apparmor-docs-3.0.4-150500.11.9.1 < > , $ԉ e%p9| O e, +ᲛRx9;Y{WA>Sdǚ4J95
N.Xֿ^H
2Hg˽Dϒۿv4 cJ֑K
ԇ'0IyԺw2 l#q w
x[# eh+}ЧsP֟CiǪ_!
U`F#QCl0`H@iOM
dqN8J{"T7(@4`,1 > ; ? d $ C 5 I h n x
G
T @ P ` ( 8 9 : ` F G H I X Y \ ] @ ^ b U c d e f l u v z S d h n C apparmor-docs 3.0.4 150500.11.9.1 AppArmor Documentation package This package contains documentation for AppArmor.
This package is part of a suite of tools that used to be named
SubDomain. e%h03-ch2c عSUSE Linux Enterprise 15 SUSE LLC GPL-2.0-or-later https://www.suse.com/ Documentation/Other https://launchpad.net/apparmor linux noarch e % M E. V A큤A큤 eee"b`b`b`%b`eb`b`b` c30036de8e525c68d8474622f3f6984164dc60e91670039898e5b9066ae562d6 30a0adfab04b7755e093632fab7b8ab2adea32fc2eb640ec9586faa0cd2ebbd4 bfadc5ec4cbe5c894595c52b95c516d8daa27a76a6cc356b77065592ed8a0299 d383e3f1c2fd71198fe319a325fbb9a2068dd73b2609e27db150d3aeddd9ed06 474d65c9a3464d4a98ff295211ad0f248987237746fb4491779d0d2887ebf76c 5e33ae4afd85d4e8a3a0f579068ca74e1686ba4651958a25e6792c6e1226f58d bb7e15ffdd6bd82b037c217dfac7d3cd0f310aadba0776760d1d3b73f6bb778c 6060fdf95aa753427faf0a9b7f2aca6de48d1e7e909009845d8a526d25e358a5 84c8cdc92165201b233cf1607b5c1096de663abb9ed9afc9d3e92da2db5b35c6 root root root root root root root root root root root root root root root root root root root root root root apparmor-3.0.4-150500.11.9.1.src.rpm apparmor-docs
rpmlib(CompressedFileNames) rpmlib(FileDigests) rpmlib(PayloadFilesHavePrefix) rpmlib(PayloadIsXz) 3.0.4-1 4.6.0-1 4.0-1 5.2-1 4.14.3 ev@d@d@c@cbk@bi0@bZbV@bT@bRbBb<]@b@a7aZ@ap@a abaim@aEaaua
$@`#@`
@````_ @`% @`!'`>`
@__ǁ_ǁ_Q_h__@_~@_[f_P_-B@_@^m@^@^<@^j$@^,-]҇]o](]K@]]@\\@\ \\v{\I\
include in apache extra profile optional to avoid problems with empty
profile directory (boo#1178527) - prepare usrmerge (boo#1029961)
* use %_pamdir - update to AppArmor 3.0.1
- minor additions to profiles and abstractions
- some bugfixes in libapparmor, apparmor_parser and the aa-* utils
- see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.1
for the detailed upstream changelog
- removed upstream(ed) patches:
- changes-since-3.0.0.diff
- extra-profiles-fix-Pux.diff
- utils-fix-hotkey-conflict.diff - Use apache provided variables for the module_directry:
+ Use %apache_libexecdir
+ Add apache-rpm-macros BuildRequires - add utils-fix-hotkey-conflict.diff to fix a hotkey conflict in
de, id and sv translations (and fix the test) (MR 675)
- add extra-profiles-fix-Pux.diff to fix an inactive profile -
prevents a crash in aa-logprof and aa-genprof when creating a new
profile (MR 676) - update to AppArmor 3.0.0
- introduce feature abi declaration in profiles to enable use of
new rule types (for openSUSE: dbus and unix rules)
- support xattr attachment conditionals
- experimental support for kill and unconfined profile modes
- rewritten aa-status (in C), including support for new profile modes
- rewritten aa-notify (in python), finally dropping the perl
requirement at runtime
- new tool aa-features-abi for extracting feature abis from the kernel
- update profiles to have profile names and to use 3.0 feature abi
- introduce @{etc_ro} and @{etc_rw} profile variables
- new profile for php-fpm
- several updates to profiles and abstractions (including boo#1166007)
- fully support 'include if exists' in the aa-* tools
- rewrite handling of alias, include, link and variable rules in
the aa-* tools
- rewrite and simplify log handling in the aa-logprof and aa-genprof
- see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0
for the detailed upstream changelog
- patches:
- add changes-since-3.0.0.diff with upstream fixes since the 3.0.0
release up to 3e18c0785abc03ee42a022a67a27a085516a7921
- drop upstreamed usr-etc-abstractions-base-nameservice.diff
- drop 2.13-only libapparmor-so-number.diff
- refresh apparmor-enable-profile-cache.diff - partially upstreamed
- update apparmor-samba-include-permissions-for-shares.diff and
apparmor-lessopen-profile.patch - switch to "include if exists"
- apparmor-lessopen-profile.patch: add abi rule to lessopen profile
- refresh apparmor-lessopen-nfs-workaround.diff
- move away very loose apache profile that doesn't even match the
apache2 binary path in openSUSE to avoid confusion (boo#872984)
- move rewritten aa-status from utils to parser subpackage
- add aa-features-abi to parser subpackage
- replace perl and libnotify-tools requires with requiring
python3-notify2 and python3-psutil (needed by the rewritten
aa-notify)
- drop ancient cleanup for /etc/init.d/subdomain from parser %pre
- drop (never enabled) conditionals to build with python2 and to
build the python-apparmor subpackage (upstream dropped python2
support)
- drop setting PYTHON and PYTHON_VERSIONS env variable, no longer needed
- set PYFLAKES path for utils check
- add precompiled_cache build conditional to allow faster local
builds without using kvm
- remove duplicated BuildRequires: swig - update to AppArmor 2.13.5
- add missing permissions to several profiles and abstractions
- bugfixes in parser and tools
- fix two potential build failures in libapparmor
- see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
for the detailed upstream changelog
- remove upstream(ed) patches
- changes-since-2.13.4.diff
- abstractions-X-xauth-mr582.diff
- sevdb-caps-mr589.diff
- libvirt-leaseshelper.patch
- cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658) - add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
cap_checkpoint_restore.diff) - %service_del_postun_without_restart only works for Tumbleweed,
keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x - Make use of %service_del_postun_without_restart
And stop using DISABLE_RESTART_ON_UPDATE as this interface is
obsolete. - libvirt-leaseshelper.patch: add /usr/libexec as a path to the
libvirt leaseshelper script (jsc#SLE-14253) - sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
to severity.db (lp#1890547) - add abstractions-X-xauth-mr582.diff to allow reading the xauth file
from its new sddm location (boo#1174290, boo#1174293) - add changes-since-2.13.4.diff with upstream changes and fixes
since 2.13.4 up to 5f61bd4c:
- add several abstractions related to xdg-open:
dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
kde-open5, xdg-open
- introduce @{run} variable
- update dnsmasq and winbindd profile
- update mdns, mesa and nameservice abstraction
- some bugfixes in the aa-* tools, including a remote bugfix in the
YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
- make-4.3-capabilities.diff
- make-4.3-capabilities-vim.diff
- make-4.3-fix-utils-network-test.diff
- make-4.3-network.diff
- abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff - Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
(bsc#1168306) - fix build with make 4.3 by backporting some commits from upstream
master (boo#1167953):
- make-4.3-capabilities.diff
- make-4.3-capabilities-vim.diff
- make-4.3-network.diff
- make-4.3-fix-utils-network-test.diff - update to AppArmor 2.13.4
- several abstraction updates (including boo#1153162)
- disallow writing to fontconfig cache in abstractions/fonts
- some bugfixes in the aa-* tools
- fix log parsing for logs with an embedded newline
- see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
for the detailed upstream changelog
- drop upstreamed patches:
- abstractions-ssl-certbot-paths.diff
- apparmor-krb5-conf-d.diff
- libapparmor-python3.8.diff
- usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff - add usr-etc-abstractions-base-nameservice.diff to adjust
abstractions/base and nameservice for /usr/etc/ (boo#1161756) - Properly pull in full python3 interpreter - add libapparmor-python3.8.diff to fix building the libapparmor python
bindings (deb#943657) - add usr-etc-abstractions-authentification.diff to allow reading
/usr/etc/pam.d/* and some other authentification-related files (boo#1153162) - add abstractions-ssl-certbot-paths.diff - add certbot paths to
abstractions/ssl_certs and abstractions/ssl_keys - add apparmor-krb5-conf-d.diff for kerberos client - update to 2.13.3
- profile updates for dnsmasq, dovecot, identd, syslog-ng
- new "lsb_release" profile (only used when using "Px -> lsb_release")
- fix buggy syntax in tunables/share
- several abstraction updates
- parser: fix "Px -> foo-bar" (the "-" was rejected before)
- several bugfixes in aa-genprof and aa-logprof
- some fixes in cache handling
- see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.3
for the detailed upstream changelog
- drop upstream(ed) patches:
- apparmor-nameservice-resolv-conf-link.patch
- profile_filename_cornercase.diff
- dnsmasq-libvirtd.diff
- dnsmasq-revert-alternation.diff
- usrmerge-fixes.diff
- libapparmor-swig-4.diff
- re-number remaining patches - add upstream libapparmor-swig-4.diff: fix libapparmor tests with swig
4.0 (boo#1135751) - Disable LTO (boo#1133091). - update lessopen.sh profile for usrMerge (bash and tar) (boo#1132350) - add usrmerge-fixes.diff: fix test failures when /bin/sh is handled by
update-alternatives (boo#1127877) - add dnsmasq-revert-alternation.diff: revert path alternation in
dnsmasq profile and re-add peer=/usr/sbin/libvirtd rules to avoid
breaking libvirtd (boo#1127073) - add dnsmasq-libvirtd.diff: allow peer=libvirtd in the dnsmasq profile
to match the newly added libvirtd profile name (boo#1118952#c3) - Use %license instead of %doc [bsc#1082318] - add apparmor-lessopen-nfs-workaround.diff: allow network access in
lessopen.sh for reading files on NFS (workaround for boo#1119937 /
lp#1784499) - add profile_filename_cornercase.diff: drop check that lets aa-logprof
error out in a corner-case (log event for a non-existing profile while
a profile file with the default filename for that non-existing profile
exists) (boo#1120472) - netconfig: write resolv.conf to /run with link to /etc (fate#325872,
boo#1097370) [patch apparmor-nameservice-resolv-conf-link.patch] - update to AppArmor 2.13.2
- add profile names to most profiles
- update dnsmasq profile (pid file and logfile path) (boo#1111342)
- add vulkan abstraction
- add letsencrypt certificate path to abstractions/ssl_*
- ignore *.orig and *.rej files when loading profiles
- fix aa-complain etc. to handle named profiles
- several bugfixes and small profile improvements
- see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.2
for the detailed upstream changelog
- remove upstreamed fix-syntax-error-in-rc.apparmor.functions.patch - update to 2.13.1
- add qt5 and qt5-compose-cache-write abstractions
- add @{uid} and @{uids} kernel var placeholders
- several profile and abstraction updates
- ignore "abi" rules in parser and tools (instead of erroring out)
- utils: fix overwriting of child profile flags if they differ from
the main profile
- several bugfixes (including boo#1100779)
- see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.1
for the detailed upstream changelog
- remove upstream(ed) patches:
- aa-teardown-path.diff
- fix-apparmor-systemd-perms.diff
- logprof-skip-cache-d.diff
- fix-samba-profiles.patch
- make-pyflakes-happy.diff
- dnsmasq-Add-permission-to-open-log-files.patch
- refresh apparmor-samba-include-permissions-for-shares.diff
- add fix-syntax-error-in-rc.apparmor.functions.patch - update rpmlintrc:
- whitelist .features file which is part of the pre-compiled cache
- comment out filters for the disabled tomcat_apparmor subpackage - Backport dnsmasq fix:
025c7dc6 - dnsmasq-Add-permission-to-open-log-files.patch
(boo#1111342) - add make-pyflakes-happy.diff to fix an unused variable (SR 629206) - add fix-samba-profiles.patch - smbd loads new shared libraries.
Allow winbindd to access new kerberos credential cache location
(boo#1092099) - exclude the /etc/apparmor.d/cache.d/ directory from aa-logprof parsing
(logprof-skip-cache-d.diff) - add fix-apparmor-systemd-perms.diff - fix permissions of
/lib/apparmor/apparmor.systemd (boo#1090545) - create and package precompiled cache (/usr/share/apparmor/cache,
read-only) (boo#1069906, boo#1074429)
- change (writeable) cache directory to /var/cache/apparmor/ - with the
new btrfs layout, the only reason for using /var/lib/apparmor/cache/
(which was "it's part of the / subvolume") is gone, and /var/cache
makes more sense for the cache
- adjust parser.conf (via apparmor-enable-profile-cache.diff) to use both
cache locations
- clear cache also in %post of abstractions package - update to AppArmor 2.13
- add support for multiple cache directories and cache overlays
(boo#1069906, boo#1074429)
- add support for conditional includes in policy
- remove group restrictions from aa-notify (boo#1058787)
- aa-complain etc.: set flags for profiles represented by a glob
- aa-status: split profile from exec name
- several profile and abstraction updates
- see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13
for the detailed upstream changelog
- drop upstreamed patches and files:
- aa-teardown
- apparmor.service
- apparmor.systemd
- 32-bit-no-uid.diff
- disable-cache-on-ro-fs.diff
- dovecot-stats.diff
- parser-write-cache-warn-only.diff
- set-flags-for-profiles-represented-by-glob.patch
- fix-regression-in-set-flags.patch
- drop spec code that handled installing aa-teardown, apparmor.service
and apparmor.systemd (now part of upstream Makefile)
- simplify "make -C profiles parser-check" call (upstream Makefile bug
that required to call "cd" was fixed)
- add aa-teardown-path.diff - install aa-teardown in /usr/sbin/
- move 'exec' symlink to parser package (belongs to aa-exec) - Set flags for profiles represented by glob (bsc#1086154)
set-flags-for-profiles-represented-by-glob.patch
fix-regression-in-set-flags.patch - add dovecot-stats.diff:
- add dovecot/stats profile and allow dovecot to run it (boo#1088161)
- allow dovecot/auth to write /run/dovecot/old-stats-user (part of boo#1087753)
- update 32-bit-no-uid.diff with upstream fix - Change of path of rpm in lessopen.sh (boo#1082956) - add disable-cache-on-ro-fs.diff - disable write cache if filesystem is
read-only and don't bail out (bsc#1069906, bsc#1074429) - add parser-write-cache-warn-only.diff to make cache write failures a
warning instead of an error (boo#1069906, boo#1074429)
- reduce dependeny on libnotify-tools (used by aa-notify -p) to "Suggests"
to avoid pulling in several Gnome packages on servers (boo#1067477) - update to AppArmor 2.12
- add support for 'owner' rules in aa-logprof and aa-genprof
- add support for includes with absolute path in aa-logprof etc. (lp#1733700)
- update aa-decode to also decode PROCTITLE (lp#1736841)
- several profile and abstraction updates, including boo#1069470
- preserve errno across aa_*_unref() functions
- see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.12
for the detailed upstream changelog
- drop upstreamed patches:
- read_inactive_profile-exactly-once.patch
- utils-fix-sorted-save_profiles-regression.diff
- lessopen profile: change all 'rix' rules to 'mrix'
- add 32-bit-no-uid.diff to fix handling of log events without ouid on
32 bit systems
- no longer package static libapparmor.a - update to AppArmor 2.11.95 aka 2.12 beta1
- add JSON interface to aa-logprof and aa-genprof (used by YaST)
- drop old YaST interface code
- update audio, base and nameservice abstractions
- allow @{pid} to match 7-digit pids
- see http://wiki.apparmor.net/index.php/ReleaseNotes_2_11_95
for the detailed upstream changelog
- drop upstreamed patches
- apparmor-yast-cleanup.patch
- apparmor-json-support.patch
- nameservice-libtirpc.diff
- drop obsolete perl modules (YaST no longer needs them)
- drop patches that were only needed by the obsolete perl modules:
- apparmor-utils-string-split
- apparmor-abstractions-no-multiline.diff
- drop profiles-sockets-temporary-fix.patch - obsoleted by a fix in
apparmor_parser
- refresh utils-fix-sorted-save_profiles-regression.diff
- add aa-teardown (new script to unload all profiles)
- make ExecStop in apparmor.service a no-op (workaround for a systemd
restriction, see boo#996520 and boo#853019 for details)
- lessopen profile: allow capability dac_read_search and dac_override,
allow groff to execute several helpers (boo#1065388) - read_inactive_profile-exactly-once.patch (bsc#1069346)
Perform reading of inactive profiles exactly once. - update to AppArmor 2.11.1
- add permissions to several profiles and abstractions (including
lp#1650827 and boo#1057900)
- several fixes in the aa-* tools (including lp#1689667, lp#1628286,
lp#1661766 and boo#1062667)
- fix downgrading/converting of 'unix' rules (will be supported in
kernel 4.15) to 'network unix' rules in apparmor_parser (boo#1061195)
- see http://wiki.apparmor.net/index.php/ReleaseNotes_2_11_1 for
upstream changelog
- remove upstream(ed) patches
- upstream-changes-r3616..3628.diff
- upstream-changes-r3629..3648.diff
- parser-tests-dbus-duplicated-conditionals.diff
- apparmor-fix-podsyntax.patch
- sshd-profile-drop-local-include-r3615.diff
- refresh apparmor-yast-cleanup.patch
- add utils-fix-sorted-save_profiles-regression.diff to fix a regression
in displaying the "changed profiles" list in aa-logprof - add nameservice-libtirpc.diff to fix NIS/YP logins (boo#1062244) - profiles-sockets-temporary-fix.patch to cater to nameservices with the
new sockets mediation, until unix rules are upstreamed (boo#1061195) - add apparmor-fix-podsyntax.patch from mailing list to fix
compilation with perl 5.26 - do not require exact X.Y version of "python3"
- require also matching python(abi) which is arguably more important - don't rely on implementation details for reload in %post - add JSON support. Required for FATE#323380.
(apparmor-yast-cleanup.patch, apparmor-json-support.patch) - add upstream-changes-r3629..3648.diff:
- preserve unknown profiles when reloading apparmor.service
(CVE-2017-6507, lp#1668892, boo#1029696)
- add aa-remove-unknown utility to unload unknown profiles (lp#1668892)
- update nvidia abstraction for newer nvidia drivers
- don't enforce ordering of dbus rule attributes in utils (lp#1628286)
- add --parser, --base and --Include option to aa-easyprof to allow
non-standard paths (useful for tests) (lp#1521031)
- move initialization code in apparmor.aa to init_aa(). This allows to
run all utils tests even if /etc/apparmor.d/ or /sbin/apparmor_parser
don't exist.
- several improvements in the utils tests
- drop upstreamed python3-drop-re-locale.patch
- no longer delete/skip some of the utils tests (to allow this, add
parser-tests-dbus-duplicated-conditionals.diff)
- add var.mount dependeny to apparmor.service (boo#1016259#c34) - Cleanup spec file:
- don't use insserv if we afterwards call systemd, this can
have bad side effects
- remove dead code
- remove now obsolete 'distro' checks
- Replace init.d script with new wrapper working with systemd - add python3-drop-re-locale.patch: remove deprecated re.LOCALE
flag in Python UI as it was dropped from Python 3.6 (lp#1661766) - Fix RPM groups - add upstream-changes-r3616..3628.diff:
- update abstractions/base, abstractions/apache2-common and dovecot profiles
- merge ask_the_questions() of aa-logprof and aa-mergeprof
- pass LDFLAGS when building parser, libapparmor perl bindings and pam_apparmor
- adjust deleting the cache in profiles %post to the new cache location
- silence errors when deleting the cache (boo#976914) - split libapparmor into separate spec to get rid of build loop
involving mariadb, systemd, apparmor, libapr and mariadb again
(see the discussion in SR 448871 for details)
- libapparmor.spec is based on the AppArmor 2.11 apparmor.spec, but
with minimum BuildRequires - update to AppArmor 2.11.0
- apparmor_parser now supports parallel compiles and loads
- add full support for dbus, ptrace and signal rules and events to the
utils
- full rewrite of the file rule handling in the utils
- lots of improvements and fixes
- see http://wiki.apparmor.net/index.php/ReleaseNotes_2_11 for the
detailed changelog
- patches:
- add sshd-profile-drop-local-include-r3615.diff to fix 'make check'
- drop aa-unconfined-fix-netstat-call-2.10r3380.diff, no longer needed
- refresh apparmor-abstractions-no-multiline.diff
- refresh apparmor-samba-include-permissions-for-shares.diff
- spec changes:
- aa-unconfined switched to using ss (from iproute2), adjust Recommends:
- move libapparmor to /usr/lib*/
- drop %if %suse_version checks for 12.x
- change several Obsoletes from %version to < 2.9. Those package names
weren't used since years, and 2.9 is still a careful choice
- include apparmor.service independent of %suse_version
- techdoc.pdf is now shipped in upstream tarball to reduce BuildRequires
- drop latex2html, texlive-* and w3m BuildRequires
- techdoc.txt and techdoc.html not included, drop them from the package
- run most of utils/ make check (some tests expect /etc/apparmor.d/ and
/sbin/apparmor_parser to exist, skip them)
- BuildRequires python3-pyflakes (utils tests) and dejagnu (libapparmor tests)
- drop sed'ing python3 into aa-* shebang (upstreamed)
- build binutils
- aa-exec is now written in C and lives in /usr/bin/, move it to the
apparmor_parser package and create a compability symlink in /usr/sbin/
- aa-exec manpage moved to section 1
- aa-enabled is a small new tool to find out if AppArmor is enabled
- package new aa_stack_profile(2) manpage - change /etc/apparmor.d/cache symlink to /var/lib/apparmor/cache/.
This is part of the root partition (at least with default partitioning)
and should be available earlier than /var/cache/apparmor/
(boo#1015249, boo#980081, bsc#1016259)
- add dependency on var-lib.mount to apparmor.service as safety net - update to AppArmor 2.10.2 maintenance release
- lots of bugfixes and profile updates (including boo#1000201,
boo#1009964, boo#1014463)
- see http://wiki.apparmor.net/index.php/ReleaseNotes_2_10_2 for details
- add aa-unconfined-fix-netstat-call-2.10r3380.diff to fix a regression
in aa-unconfined
- drop upstream(ed) patches:
- changes-since-2.10.1--r3326..3346.diff
- changes-since-2.10.1--r3347..3353.diff
- libapparmor-fix-import-path.diff (upstream fix is slightly different)
- nscd-var-lib.diff
- refresh apparmor-abstractions-no-multiline.diff - add nscd-var-lib.diff to allow /var/lib/nscd/ in the nscd profile and
abstractions/nameservice (path changed in latest nscd in Tumbleweed) - add changes-since-2.10.1--r3347..3353.diff with upstream changes and
fixes in the 2.10 branch, including
- allow writing *.qf files (for disk-based buffering) in syslog-ng profile
- add several permissions to the dovecot profiles (deb#835826)
- add a missing path in the traceroute profile - add changes-since-2.10.1--r3326..3346.diff with upstream changes and
fixes since the 2.10.1 release, including
- allow dac_override in winbindd profile (boo#990006#c5)
- allow mr for /usr/lib*/ldb/*.so in samba abstractions (needed since
Samba 4.4.x, boo#990006)
- abstractions/nameservice: also support ConnMan-managed resolv.conf
- let aa-genprof ask about profiles in extra dir (again)
- fix aa-logprof "add hat" endless loop (lp#1538306)
- honor 'chown' file events in logparser.py
- ignore log file events with a request mask of 'send' or 'receive'
because they are actually network events (lp#1577051, lp#1582374)
- accept hostname with dots when parsing logs (lp#1453300 comments #1 and #2)
- fix python LibAppArmor import failures with swig > 3.0.8 (boo#987607)
(libapparmor-fix-import-path.diff)
- refresh apparmor-abstractions-no-multiline.diff
- drop upstreamed profiles-ping-inet6-r3449.diff
- add %check section - runs libapparmor (including swig bindings),
parser and profiles tests
- add BuildRequires: perl(Locale::gettext) - needed for parser tests - add profiles-ping-inet6-r3449.diff - latest ping also does IPv6 (boo#980596) - update to AppArmor 2.10.1 (2.10 branch r3326):
- fix incorrect output of child profile names (apparmor_parser -N) which
caused 'rcapparmor reload' to remove child profiles and hats (lp#1551950)
- fix a crash in aa-logprof / logparser.py for change_hat log events
(lp#1523297) and log events that look like file events, but aren't
(lp#1540562, lp#1525119, lp#1466812)
- write unix rules when saving a profile (lp#1522938, boo#954104#c3)
- several fixes for variable handling in aa-logprof
- map c (create) log events to w instead of a
- add python to the "no Px rule" list in logprof.conf
- let aa-logprof check for duplicate profiles
- let aa-status work without the apparmor.fail python module (boo#971917,
lp#1480492)
- add permissions in several profiles (including boo#948584, boo#948753,
boo#954959, boo#954958, boo#971790, boo#964971, boo#921098, boo#923201 and
boo#921098#c15).
- and many more fixes, see the full changelog at
http://wiki.apparmor.net/index.php/ReleaseNotes_2_10_1
- drop upstream(ed) patches:
- fix-initscript-aa_log_end_msg.diff
- syslog-ng-profile-boo948584.diff
- upstream-profile-updates-r3205-3241.diff
- refresh patches:
- apparmor-abstractions-no-multiline.diff
- apparmor-samba-include-permissions-for-shares.diff
- drop libapparmor autogen.sh call (broke the build) and remove libtool BR - add syslog-ng-profile-boo948584.diff - add several permissions needed
by latest syslog-ng (boo#948584, boo#948753)
- add upstream-profile-updates-r3205-3241.diff with several profile updates:
- add /usr/share/locale-bundle/** to abstractions/base
- allow dnsmask to use /bin/sh (boo#940749) and /bin/dash
- allow dovecot imap to read /run/dovecot/mounts
- allow avahi-daemon to write to /run/systemd/notify
- allow ntpd to read $PATH directory listings (boo#945592, boo#948752)
- update dhclient profile
- allow skype to read @{PROC}/@{pid}/net/dev (boo#939568)
- and some other small updates
- drop upstreamed apparmor-winbindd-r3213.diff (included in the
upstream-profile-updates patch) - netstat moved to net-tools-deprecated in Tumbleweed (boo#944904) - add apparmor-winbindd-r3213.diff - add missing k permissions for
/etc/samba/smbd.tmp/msg/* in winbindd profile (boo#921098 #c15..19) - add fix-initscript-aa_log_end_msg.diff - fixes ugly initscript
output (boo#862170) - update to AppArmor 2.10 (trunk r3205)
- profile names can now contain variables
- improved profile compile time in apparmor_parser
- lots of improvements, refactoring and bugfixes in the aa-* tools
- new apis for managing and loading profile caches into the kernel in
libapparmor
- lots of profile updates
- see http://wiki.apparmor.net/index.php/ReleaseNotes_2_10 for the
complete changelog with more details
- add new apparmor_private.h and the aa_query_label(2), aa_features(3),
aa_kernel_interface(3), aa_policy_cache(3), aa_splitcon(3) manpages
to libapparmor-devel
- drop apparmor-2.5.1-edirectory-profile patch - it's most probably
no longer needed (see boo#621394 for details)
- drop upstreamed samba-4.2-profiles.diff
- refresh apparmor-samba-include-permissions-for-shares.diff - systemd-rpm-macros and %systemd_requires were at the wrong place,
move them to the parser package (boo#931792) - update to AppArmor 2.9.2 (2.9 branch r2911)
- lots of bugfixes in the parser and the aa-* tools (including
boo#918787)
- update dovecot and dnsmasq profiles and several abstractions
(including boo#911001)
- see http://wiki.apparmor.net/index.php/ReleaseNotes_2_9_2 for the
full changelog
- remove upstream(ed) patches apparmor-changes-since-2.9.1.diff and
apparmor-fix-stl-ostream.diff
- replace GPG key with new AppArmor GPG signing key, see
https://launchpad.net/apparmor/+announcement/13404 - make sure %service_del_postun doesn't call systemctl try-restart
(boo#853019, bare systemd edition)
- add samba-4.2-profiles.diff: update samba (winbindd and nmb)
profiles for samba 4.2 (boo#921098, boo#923201) - only install apparmor.service for openSUSE > 13.2 - Add a native systemd unit which *at the moment* only
wraps/masks the early boot script. - add apparmor-fix-stl-ostream.diff which fixes odd uses of
std::ostream which are not valid. Fixes build with GCC 5 - allow lessopen.sh to run /usr/bin/unzip-plain (boo#906858) - add Requires: python3 to python3-apparmor package - readline isn't
part of python3-base (boo#917577) - add apparmor-changes-since-2.9.1.diff with upstream fixes since the
2.9.1 release
- update logparser.py to support changed syslog format (lp#1399027)
- update usr.sbin.dovecot and usr.lib.dovecot.imap{, -login} profiles
(lp#1296667)
- update the mysqld profile
- fix network rule description in apparmor.d(5) manpage
- drop upstreamed dnsmasq-profile-fixes.patch
- update expired GPG key - update to AppArmor 2.9.1 (2.9 branch r2831)
- fix log parsing for 3.16 kernels and syslog-style logs (boo#905368)
- several fixes and performance improvements in the aa-* utils
- profile updates for dnsmasq (boo#907870), nscd (boo#904620#c14 and
bnc#908856), useradd, sendmail, man and passwd
- see http://wiki.apparmor.net/index.php/ReleaseNotes_2_9_1
for full release notes
- refresh dnsmasq-profile-fixes.patch - Fix dnsmasq profile to allow executing bash to run the --dhcp-script
argument. Also fixed /usr/lib -> /usr/{lib,lib64} to get libvirt
leasehealper script to run even on x86_64.
dnsmasq-profile-fixes.patch. boo#911001 - rename lessopen.sh profile file to usr.bin.lessopen.sh to match the
script filename - add apparmor-lessopen-profile.patch: /usr/bin/lessopen.sh needs
confinement. bnc#906858 - delete cache in apparmor-profiles %post (workaround for
bnc#904620#c8 / lp#1392042) - No longer perform gpg validation; osc source_validator does it
implicit:
+ Drop gpg-offline BuildRequires.
+ No longer execute gpg_verify. - fix bashism in post script - update to AppArmor 2.9.0 (r2759)
- change aa-mergeprof to the final commandline syntax
- lots of bugfixes in the aa-* tools (bnc#900163, lp#1328707 and several
bugs without a formal bugreport)
- small additions to gnome, freedesktop.org, ubuntu-browsers.d/java
and user-mail abstractions
- fix mod_apparmor to not break basic auth
- update perl modules to support signal, unix and ptrace rules (bnc#900013)
- don't warn about rules not supported by the kernel
- fix logging of "audit capability" (lp#1378091)
- add support for the "hat" keyword in apparmor.vim
- build html version of apparmor.vim manpage again (lp#1366572)
- see also http://wiki.apparmor.net/index.php/ReleaseNotes_2_9_0
- update apparmor-abstractions-no-multiline.diff
- remove upstreamed apparmor-profiles-ntpd-pid-location.diff h03-ch2c 1696247589
3.0.4-150500.11.9.1 apparmor apparmor.vim apparmor-docs aa-teardown.8.html apparmor.7.html apparmor.css apparmor.d.5.html apparmor.vim.5.html apparmor_parser.8.html apparmor_xattrs.7.html techdoc.pdf /usr/share/ /usr/share/apparmor/ /usr/share/doc/packages/ /usr/share/doc/packages/apparmor-docs/ -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -g obs://build.suse.de/SUSE:Maintenance:30900/SUSE_SLE-15-SP5_Update/bf7fc34cc3d034d75e6790157f5ae668-apparmor.SUSE_SLE-15-SP5_Update drpm xz 5 x86_64-suse-linux directory ASCII text, with very long lines XML 1.0 document, ASCII text XML 1.0 document, ASCII text, with very long lines ASCII text ! TN^C LA; utf-8 50983d00599eb5ae5dd72ac58428a2f176e0117e3b5ee95fde776ff1595a3402 ? P 7zXZ
! t/"] "k%R{_ OdT8v%`}`$njO/B)-Ot&&w 5AcFYC~ZE*P]]aHEs:Ƥ[>JQFsPp/FC(=& [ܛK: A?P
|+icJ9sT 0e|RDo:8[F*s3а?Q ):jj7\ 2; MǂIw{qUf[U(2B7
ЀPAME&bzfEb1$> DbuCa (P_-`Shu5K Ȯ1^ro(1>
Ene 6GxzOm~[1V$")+ u}\* 𫻠 BG+{+wqR9DId1mVʳ`[#F:b?XU-~pv֥vnć "waF6U2'=M7 "0A a|'< " stS0yV3)͌r6fI"_Y13vZ0]f߃!zuײï +8wR ۏ)W3F ~F;Ah7KZ2@ٷ,h&G/$r=BdCJds|UTm<{i$ }/a>+1'l=- wݹ s҈~ ,TS`(8gm @ IK0Y@rnԬMIN y1Eu.{ֽ^x F#[lV:*2\vaO g Cu%m]ZtpsJvjP a&!VT%qJfI0'r
Uw{v{ xyw4SPýn0F`J`lW4ئh+h qL'mJY$4F/ osm
vgxܷL{L ' R%x(*2z;Anvoq4Xg)]rK 0)i>!ՔI K߬Vh* X{F|E &$ Vh8IBwOʴģNP c&mwf%9b/y c E?/l8$T V̿xqDZN6Y$$ iC\џFሂ ->WO NT$$cɐzX+'=|6 +VJ4@gI+Q'>HO*Lbb ǥWA>xń/B^=)&*xfrysX|ķs( E|IcRbE&EUO:Jt{>9u;I"rx`z+k%fؼo/Z.N=Pu">Y _q>|x}_~I<64MڡXήyZ e+mx0R Έ^fcQKS J@IY zUyUo6t$|n$r(+=Ő
@GE''-1i] a3*sYy[cϑf!E_d-1x{+k\rB AJȋ
x3[p}T F* L4w%;ͥz%x2Z>H4i$]`딖z -Dueh5
ow0Dp˷E
Ϛ0 }غ&+X}!o&s{rOI\geV[v-{-/6اo=uNdC yt^ʍCgWIoK^,]!~~G4V
q[]Ijz߬z\i
qٶl~#߾,(GD׳C֓Nҫ +˝WyPy5Vq4~c
1K)=N+X+uq&s0=Ah[ U Iä.t1[Qme ϔ#x"Z6t: >CG*Gw%03 ~=aʙ>4=u?7e_" Agb8 7-{_B]=~B N8^ӣK֬8)g
^ )`~5|k)u! *}ɢqflj}
|एLs^ _ C+8gJ ?|`'ssI4vqpLפzO_*:jaC4S~Qc?( v ̾]# Hi00Nq4 FEcp^O=uޛ/(p_ [?:e
y@k*\@|qVbR4Qw4Bڤ48l-SmW:F!
Ɓ.x1#R{I"q<jCE"srkK[%>?@ d=cBTTb]th^f^E՞r'MV[}ݮCb\rݥY z;m2߶Mُ. zOC4165%X!\.RPH^S{*P c wD˜t F 6Oq]NKfsdXǦUo$ 8.ܼo,.
3
ިќu[](a\[ψ#qw\bFzYwU1:n Ą &. 2lO廲X6kiia[43c
(-Bf1vYAmxa77Äm#p.3^0CpmQ+ĚPr1GV( 0G%軙wW(Z8f*Y T "2嘽e
cv@> .u$ap"ǯDA1#$}:bXW@+6jN)P_]:RMsK2E\ FMa1G v6 4|%M܄G7tux:uO
n#}BH'S6 %E V~@bQ ָUx
!,*UWW[ZS )F!˪=Lm x
9qM1ܱv&up1)ur VD[U+ZJ|pBWIc!1kB,./ OܟRitsݦe ͷ'2gG3ڦgLYc[J <:CK6/. $4tU-x&D[,n|`;sZ9 u'-Y{V#{Xl 2> i*8h4!п"uبϨ1WH"H'Қ r&0X.Kz Snl=ɓ /(4y6N. i7 $!IG\]8iD;O_cX< TwF8_3y!\~Z'ޏhɑ!\ȣ-FĊ&0*b+.ezRA QD붯du4Z{$o~]#N,xݴ 7z=*(*. Wي[l?O=٠Ș?uzO.[XyG|ЍI +d YY]G/E sl e$v.4! @
bN1 (>vzΎ>CK Ë[Ns 0i-8 Z<^O8v&~]͝},G~}ڳ!݆xWaҡ8U,}JV>֕Z%ԮT G1]a!0mFQlP+X>C5W3@.b Ըj NG)ƭbrn`%Z@gGZT%I&B8o \Ma} m%A}yA;9 Qj#JTbB8 0~ 0q\vzU0`4P0Gޜ(>ҹP7pNP(]z*o^بݳPOIn ݈ޜry~bSchѥ]K1mB`8hm{Qv#IF+`sOB#y= YTedcc5 S.z{$*Fu6JjbOW|sFiv\ ;*KbF߬td2 Y;+lZ4
gvIƾdq,dX)뷥M[ċ]nw{sL]_呔}_/OI~^msi :I,m[B$UOX[0Gp:&~8,.A8PM7tG`
;=gCHKjdTQbSAI9=Dw"21TC{0zZ] լpj({~x`:ۃ/7q|3*F|d5VaQA
БZjVs9\AgXE.Q2)RA2$Gb6 qDN P \ ^9OPН Xz_9O!E(pfU?+aOq1&?H n[ q;mrԋ 82A?
mAd~r
|z
3,/j5mR0qTj *a%Ri3mfA|颩Jfj=6$(3`3cg03|9 N9-5A+c{u
-A[˔Wf\ay-[& {J*))$jBA+Y' VʀbWeI6 M")]<ɲh# 揕*N{ED66a6"*GR-kQƷ <ݕYc?1%]o% ?QɛEl<9 kP+ȣݭIـ)i`.6L 7*7A.۶mEC%r!3 ofƏe'j4dk`z:k_!eZj7/$CE8o-xk; ْ}HynWeřyQmP2n?6&=bvpraMô4$Heňp3i0p5
Yuy ・=XUO =z
*^ÄҒLo~9%ў. ^G48{K0(Y8'(0 "FJ%!H
XL 0CkGI.Qa?{D+OyYRjl 4tݫ R$0X+b RiC6;;ĹԊҹ61ĕ6L*
X,7A
7pЋOT BrD ږK >yҳIRiۡ]Suss.ʨH#5GV.T$W2^e~Nee*GV5/hXU~X͠D$vMXmJQ#p9#STe\ )`C܍q2ka 9jvY@ (DBوDo/S(^,hW 7șf+1|~:B"
@ 츘=9 HeSz0k/M@Ȳv#C=$wl
Q~ "ﳫ }m1
=3Ӟhܢ{aN]8Ni꙳+_xJm:rU:/6_]:ݙBe&េms}J Ab4qys${ qt\eB[Q.Vt[΄ #ǖ5W3_.r+b
mqRHş؎ \>V6r*Na"w
hl'ZsAaj[ExÃ&/6ߔASXMxqz]S0F vG}Cޕ@%^Ń6d})oWפrb
[Ӫe .w)\ UљJ >PA 'VkEbOw4LQ֩kx A) ֔iZ W0F@kʄ''a[Vu$ e tܠRe&̩B y~z+U@@OҝrufKdt
%|]c#߈Gj-~ܐ*O.`N/e.#DgC
Iex#1#(6#"
By |5={+=
j]/RS^UPQOpF&X3\a%>Lv) Gg|oCMv℟UrߔKr&bhqOYax4C!MIYIk}}P? ݛ4ڏ7v |\,?|V3T
Ej4çpXfpAqVġg1e[nMhLY|̭䊑f@gos 37UBxq`7%t3o/
5+[ yt %`a]X K`2D go6 {˝vL@vV!<`.lTBY,0JɛOi g vx<2ou[b<^7x@CAt* f1M*-Jv?/R}
S[ɏ n)g:m[4cNbl ͩUaqj.I*;]IY,EN@@,lEf V-,N8>u|rq#ѡ-et6xR_> >Y%BCOJ&DLۡ9S.iô> M
>ܘ)Ro(3! *iADw:)ڌ3 g8,0~!E|;]<.8wI^Iq"Fx7$q]|7[JB9.x\{k" 7 !{KkЖi\df2^^g E
H Qcnjl8 6..:uSTYTg^y
-}W#o}^m?VbbX+H
=XM4^_Js.%9~69PM#A{E#qƍqI{$#sdOT1.,_VQϯt]nÝ({SԳevĒ=W?%r9|M0 /@| Gc: __!yd%w~v ;=
\"B E8e4-/^`ߪ:p ۛz+gS-0oO:Y}.ZTQʉyo:x*,5Շ;\T/lj?Cp)B/3 f%j/q&͒!
qC1*1EMI wb4yTMdk '{36y9tOL4&+Ĩ8aoH{d ђlsc1-I1{t=pJ TV@CzB 49 H 6Hdv6Ut-Kۅ2 95l` OהOǖІ3~ķ.slP YӬՑ!''X*@} ѱ&
c<& Kf X^%
dS=W
cXVHrs8k4P_I V`A$>OWgd5Cx? "}..wI
%
b#9Ud`K@ i݂U1lM^b/a
g
z]8 95u vz; |c+!d:}K9YgsC+Y*?%ooڠ[]"e{|<p=0uc1Dy63Qj*]~U?jK<}] D7N\_p =T}K܅q[wָy_߂%},J2 7h dNm!-{5
Yq{%`jL"Lop,SfܰwuzgLsOՉ"Fڀ Hkqج}ӗ腡s$
_9= /mŚ;vCy1T)gr9Dn>XԿ۷Φ ͼSp/=MmdǔKc} :j3xe oLFۦLG }V.8DzkPw7Oju{xlN g>]0馯]Y` *j#8IE^ fGk|sچtvwӻ`adY'3dG5I]@[
ܸ^rrM ?c'$݉@h$,uz/m^"`gCwZnU=AmVݼU+ [L+fמѴ=HC-]
b*]xfՋ]$ ٹXQ*%V6LE{ћ }}19̲EawvSV15~ ]3 #{>?KO3C^# Fd6( ] ҮᚍZ
ӍR~R
WvjQЖ'ڜ_!!+gaEQE_m$ &Lջ H$.D VrLźU4巛1a}drG%g,f Xǔm!6!(TR -pa~TzuWq[k 9ugz +Թ:bBs JfsFn.r|V;_P!K( \f˽/O+a5a+ 2cd xl$U6Bg`ғ
5'q4 E fCx8#; y.~xH~n/
}ʕzjZ李3pԳ|_2Q{rSRͤ|M~ER & /ٻq
Ji>a[| _kG9$l#
]EMw a,jDVa7 'nN琧o|3L>cy8hX A]TL>
M4h/ y0 -xEV ^ MdwyAn=w-VM(mtjm@SY 7W
6y
qKM\<8nCW0ۊ8H
u{W2'ͧ ¼_IX!J}6nWYK'uX)E9RA jྑ{TQN͌_|G#ې^Y5prΑS4̝?u}-;79@U5VLs[IJI &)A2WE u=m;@vM5̔[*qrfBOU0# \c6+_D`帹e+4u;6
vC
m0a 68qf_Nq
L%c▶3$2F \?tyŗ\X3Y,.
ϬrUKÁF^lD*u7EԓWTӭ hZbP̙jI}]cn&(=nNROP"; Q`CdrzLV(y!;}[..'HƮL m[`$Dߍ L)s2]= %,|3`Y1^yR]l܆;T75ZBʙ<;jC>P h l;\7iCZH3=yU W:]ۻow Q,_7<_NLixJqO-/4{v /`ɿ
lV"fDs尃YJ x&AB ڲ茞3+ nsU) T
<êu+bMQz *eF
XXȘ$4Ȩ34ݧ8I60mGl l+E~AlgW +:UuXdݖ2lS nw}^)'> Թz,8b$ ;3* ixx:v뵄/bp_DHc|nV>k8P j
:G+gXp{Zҏ"T2O 9 {gݽ/|sl:)|POeU"{߆Q-p2!薙Hm#c ҹa4rG[sn:hƩs(Fj TdGVNDVy>&}~HVqD:|ˡBdڜ1-߉.+=?jAAZuM}r5x2Y Io3ㆧwum*6~O Vj% dO*EBqtQ [1TT^<$lj ^wu1Wk,> =lOk|+HD@.U$T 3@,hPX+G"TD Mt+$I1}W1Kq3CzA&M:cHŎp仛[͉ \I](f8!'b$cp`P8yoT hkqI՛%tE8gop}ޠ Fj 6sels aD
(*IDtj腵 ζDwsCTCx$jg:.0hAt##y fgΆ|{;곕3{7s~zo;|.هҼSD6T|hмb2#MH,%
&l;ꛥZ5 #9w9-oqz\*rTɃv-[ѽ .o*'`rǚ`%q nT@e;}r;3ǪͷhcVj< |Ȁ#{:!pTYnM6"W7xHăPEm\u
mѪ@>U*m'-Yq i nS0,C<YOsHW+'MgPr {՜*7Qo W +S4찏8]K9
?#y"8np7O *甬U31ts^o[h<2 y c8o%WOXTITQx' bx j
F['W7KJ \t}؏&*! tD["wq;RoŰx 2h5,
|a~OV_ѯ `]Gebb r_
&gz)ZotI QSB/2 k=_}pϴjeO 8 _@ Bh
ރv}tF0ڜJ|8%A7=ZHat oo䖇cEZߠ IyLi ֮1^rj;ĉ لExdog3YnI )Y
k#PGDwIҷxW)ч[hDmd̤3BzbH{ qf~ù^uW>ĵ'5v_[Z?0%7kzSb5PzgW2-5 d0]"Wg{A2u bwWප'㗘/Y$ӌ.]c;͑'"RWv L
Ub4? l3yP{'TJ:ȨW\' -l|$U
'j^7+b'ri_
o {4xSN&3qHnIͬpaEͰ5:߆챥U^m |UħSh+v~{'&a'7ݑD O$8? '}ǩV-bmcY qZ&rDT#,TE}ٯgQ.JKdʭLXBWǮŖ t sUXIEQ 91I
C .mJ0W,@U ~bI VUgR(2pFkPľ Z8)@E&\a.AZdL[`yG~.HnMQs`|JCĮ&Z12_h7[< pȄ ky-PCݗ0_.X Qb5_ 4I>qr HӦԚE9\ 'AqI2q#6;b9ipU KZQ[6-#ֵIWWz6 tXaCi%إ^kբ[@F"" 05)(vDe@c߂.w lB UB{ƿgp]Qƿi'ly
3:Vʩ:ʱ$8d-݆Vs " L;<ӣ꾦 Fyżer̉lnu(5Ъ0<) Ӓ$s i@pӁVU'}%ϡmdCz2ҊJw#in{ F V k 2 R2q)a%VV{Ƈ{)?J<ȩf DQbvݘjI:A0Rq#|KB[ κJ w%[ϜxaSU"^L>'̅(gr{DYӝu ߊ6xΫ8 7eT6?{ O1L mAӧKU0IظVb e6UbCԑZz{u 0LDa;IDۂkiS y{6PP\@×?iA0,vIA"> s;vi ڇ V5yB
Fv
m`N&<@/ޯ3^!4V). O 2t-|mاH5`n2r)2R+6ՌCᮇणT xٻnC\
A
Jk` A%&;tS'ȗάZVcc})C9^JNx\*F&Rf?䥑%= ':`&9SV°H XN'Z4o&jwUAJdl3'dArn9`v1
YP9 ,C;lyUQG\#4[:Y,&>nYv3C*?7C{;D# vc Ha֜z5 y5 ƺ"-EުRX\l-
#]oj¸;i8`/ĞmF j~Mӌ< د 'lBP +BD;1vw7ש"c)s&J1G[ G6 H弇f;J; zǀ lGzu%?^. yPjRLڄ bg ཾa~ 6BW!-% rswcxk@O1_&7Re*sc+g`
N'" +A#yI70*Ep ,.XiݠkseZFyU13g0TZR|OD?ͫ]rFAf q2y0#qFPCD_w&OiLsgS}:(L=QʣX_}-b^v |z
e?g+H*K(F` $ ΄_ 'v~ L-#o >G_Ftn5U~_n)e$ - ɲ fh!Py4{;r!kgr,A#f-s>8SG:YCr -KoRXMm ك)y dHg9AF 阦cS\/r=r] 'ӻ CW5wp+kYto2&pwQD=67NKd#I
b_1 & &>on}&)v迊fWa{PC,iN"Nt,oA2[+LR .y N );5 a6v!,~_\4)(={, J~$,LkK($ɈۍZߺ2KKcS kk z `yd= abPjOhI. kVQBg'iT> BS܂Lj_V`aiOyG}BY{!skJCZMM9oW>s@@x
g|wϓIpq`;:u SaVqѤ<[4V %b3H{ijBg# /ClS#Ka&pB^I $k_C"6в QPpaKxp/.@I 8\1rD6DtuGs@Tö6*|fƘXzf+ώ_Lf;(f:&e#f3OZ,'$;9ݨLyL)_>mw$K
AŷU~Pz5@CħA/1AG'btn%J&u*l],F\M
úX03J2n %7N`?KlSs}
8
hN}rb>@l%w ur1pen^Q)9!)=N$\i 1Ne!" 'C stF-?Ǧ8I
LU?銸-f~Л7O,Rq + ?L ւGW L=/8N[t{VU;t1`
n$jkl?L((&dg8lvMQ#VrN~p {O)pдq Gm.ֶk7z%̋߷WVKm) huSڡM/
}4Ev-Å'b1|Mi\n nmEJ2ټL&aʧK=R>T30 R F/:pKnfW'ytȴz@z%
ךb5f{%RΡ1}'_X5 NѸ~"3x%0\'j?_Fk3D IJk Ezx@+k˽(vUC\ 0uAyʨmƿeg5&"ZVc!+ice P.k >!Li8/D|SUXJaہ_n}ݒ
._<:SĊ3Ml^C3ÁhWrn,
<]i"~6
`ys]h3|eQ!vFA7sML`n*)KpUg=/pdl"as~/٫i( _K?CR> R5>gkIIC?'簎-e#ᨈiR:bʴFj0otKN }
TjO-]"bSaPet)[Z(y.l;."J5}^[#y
+oh^2݅Ks#Fcw)i}74FATG{_ @ꦏ rG,D\QV,^[e
14u8'#7E:50'dsCZlZ`E}Zh'+=xcOdeA?
jB=PTjD fJz_*8]Ɔfثv ;ǝzp558HŴ+
ת{a CSDQ=$i#ΙUK ̤su2No@r^FLF$8ʘtW~ݥϐ` T2/[l8tp#}P\3?l6i?ǵE@SAijltA*F( iȋ?;_f?Ob,Q J
#U_+&[!_$ 8n2Eelm4a 9y8z|)mOTFぎ xJ`=ǙZ;k g&'e JgTP|]%;jI$Uj ݵxM4#X]D*?&a?sR@l kM2WΉnWher Y[tFJ.*w]4yYRqG A.}+f=k
,~oe[^͵dz NO|B-Mփ,TQ%bnI>$M?61Pr#5pv=`kT.s x
}4=A7"(iոȜ5oĽk%3@U (6GpT-)նkC tQe+U 5> " G(n*$9>=%(1Di')U L.Qmdu%%ÆWwQ2P^}[TǺid?O9,C%J!Bo>k?R1%Ec|Ӓ W(F']
0s d{< cePGj gySr w_kzz.6'VP-eħa
Lߞp>
렲>g&;_f55cNtq5;Ds:K;5F=v4Cq>ȋ(!Y &B0kqo
vG¢*%2 E> V]Tv hvr.Iٞz
v^"P`$F88 k)vgߣ(sz_-;}*(/[Wk K4q !+@l: BpLd W j; y9%-7@=5L v8.Vʯ.X;y =O&*)dᢎPDEDzLX^5Zn<ïx
i M@ Gt,}tIίI4DDWb7nȝ}QI7 Bp,߾ k@lX+o
c !Jz < 7,F}rsr @_bd2NT}'!&У9-l-)%oCa\ϰ8ob7s'ū˛Vz f$0 +{#y0#LG>}UbZv L ^ғ{0rv)Ry}@V!皆Unm~όsD8g5rUZދEc'F|b |L;l(A֛_?:&`e'V|idbwɒT臙iX&CP>} e=̘ƞd!` +yܼ}CIAK;1/O/? 6Ka ~+0lt ,j
Ցx#O7 Fdk7LudT+d$S_@D~ 9eۇdN2s
PfY:5l=EYT.I3ED|ym*/S6
kI;f`&igRo1$V tN00}TP!Oj Vxf9 ΑYgs!&ڷZ;31Z1(w7;t]FKj? esxc V|.PmS}s`ZPzj:4nIsy*ʜx{3 G5Wn+d<`t1 郌M6A)7' n ,?~-<]/Pu !r ؿCuL ި=Am{;vnfHE^:= `Kh7^~4(A8ړQx Ӂn=q8اUrɻ7{^MI3l\Ќg w^ # )6h |mCl,~A>+p 9nPWN!48@ d}u|9A0 )j㎩~*yN^Yj &isg-9e!C2\tiNITЪ?19mq(HI80((ҿ96 _\e+shh}!C%m Lz`/ I 厭5"ft %[VV#%-P69-p9CPh;)'+
#q~M%6|X[;
҉?UYlo41+Zրq*4r6[J?wD}qq?hgP<Շ,Ϗ*_w#4̳KHВ ,A~~d绠>0 y^sOݎYZp.G.
? ye)~*{ ŲFke !b5*.
DY
n9"f5EDF]]ɸ={ktQ-=7"o|AqDAU'+u(/t˨Iɣ Xv҉k9 +=&â6 Ҭ|O0bxAF +Қ !<6+Xuo,jI:t'Fw10U{.K/AF@004Yjvl:ݗ AJzu7RH iڈB%.O=SUKl`lkyL|Ȅ!5
K_3[3zj; $an_b k yE>qJTڄRY8zCANJÞ$.T Zڳ̊9wԯjJ &Mj?$ mBcQ J,uJxF'tr Yl}h3 s|O)B \fٞF~ ma zҹTW2S],:}Z¢ ݴ( }K\*V^}\@c nVj9/"hY/q-|1sU4Lbx B x > Q'ܙgw ^T>^
= *w?d~0uVD6FvhV"Мa c0ACqM"D?XȭXu3 Α; [hc,nb0B 2bՈԗ
wЫkdo) eּW6cm]hӌW)3ܔN^ =[lU3m#Zzfu(~s ]M9u* 8-\KΫ~#*nFVwͶ Dn-}I).M]? N#zG)V"P7?K8/\/
̺)NpƹdbRxh[}J
szӜO!'">MUEvrԑ&2A
/mJKl礄'kEdK
dL i?,Q'#ɓ tkiW Nu(fm3iY
<Ԍ'L_h\N8
'
KE\/MjJԈuc
)Hn]Np+ك?O:\'$@zs
\,<Τ 7@4X
5tϭ57K8a Fku
H1s;`No<`3J+Ձ'/lqK& N*%@bՒg_;"#oi H-L{ @A$0CB ;E +[",{=Wݐ/g TQqA.dunPSM^b>5F^!@?&Z',* d
-cjrψznIIӽ.U~ $y߶eU ' s(R}yDRŕLa ԙw29sb\<7Lv L"Uy O iESR%@!HlD˶\ľ"L5@Y?TQV4f`{Lp$ҒVзnaٙnR]b.bKs[@X) g/φIm!*Y[E;[J !oz r-ُ\H6ꠙ~Q Lj'v
iK=E q ۚ(>)p|=<з%&,g DDW}> M4ō(Z )o⨄l#mo$Sr
)/7s$%)EFU"P7b̷5$ʿlzIT MԹa6 ]
N o5k7TQhbWnhIp&ih@K~.[7}I·;zQO~
5,2 RNU%Ƙ̦1Nu
=NJxW5S@@YɠoҬxoZ bIύ MN7ܤw.wV:_EsU)?>g͈Ԕ;6Lp _QDU.`CZ!ߋ֧AU?X}n.*'23),/- gD읤w?;is/6D+x]/m[E?
Ei|ϪC3.48T.ɸ#Ved-) b;8+y|Rs#s UPCe<&5$O,pon-LQTcCpUw*dԯN ehCq/wa @^AOd>p=0Apv Nc~:
s
CFt6rIvB Ed+p^
CG :$ftw-f7 ŚtQ ]M ca~*!7I+H2<8uH84,G+iRmI䗅[\xle^& k LFsAG?,xTh0` }ͪQ" 94KTui.s*-5(m WҶs\=PwYB'}([/I! cT> yn5 {Ɉ?chGQ'y8QkEt|G'%=w}IWy}%X %}C+`ܱnq »_1TL1)ܙEUnJv,IU(|"]QP4sӋ:H6sxbԴ U[#V\KCJ]#&˲_8=Qܟh@EW+v̰e?
+*R@\"=}aR(-yPu OZ\~%xe@=b b"CFqr>CxgJ@iyQG4 ϰM#oř=+|; IgLNe :}l[0v~Ws}6NgUIK(nƌU\ 㕅