H@2uĈ^Wd.Kow?6=YB'ceߊtC1p0wHO>}FU~DfB崬X#YKTImL;ܵKZ+v* ҀG@y".`nLGQ"p2&Zݸ_jE#K~E>P-&,^n.ESR  P}1GJmTCn˱т+j[U]g<J 5%<z1ѼxK-tx 84MPKO܂|}:#@[X.yKLl*o))z)ޙw~aZY 8K]a&!kE l}TP@/';~Ř}#% Q>1s?pc7j?ـn)9F/$(g)TG_覑:{D$aUkBf f MK4!_ȕeA,u/^S&!ClJ5GçO1U0H;+-o_M$S%M&dEݼOc@g3iE9:'JW&$>9 bDJ{K;^YzTKon^%v I72(TCoJ- (o*24H6v>x}/ J^Vs@"~9|w6}1E\vA!LҞ5 WV}Lܼ( ft}1,MC" B!R#@I%Bx 2cp$%nef,70LºgË%hmu'3 `vQӑ9O~UOE24 q9ŏV9?,DNg=!(#jLA#cm XYt<}ƣKwסex6==kX*J4]ft$msJi#:mAMH+'uX&K&;^i-QlE_CQZĨUD/%P;h^ڎtVrSWZXlu3nj1I3E3>4v\X+pnԍ%zI"M|#Ip6 Y"v[/+ƿ=Qhq7>W|6Re ^Γm4{"Dˁw=SʽLӘe7"˶ч9аz&X91m-mYjAwWrO`{̀;v_ڈ2!%"O8!g>)bzÞ!nsr}ѢoMϳ6GH"1jz;j)f SiWQG'WEurS3InQݡC6I83qq۪͝2u/ ^zi53;kuӿ!S lZ6q4] 'Zݻ9?<9?sѳrdul";A_t)|[,V{G@xp٬v&NŘs.T=TC 媺Y(]@4Sp 'QUE!Ymr4P\P C:$+?)RlUSwP|]3&D=?tdq1[*FGfw>ߞmuz)n7c8tyK O:\Lp[*}:(|LXujH8egڞy (ATAk)H )\)$}1ҙVKw f *xGe/@&?:3Q /*Ѽ dkoБ,Ͳhʓ慴J,Iz҅'8rx2}`v)scg/A$7yb;i>•yϐ#@3sɑ/=ju(ίX ["-T_beI[8t@GjP wCookWT/+U$Nr`<3gYdtUS_he&9M=^eU f41j(XK #+. h7` b/n.? zGz՝m ubnG3/ݘZ]S /H7Vχ5fDU:պk{&ʹ^[o$Xڅ%:\)d`>|M2erWٵG1ey~R{w;f~SgD" /<5m!*T:zhul)%lJqnIQq)ZY3S'9 w- 0zcj TOJPCP:+g>wL AˢP|D˲J\[ڻXeg@kAO\P2 3ȿP;H G >$ v`-Ef?W&$5_ᬹnRK"Q+0 Oc!/w/$jv4~ ,Z2g L4,LHg>k|*"2-G&vԽ[]["6&";3g :% 'ᣖ$cĶngFc(]CߢY %zv]qX(6"N"Tii$vw(#,]%Emn}Ƶt]=VgRr$\vڠB"=qPif(LXţ\Lj` JTM`3g3j]y_^LרX9˙7WB$ 0V\]aԌ+L#߾mj6k#'j{*0׶B06V^+BkpxYR)&)PȌ8EiigYUCkȞD;I{Ɵg_oo`// >b;ApҜ_ͬV45%(l5 &*$뛙y%oNoObiv~S-2gwِ|6v%_7U& Lζ>Ĝ_w,w3 ]ڮu0çan7q$ fvR*W%.sa}jӴ5`K㌽r -,MdRU] Տst}ؓ n#='ĝo. {|pxV=!S鲁Xj{ekOAѫ%{y#Ld"(%xG'TU {l sJAXF'mѿKrצQE{'6 R-FDQ؆#*$]K| -Y@n9a>#:1fybJ6cgWPxx,KIo@b9#6Qҗ3ZՃWln}ۛmIm/_̃4qrN/6Snr9i_H|P&Pu%GfWAϢI{&/%!yH0]T~ooW(sFIr@~Sog7J~m# Lp Yk5F$S(::>jKB8s5el`&Nа;&Qa*ZՕO} 6{Qq @XCo*% ANa<:\9/~AX]*" UԖjv= |6D>5I|'fL^А#RiE{ӑoW3&KE2]&ɉMG=ew6 $.Az/4~' J86Gƕ׍a~3ӊƾS+zU1xOEef, {Vs޺ɛd\e")/2/ȝ0vp"12"TE|x+|rCR^y_.,_ݍН=ɦ#{w>QyZP=V3LlJ/Q"m67pEo+8&h~kia}t4D(&'!A b$ZVcEHg[)U[EKx=b>Z4e'%%$U͑ˢ .Eڕj8+i+R֬\l-6pރTBaj(ؼ\J ,Or7,/d A e6Pukg#7TaC7~M`ռO&5JCmʏ@c{!x[ WNOm &)U_;rX.(ڝ3khQ^ 6w,9Z0`J|yOsߪ}vN4}g>JJ=)R)ͤ%~78 s& wۋ )Ea"38\^ }C`M(I;ߦ{{`j0]BwD~5pf0h3F9]nqcZ~eJZ˜qp<{@K:y_wK 2S7V23:%&< zEJtУtzU"(x|7Rsgؗވ0݂  ¢΀2#=e%,;LٚosGp~-]εzX|7 VgQ4o4:z&;4 2Z)|E@bD$(E dFfo6n?)jttlvQKeN/TQ9zRLf8&m$>u7ܗ2GQ =$ l"{O@X ~JGר~ /r2geyLE.T8I .`@~cAu|L,#J]LG&2wMٳGbÃr}/ˢg /nӊ 6C#C;Nwy/7AiK˭6$͂#V 9$,ձh-9|-g4嗪$YUt#4d9!1E;b4{G]^= [()igz $ A1(|66鷍|}خ̡;&i01 fsjV32C>Dgv!ESƒi4[+]%E4޼7SyW[ػKZ7^j"Dh32hKRG¨8UKPťd՚eߍ# j$B0 bOR)0 .6<92$gT^O[ ܄16Twdl0iʝN)ԀlX_)VD .Pl̔P~hoWPW e8$fp ~ud,UV~07g>vFhG>R3hƆKb/ѹ\m76 .DQoZX LeHtMZ Cν+H>uB}TsTn"F 5k( hٍ7n7MY4Aw%y@Ĥ"lN°J&63~NӸqx?1x\8$S.q @YM.\`CŽGHܴbwA 7ϘW-Cq7b\ wXwUvof`Ͻ""8%A;mgUQ] ' a~v/c=iRuh, 밭Ƣm$y_zc=( zۏFO]BE%+4$|ś !~gqHy,:*}hfLCV m=Hz).f.?۩jz15x>B<SOigL%jM!m)ӑI; ~*J1#ůgK 59ڂq@a3pwk v/ į($WE^Jdp?u8f_ta>7A;d5MӇKckh@Q5#U JvoUp3ډ:m| }ռ,u6r 0. nvptQ80H^%P.=_?a 6mblF!$ sE׳[B!.-GOWݻ{f"M-Kۇ<֦Vܖ]0uE 8P&LM_7A&0z<4`7.q C?&C$gJigY ~Y2zI*"dY[yH<ߋʙ4KpAdg=PRt9Vg&\6GD UOBRhM/pKf=O/%N(Z$ GYRiiV$4ν‹!]vL 92szkC3;_5BOmKy]Cub;RMg3/NB6ףx' ػLA~!& : G@;Tm\o$_dp"T~QP'ZNֿmD}HljDyVF ]+ st߻N/یa'HX"%u܃Ja?Ad R'7& ,@[&lmv .|,{1nkbN&M*gtp?h;H)l>eEV` )SCPMiˇT9%Xj`S0o]V8F\-HJd0xI҂%.ڧ#=}$& 1vWb5W.DAdN*bӾH ֙N!@@\"tYPJ[1*EP2-JܵӈtNn d$is2b|Sm]Ml7}6Ug>7;u pP@B+{j<${w@K2g՜;dd.q9Kq(vx2$}~ GE5(2`bhaKV~$ʉ>jj4]{z<7279{(9|x,@aynp8WP3O|8bG.EQɮ5iS77!u"Lk{DhǟOu1SqMPb3CMS;~6U_~2: ΋p!uhPY sGoPAhvwtD[Ӆ82 rT !GTa1JQ[VB%}ikt] 3UJU~ɊvAD(.#2m Ji G*͓+H$m>3{ΉU`yDK{ }o=q-'zYL`P=ޫ8h[c77q:Mq][-H.^wwK{$}{HX[3cPʕN::z ^0ua){é&E0 *[O]tRRIK><+ `vX-,ER)0m*"qmHSMWlC@$Dbԅs:ple@/o`[rc0VǶ3Mۥ81 w}@/-pYGHN0i1@㎢j8f|>E"S?Y[Kbdl—̭ل4>~n K̿%V({)t\8⛼G5 H>9u· J6&je?kLp@!a FR\pxhW;ʤ (B_9x| _ʰ <,mufXc T} VZ4›NzYhX"k*M(8'I@Q.[р_ PQp h7Yyzu(LRSfTd^aUlQ.^!:'ͻRric6-Xgvio‚L+DyMHc[د~L"#+XڵT}ܚ14ꛊ{7JpںyɸVE\μdM O(UuVeqsAqo ~li2iھ9[i!!hFe=6g5h1;C\+#vC׈I}m<3J|C @ l8V |%&v&Kq=w29d>xKu ᄤ$zp,[нp-FlqRUBpd^i{aBI˦k֛"ld05շ(4º`!AޢeđF羁 y갔U4  4ۯu`&=_d5zծE#Qɔz^RX5Fe?O8@O,:#T\) UDMO*}y ג:r*I%eWyKk)">^DmEm4/9{Lΐ%v!x h1s{TRL65ු @d7#< ¤ Ep)T*M P*M֕KENW?Hu9ICV)ٍC Ѕ6u =ġN Q+\R:vy9ewT1CiA~I8J=+U ׁ=boge 5?ԫGz@ % 󿭵"|R:c1oi2E'vinh˅ è[f*D{.'Hܠ%ߚ;8ew˯~+%[fPfeM`IgSa!:ԴVpE"e҆[wkp>*cZPuؼXAl9NБRU?qo>[=:~ďgU&RH|aXdY% Zp^FLTb'j4N"gJAR8]%uh%1Mu7tII8a  .f_mcE@K}ۏCzhNj暉QԠ7tJ#vsܪl;OǤA0-]B -ӭ?V[& |+|f=Ǝluv޷O6#yo6P<lf_\-7[Gmf43ZƐ(<*N7(tzdࡣFVȋ%π90OCwﯠ2aeDP6"L<]6tim B[v"[eJ3,<=r9ȹ^p-ߤ`SDBkI^Pt$UCfZ/x-{duޕRa9xtZxpyp,-H.f{_24hx}W=bX64)pK  pn="7?8לgTܡ{ۨ,Ͳj5Vg53 Z=-73~s ȟ&C"GFBR5)Rr#4UmyWfQlt?) a מ^U>47 !J|HDP{UnvY:ܢaG)r;@X!LdPI {L;R Apbz{8^5e䦅C\e}uZQZj7ѴjH+ލ94V l39avtkez"UGNoVQE>ϴ<^ju}3sDfkw|*qaa e0XÊ']t'<ŨthP1m)W.F ?-}rp|'DbD‡9ZL: WD.Ĭװ)\졦rs?DCmNIE,ФN H8m%4ĈLLf{𱙡gAԂP"]'؜'ȧG-E%[ s{)GHoKMs;8yN)R*K +(cL71k7=kn`d:ʉJwE[X0$OZuz wC N؊czϸ6ژgբaI-q/ƶk4KKh*G[5ex$BړcNsPvl͉0"4ƌY&azVL\T ].5bMÎM @o_U16\SoLt0^SS?4^Em h:l[6/3*| Զa#-P@>-U)jfЅ(HVټ&(d`s*17 M llͥsCٯ/_Z>(w3J8p*q {odqn9IJB)3ţvt=ЊBssR)D~$fcϔifD,ƿXCΞ[z뾄P*ob OZQFaS!7r|VY&iC yI<"BRzL,r0@ (VFF ;aw <MXG;Z\F25$YكS=-ᠽǖvtQB (&f9!cQ-w*x H"9k|}R4i CLD*>NԅM=PXGHTa+Ht,8r}L|b̩/s=Oܦ4 ʭp} b zOD.A*x0'X?:3Ρ[֜Ԉ;Le ,0: bT⊙7 k(;`OyJjG DKK UB ~`y!,ÔVulN_,0{4 ZqDN1e])v)caPdbF:w嘑^Թ+ }C>#R5h๖@1ț*#6}l\n]TEK|l;4.P(uo69>vLԿWzRr YzhJ]2sAWb,+Oxz[v'8>D&OԚOW4;f19+gLRl8cϢM=Tܟmv#LDk呕rJ:N']/*_B4߂(vk9s!ZZyZAmi&iwaɘN}ʡjWaaW}<60fC~M'p0us[:Eo<#; *K,h2cCK]zM3hymScāezB$%n9+׌K!0N +w-0gO|ޫ:#=8,0YO#9@GM2@W3㟵k R˽if-*@/XG_7dYG/r bjډDnBARܗۇD.RtJJGMuXJ-3yYٌXj$rI"ۆ8[}C))g~g2'n* CUhpy4P`~cϞb1ِ6V 7[{?*g=4 jޑNM aU)0VJ  5 tpbWt*7)G qQ!3lGW:&SR`&Y !3M8+C2"d4̜p\{}5 j yYju<~=kUlP`Օ )-vXEISo&\= 3ЎF OGt]ZJ@xhi5oe":d@k4d fs{>}=797ˌ]w0|HcA'z=,x01!ԚC1~w襁U[+]wF^ϞRhd2K@+Hl7pd "5|ex=*b7-I]_m1Q0uh jnq熹%4x.r*r|}l1Q3CHFk%Lҟib3 eTί?퐛U讇U ʈc&Vq}3I2ƚDht{@1  @ Ͽma&ё0F6[qM|r?@(pJ TmdzA*L ӣ^/ᚱWy=㊵-#V}w,yzڦSOE EE0T Eȃر/x0O [1^lMJV:S|:&hΖ(^ 3M#,nhW&\IuȘ41< .^l&]ּB1u Ƈ/ F~-*C<ډL{-E|u> [c>quRZ>r+0@< aYɂ=fn`CiϮp?AB뺠T@IFbMq`eyX %D64-a0@iGѿX!=wnDx"U`D >ܿ}K"g2Sҽx0$6EMT⊦=Z tZ&:tf߃ɘJ+`sCsYƣokZɤ+o[K7~/sJ!QE Iɑ\MMw6!kTំ o$[XM%KY\;OleL){lunOT`G^zuϹ.G}+Ӣ5?'+5xWDWm PJocz*V唵H)li[/ĉ7G ޛSr0y]Tш"Qȉ55w oҊ1TDigFW E+4a0M&_xy̮#LnǷ[q:f3Ջes/A+WS~EdTq6XtQlnoc). ca`wOcйAx>iiYjHÍ&h٬;Dȯ5 U9MQtWO_֌3$ę W> M?-w|,/Aݱau8|n@;WD.zUn݃prǥK wC=X3!جNm 빎$U bm8&-’atP,HȼX] `~ζgֹ+VX\d}L y(:#7vQMh*}% # l"S՝fP՞K:2y1z,Kݣ6$5 1UUl6"Үkb̀Rnt˜Tʇ.[z.1?|0ۓ\62f]v4ԇLR@);Kւ5*i`_Suw&WL?o>"Bm1L)ft{Sug0w__%Yi\ $*] Ӓqٵ,}2$}v _O9nEC-Oato gJ̍@,G2Zu}ށ6q_mHN~岛c Hrè *,hgSĞQ{Y a> O cI'Njfz}E|Vo #zҍbWu}īOV3/9/dd0ShD lbjGu!zgyaŞ5../Сpy藹C8?+s+hX/!,R^"wC|tp <<2T(˥xf6>#/ˣ*_찓0u'f6xDw8|[\ZzG`\ſ$j}{͔AH GV7Z)'5q=nMgλIڶ/7"~>,ߠX#ɘE$qZJP9 "'9$P|^} jd#×dL˜آfsrB!Mo@`~c*=knP qC:YcB;O ƺET0%=2^-0ŦM_*.{'c=Wq/EN?,{X^A֬H+D^fL%UBw !{/U>Oޢ_!!PǺodGK13Izv-o# $' !T bWÜea|7BF6bC:StT(b„(,*Fᅛv'鴿ޯcPfWՔ@|}r8(zz}/pg 4EB^!BAk,LCf@mkkմטMKIft;̈́\z[ hz,)L+'L6qӐcUrٹ_M:,ǮpqF>FJ(tߴn?ߝNe ay zrHsuq*VɐY #bVvAitIR{YR6F7@„~sM`QYxTG&#}b!tZn12i(\̎ &`& #p-Y1j>^uٺٲ_:,Ս 7iS| AF%A9EpN8]>"b '~GcaH-@@(6|oԘc- cS"B]VACSNPUGNa+Lf{K3]_^$JW C aЩ]ƍwY>#6csKCM`(&ɏyg@T*{?>i7r(<ÚGqZǐФ .xBǧ_%y~s@/LjUI n^DiU20 3o*ILIa2X{U~@=iUB?'F+@Eop-bQx w?RgfW9ie;혅Jb>.&FRw181R9kIЃc*6l\RF"{%mtd9-i""8*?6M Q?&mYJkʓ0-|(G~<  R8OrҮEYr k;,b(<s?zj)mZ^6ygd) Me~[pY ;`DŕmK)8-{N\Nl$]-D2b܊7_[;mV6+rlV1s8N&4G)m:zwJ5z {r:b&'Pw,)v9{$3]tc]Eh|v͖GH0Wh >"K@xU5=o]AQK ͪ2L_ ROC#i_꓍[UyաX(uäC iG{'np= ɛ ru%)yL8N.c+.<{1 bϴ`˽Y9[߲D?rsS>e. SB^(M2ez:0Ct|mSۦJ*9A >DԋG.14 ÓaQ΍[)(fÅføۄ R04 z(6Z|hgzy x6hQ7Ǚb]#4~hz[TrPP;tU3SMº ,p:=C"ugSP\J1Ȇ |,AIpMR]qADh#uMMVl:^eD*cWlNU8u Jf {S2i2m 5w5SU,[cPƚ]977CЮ9Y0KmWeXV`borHؤJ KÊבT PMnQ[㎆o)T4 {[Ҏamx xlvI.UJG"s[H;mm@#w h 3[Ii&?kHG׀/.;G/:x0V^*W&Μ&dZcŀWqYhQ\ z^n;(CܘT&+MMw5Fێb[/4Ԑc}psU9 ߉8d:g02ΒDǔ`"{dT*@Wbd/ !E'g259?zd:8'ق 8,h؟/X0bM\0tXL7{ҀS5CHzWaC1"Kv'+@.`¼ }yFkZ9mq/fjcVM1kɪ6X3m8顥g^cq G>:2e$3U $ 盄Fa ]]j.xW\[)z#>Ra~ﴸղ^vCs"g*V^ܗ24X,I!H8ѹ 1kߺӅ`:F!UMK#.CJ^{20ǘ :amY=[xb'#I=^jx#hn#9&4QjM#y>5Xl,Tja%bB >eC?b3YA%gT DqiA94D_N'-ndYܣOqdA1:I<'gVs52 }h}t ` Տۉ,Z"];sjJȩ>8$}ߡHsi;+$7`oJK4Lj?=V Z6rkI؞Eiy#8֋XV KKw&j`DdAXDClzd% &dXOM~io4ΉI֓flɕ4#:۱BѯQ|ev1Me2s$< ,i[g817;:uwA=yj˰!ya_pC0J}t?æ4R>`71o4MW9z7UUj66\ūwL&dPAfx^MWs f1X$kcO sAք%_ոYg20}]!Dc1"32`'u_-]WTZO98:^(^g⏬,/{JŽ,^NS%y*OS*Sr|pB~ ӃK6 ^zKTMWLvyRu&*9H{k"-lRKT4 ٺoo4lAλ*4~U`pӋg1R݄8ZgX}^SĦw5qN8JQ@HWzx~ `'Ţd :BR=VNrtkK 1ŗAL1V|9K i]コ|! ^\ǹUD@m&4sR`:{rdz>9 qn@:tTwgOm0)2ՂETFhdMẀD(j>cSdX%%tńP/%>6ͣdt LI03;97@Rle]vpd>_v>V`M>NI.ZT%>. fbW3) 4v'e@b#X>e_9 Ff3 D;Q"=DS4#Ȧy{Ğk b̬jv0H]1M@sZA7ֻW z?UO""W$*}]$ڮzt}ҷ{tf|g zuanZ:z$Xr+4v\ ClיFto^K%VZ@Cv9Q.O}} ]>52) Xgg@=&T[U]vϞDgސJsZ$Vg?qZL" c$΢Xe%g-U ,v>j|K{x WܑDU'$Mn: j45.I(|;Bޖ\BFb媷vM|b#2Pw2E;EGfZϒ 4xR4L>0瑠Pܡ bŔBS,!V~zIM yQ6j N'8bP>oYӠ.*Uff1{G h$mg;A w-'AqA3 -*681ȶ)s~.8L#|HtT$3yFp@]nr@hxo^O^n<~e=oaW D6pWL*P{TJБvaJ"KՏGL蚤X2}ִ RvޣuSLvLAٯNm꘰MtQc٪ے ^ݹFj`|SFYdv 1F׻QM*K.zCp$C\5l it`dnމAC@}0)'2<$$s bѱӹR)ȌeoDBhmU:S:kZ=n Jʫ}w'*~{TL<::;!4V'.l蚬&`&e|!v톈8B[[X{b(:6Mb@tѯ7SQ gC8msD:W} }],xF9 a[X +hs D=Eg;!p@HbkXG*v R,m(jB:/?f2N#YSY6ubrDb8-p:IsSIA崏6pqpky;p$U^d$W}JNƛK{h0s|mhⓁMj/HZ|K}`[Q=> ڀRp2N()zc?FwqǣPr*Ow 믨Կ"±\ƭwH2:Z+H9ESedFskM4}fsSa7mf,ntܮiU ~tR$"9n理2})X*k;}!yVs[l T5KO6BLFCT96'Hz?^GǙ=fօ:KiIj 4ncөԖ9*K寞=mR`*-%ϓ'RGtaXeuF?-[;Agؑү-v,/G;o\Bz?dS9: C֋dC)jU d|\ I͢dtMitGх)Wc^E.K@n iW~Z_{&~a8;k*} l6VCc&3xjdHG8!7Onѩ}p`<-ZHAAIy3;ߧVL"OPZ(^g !Agށk^ch,p6 RO2]jfxlPcUWe>kx{Tŀ+UJ\ rtQ"(6$vE7h7(s…%%eɩ.Zҋ«Kiڨ0U m(p4<%.m5b^z!TIGo0Ё A!<u[`҅sJ]] RP%f5uxzi~KQ+"0r! sZlc*On&=_SOkU^p ml!Ale]\6gg W{)/_aoPAJT'nm2IOY \IBM{<:3 Ąru?3Ĺ@kLT8P&6C]AP4$&_#d/e'ZϷ6\? Doj~s0ۛa3Q%8>)pc&)ka[#d3BcΪr'qzz̏nz*D !@4ǦSq5l"Ή&Dy yZ<6ATRRP^ dնڌcV<Ա\1 Q%9 dk_1[^.\WfmpL\q{bd*}Vx 3mhT`.Ȉ$)9& Bw) "}fTc,cg~#=iK-)kt2[=gRQ )c,$mش$J@6EN֫*qJBhwtkZ}t 2Tn㢥;;B5+:Q ~T0p=7pesX1Mh\(Ʊ1}dåuqߡnz&+hZWdٟ`s iEn U`Z/*tJJ#CHDk5߂Y89[H :%).:f!-KvxN)|("@S0˷gZjs i`BfB8>IJQV$1CZbc嶱3ny,(fHw܌W;'J㽱2~Mƽ}n~\;t'dtu:jQEO%rܾmv,xY`"nbCg, Sȥsj'Ts,<ƞftc'*]@_8PD{32U3',h:^&hUָ7ѽ{ؒ||;F;@mY¢X3oK 5b$^.!\CðξJx.//4E'T ӉNr 0m8{ukGrQDՠkHkcHXQprIDOHA;ȓ]͎m~>*t8W΄I{F!BHP$}a?wN; znrTgJiW[%{k^y&Ue$FF] [G7yebѨƃH>Wi".b`;`%9K1DijA6WuBt39VnBHѧvCLg!,W 'Yx7 =qXLȖi>DIqXOqMpB}C$mH o`Y3k Qjsd|p7|ej f0<%_ 7rV#n!D;w;L0>'@Q:_b^s.6՛IaO]`INxf923!Y0o@Ki&PUu<¿ 8{X⢈) 3oTt[-S\@[s9\B ޥλkDP7roPFsIOnL^.G0+Qmc3KГ]vΓ9">:3+wKݖwY˄r_ͮHb:jdcІedvDėi` +~欍[nB+{/Ȩs*5KAD$„tذU鸦40eĝԆunJbu^~?i<>UL!2|P $Zܖpj!}dN ct l hJDZ c؀V}4xf*; '@̆"& zWZ/2@8ێtA?q"n gF-H#c0f pe#Z] _921:c^j-/eWfskaw+6ΫΎo$Ko|=Q(Öi45kQuWoMzEEƷyX&qg( #x,Y:[}m RP2>G8&T;Ęk)@)&yϪTFջ/n ":U!h16A|!iPdE- ama=o𑂢pqxu}㋟ɇ&6ɽ\+ `6&GN"#!e Vx#IWgߒLJ~f6Y] @l_?>~UYRH*C}sm*PS h``_D v11B ?G7帱|FI͜>IBȌ|2Ҵ|.3\]!u[-dEEIl~uZ{*w>ކщEub6nn,'BY?%2#yzH$kKv{ZV:װ EZ ygͦm6?x`騄]s(}U\wl7E^j(gȘ72$ΕlaampG, N3e/س 2QiT^SI`C[ cYRC/܌h ҷiWѾGR>'tB#&`֛[@j~'\"?n yRQEB3TpV`xBGթ2*Jy"W'X