apparmor-docs-3.0.4-150500.11.9.1 < > , '< e%p9|f$EnwȺ@!= U!U(nT+,p)ql &Q/w+fMzl40VصEu<MƔ\Sw'Xˉ`J:g+H5I$ ?ElRcm"Yֳ #> QTYKp MfQgbx *v CiSd {|@dޫ ߢ =ynmצD|۸HI > ; ? d $ C 5 I h n x
G
T @ P ` ( 8 9 : ` F G H I X Y \ ] @ ^ b U c d e f l u v z S d h n C apparmor-docs 3.0.4 150500.11.9.1 AppArmor Documentation package This package contains documentation for AppArmor.
This package is part of a suite of tools that used to be named
SubDomain. e%h03-ch2c عSUSE Linux Enterprise 15 SUSE LLC GPL-2.0-or-later https://www.suse.com/ Documentation/Other https://launchpad.net/apparmor linux noarch e % M E. V A큤A큤 eee"b`b`b`%b`eb`b`b` c30036de8e525c68d8474622f3f6984164dc60e91670039898e5b9066ae562d6 30a0adfab04b7755e093632fab7b8ab2adea32fc2eb640ec9586faa0cd2ebbd4 bfadc5ec4cbe5c894595c52b95c516d8daa27a76a6cc356b77065592ed8a0299 d383e3f1c2fd71198fe319a325fbb9a2068dd73b2609e27db150d3aeddd9ed06 474d65c9a3464d4a98ff295211ad0f248987237746fb4491779d0d2887ebf76c 5e33ae4afd85d4e8a3a0f579068ca74e1686ba4651958a25e6792c6e1226f58d bb7e15ffdd6bd82b037c217dfac7d3cd0f310aadba0776760d1d3b73f6bb778c 6060fdf95aa753427faf0a9b7f2aca6de48d1e7e909009845d8a526d25e358a5 84c8cdc92165201b233cf1607b5c1096de663abb9ed9afc9d3e92da2db5b35c6 root root root root root root root root root root root root root root root root root root root root root root apparmor-3.0.4-150500.11.9.1.src.rpm apparmor-docs
rpmlib(CompressedFileNames) rpmlib(FileDigests) rpmlib(PayloadFilesHavePrefix) rpmlib(PayloadIsXz) 3.0.4-1 4.6.0-1 4.0-1 5.2-1 4.14.3 ev@d@d@c@cbk@bi0@bZbV@bT@bRbBb<]@b@a7aZ@ap@a abaim@aEaaua
$@`#@`
@````_ @`% @`!'`>`
@__ǁ_ǁ_Q_h__@_~@_[f_P_-B@_@^m@^@^<@^j$@^,-]҇]o](]K@]]@\\@\ \\v{\I\
include in apache extra profile optional to avoid problems with empty
profile directory (boo#1178527) - prepare usrmerge (boo#1029961)
* use %_pamdir - update to AppArmor 3.0.1
- minor additions to profiles and abstractions
- some bugfixes in libapparmor, apparmor_parser and the aa-* utils
- see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.1
for the detailed upstream changelog
- removed upstream(ed) patches:
- changes-since-3.0.0.diff
- extra-profiles-fix-Pux.diff
- utils-fix-hotkey-conflict.diff - Use apache provided variables for the module_directry:
+ Use %apache_libexecdir
+ Add apache-rpm-macros BuildRequires - add utils-fix-hotkey-conflict.diff to fix a hotkey conflict in
de, id and sv translations (and fix the test) (MR 675)
- add extra-profiles-fix-Pux.diff to fix an inactive profile -
prevents a crash in aa-logprof and aa-genprof when creating a new
profile (MR 676) - update to AppArmor 3.0.0
- introduce feature abi declaration in profiles to enable use of
new rule types (for openSUSE: dbus and unix rules)
- support xattr attachment conditionals
- experimental support for kill and unconfined profile modes
- rewritten aa-status (in C), including support for new profile modes
- rewritten aa-notify (in python), finally dropping the perl
requirement at runtime
- new tool aa-features-abi for extracting feature abis from the kernel
- update profiles to have profile names and to use 3.0 feature abi
- introduce @{etc_ro} and @{etc_rw} profile variables
- new profile for php-fpm
- several updates to profiles and abstractions (including boo#1166007)
- fully support 'include if exists' in the aa-* tools
- rewrite handling of alias, include, link and variable rules in
the aa-* tools
- rewrite and simplify log handling in the aa-logprof and aa-genprof
- see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0
for the detailed upstream changelog
- patches:
- add changes-since-3.0.0.diff with upstream fixes since the 3.0.0
release up to 3e18c0785abc03ee42a022a67a27a085516a7921
- drop upstreamed usr-etc-abstractions-base-nameservice.diff
- drop 2.13-only libapparmor-so-number.diff
- refresh apparmor-enable-profile-cache.diff - partially upstreamed
- update apparmor-samba-include-permissions-for-shares.diff and
apparmor-lessopen-profile.patch - switch to "include if exists"
- apparmor-lessopen-profile.patch: add abi rule to lessopen profile
- refresh apparmor-lessopen-nfs-workaround.diff
- move away very loose apache profile that doesn't even match the
apache2 binary path in openSUSE to avoid confusion (boo#872984)
- move rewritten aa-status from utils to parser subpackage
- add aa-features-abi to parser subpackage
- replace perl and libnotify-tools requires with requiring
python3-notify2 and python3-psutil (needed by the rewritten
aa-notify)
- drop ancient cleanup for /etc/init.d/subdomain from parser %pre
- drop (never enabled) conditionals to build with python2 and to
build the python-apparmor subpackage (upstream dropped python2
support)
- drop setting PYTHON and PYTHON_VERSIONS env variable, no longer needed
- set PYFLAKES path for utils check
- add precompiled_cache build conditional to allow faster local
builds without using kvm
- remove duplicated BuildRequires: swig - update to AppArmor 2.13.5
- add missing permissions to several profiles and abstractions
- bugfixes in parser and tools
- fix two potential build failures in libapparmor
- see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
for the detailed upstream changelog
- remove upstream(ed) patches
- changes-since-2.13.4.diff
- abstractions-X-xauth-mr582.diff
- sevdb-caps-mr589.diff
- libvirt-leaseshelper.patch
- cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658) - add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
cap_checkpoint_restore.diff) - %service_del_postun_without_restart only works for Tumbleweed,
keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x - Make use of %service_del_postun_without_restart
And stop using DISABLE_RESTART_ON_UPDATE as this interface is
obsolete. - libvirt-leaseshelper.patch: add /usr/libexec as a path to the
libvirt leaseshelper script (jsc#SLE-14253) - sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
to severity.db (lp#1890547) - add abstractions-X-xauth-mr582.diff to allow reading the xauth file
from its new sddm location (boo#1174290, boo#1174293) - add changes-since-2.13.4.diff with upstream changes and fixes
since 2.13.4 up to 5f61bd4c:
- add several abstractions related to xdg-open:
dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
kde-open5, xdg-open
- introduce @{run} variable
- update dnsmasq and winbindd profile
- update mdns, mesa and nameservice abstraction
- some bugfixes in the aa-* tools, including a remote bugfix in the
YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
- make-4.3-capabilities.diff
- make-4.3-capabilities-vim.diff
- make-4.3-fix-utils-network-test.diff
- make-4.3-network.diff
- abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff - Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
(bsc#1168306) - fix build with make 4.3 by backporting some commits from upstream
master (boo#1167953):
- make-4.3-capabilities.diff
- make-4.3-capabilities-vim.diff
- make-4.3-network.diff
- make-4.3-fix-utils-network-test.diff - update to AppArmor 2.13.4
- several abstraction updates (including boo#1153162)
- disallow writing to fontconfig cache in abstractions/fonts
- some bugfixes in the aa-* tools
- fix log parsing for logs with an embedded newline
- see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
for the detailed upstream changelog
- drop upstreamed patches:
- abstractions-ssl-certbot-paths.diff
- apparmor-krb5-conf-d.diff
- libapparmor-python3.8.diff
- usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff - add usr-etc-abstractions-base-nameservice.diff to adjust
abstractions/base and nameservice for /usr/etc/ (boo#1161756) - Properly pull in full python3 interpreter - add libapparmor-python3.8.diff to fix building the libapparmor python
bindings (deb#943657) - add usr-etc-abstractions-authentification.diff to allow reading
/usr/etc/pam.d/* and some other authentification-related files (boo#1153162) - add abstractions-ssl-certbot-paths.diff - add certbot paths to
abstractions/ssl_certs and abstractions/ssl_keys - add apparmor-krb5-conf-d.diff for kerberos client - update to 2.13.3
- profile updates for dnsmasq, dovecot, identd, syslog-ng
- new "lsb_release" profile (only used when using "Px -> lsb_release")
- fix buggy syntax in tunables/share
- several abstraction updates
- parser: fix "Px -> foo-bar" (the "-" was rejected before)
- several bugfixes in aa-genprof and aa-logprof
- some fixes in cache handling
- see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.3
for the detailed upstream changelog
- drop upstream(ed) patches:
- apparmor-nameservice-resolv-conf-link.patch
- profile_filename_cornercase.diff
- dnsmasq-libvirtd.diff
- dnsmasq-revert-alternation.diff
- usrmerge-fixes.diff
- libapparmor-swig-4.diff
- re-number remaining patches - add upstream libapparmor-swig-4.diff: fix libapparmor tests with swig
4.0 (boo#1135751) - Disable LTO (boo#1133091). - update lessopen.sh profile for usrMerge (bash and tar) (boo#1132350) - add usrmerge-fixes.diff: fix test failures when /bin/sh is handled by
update-alternatives (boo#1127877) - add dnsmasq-revert-alternation.diff: revert path alternation in
dnsmasq profile and re-add peer=/usr/sbin/libvirtd rules to avoid
breaking libvirtd (boo#1127073) - add dnsmasq-libvirtd.diff: allow peer=libvirtd in the dnsmasq profile
to match the newly added libvirtd profile name (boo#1118952#c3) - Use %license instead of %doc [bsc#1082318] - add apparmor-lessopen-nfs-workaround.diff: allow network access in
lessopen.sh for reading files on NFS (workaround for boo#1119937 /
lp#1784499) - add profile_filename_cornercase.diff: drop check that lets aa-logprof
error out in a corner-case (log event for a non-existing profile while
a profile file with the default filename for that non-existing profile
exists) (boo#1120472) - netconfig: write resolv.conf to /run with link to /etc (fate#325872,
boo#1097370) [patch apparmor-nameservice-resolv-conf-link.patch] - update to AppArmor 2.13.2
- add profile names to most profiles
- update dnsmasq profile (pid file and logfile path) (boo#1111342)
- add vulkan abstraction
- add letsencrypt certificate path to abstractions/ssl_*
- ignore *.orig and *.rej files when loading profiles
- fix aa-complain etc. to handle named profiles
- several bugfixes and small profile improvements
- see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.2
for the detailed upstream changelog
- remove upstreamed fix-syntax-error-in-rc.apparmor.functions.patch - update to 2.13.1
- add qt5 and qt5-compose-cache-write abstractions
- add @{uid} and @{uids} kernel var placeholders
- several profile and abstraction updates
- ignore "abi" rules in parser and tools (instead of erroring out)
- utils: fix overwriting of child profile flags if they differ from
the main profile
- several bugfixes (including boo#1100779)
- see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.1
for the detailed upstream changelog
- remove upstream(ed) patches:
- aa-teardown-path.diff
- fix-apparmor-systemd-perms.diff
- logprof-skip-cache-d.diff
- fix-samba-profiles.patch
- make-pyflakes-happy.diff
- dnsmasq-Add-permission-to-open-log-files.patch
- refresh apparmor-samba-include-permissions-for-shares.diff
- add fix-syntax-error-in-rc.apparmor.functions.patch - update rpmlintrc:
- whitelist .features file which is part of the pre-compiled cache
- comment out filters for the disabled tomcat_apparmor subpackage - Backport dnsmasq fix:
025c7dc6 - dnsmasq-Add-permission-to-open-log-files.patch
(boo#1111342) - add make-pyflakes-happy.diff to fix an unused variable (SR 629206) - add fix-samba-profiles.patch - smbd loads new shared libraries.
Allow winbindd to access new kerberos credential cache location
(boo#1092099) - exclude the /etc/apparmor.d/cache.d/ directory from aa-logprof parsing
(logprof-skip-cache-d.diff) - add fix-apparmor-systemd-perms.diff - fix permissions of
/lib/apparmor/apparmor.systemd (boo#1090545) - create and package precompiled cache (/usr/share/apparmor/cache,
read-only) (boo#1069906, boo#1074429)
- change (writeable) cache directory to /var/cache/apparmor/ - with the
new btrfs layout, the only reason for using /var/lib/apparmor/cache/
(which was "it's part of the / subvolume") is gone, and /var/cache
makes more sense for the cache
- adjust parser.conf (via apparmor-enable-profile-cache.diff) to use both
cache locations
- clear cache also in %post of abstractions package - update to AppArmor 2.13
- add support for multiple cache directories and cache overlays
(boo#1069906, boo#1074429)
- add support for conditional includes in policy
- remove group restrictions from aa-notify (boo#1058787)
- aa-complain etc.: set flags for profiles represented by a glob
- aa-status: split profile from exec name
- several profile and abstraction updates
- see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13
for the detailed upstream changelog
- drop upstreamed patches and files:
- aa-teardown
- apparmor.service
- apparmor.systemd
- 32-bit-no-uid.diff
- disable-cache-on-ro-fs.diff
- dovecot-stats.diff
- parser-write-cache-warn-only.diff
- set-flags-for-profiles-represented-by-glob.patch
- fix-regression-in-set-flags.patch
- drop spec code that handled installing aa-teardown, apparmor.service
and apparmor.systemd (now part of upstream Makefile)
- simplify "make -C profiles parser-check" call (upstream Makefile bug
that required to call "cd" was fixed)
- add aa-teardown-path.diff - install aa-teardown in /usr/sbin/
- move 'exec' symlink to parser package (belongs to aa-exec) - Set flags for profiles represented by glob (bsc#1086154)
set-flags-for-profiles-represented-by-glob.patch
fix-regression-in-set-flags.patch - add dovecot-stats.diff:
- add dovecot/stats profile and allow dovecot to run it (boo#1088161)
- allow dovecot/auth to write /run/dovecot/old-stats-user (part of boo#1087753)
- update 32-bit-no-uid.diff with upstream fix - Change of path of rpm in lessopen.sh (boo#1082956) - add disable-cache-on-ro-fs.diff - disable write cache if filesystem is
read-only and don't bail out (bsc#1069906, bsc#1074429) - add parser-write-cache-warn-only.diff to make cache write failures a
warning instead of an error (boo#1069906, boo#1074429)
- reduce dependeny on libnotify-tools (used by aa-notify -p) to "Suggests"
to avoid pulling in several Gnome packages on servers (boo#1067477) - update to AppArmor 2.12
- add support for 'owner' rules in aa-logprof and aa-genprof
- add support for includes with absolute path in aa-logprof etc. (lp#1733700)
- update aa-decode to also decode PROCTITLE (lp#1736841)
- several profile and abstraction updates, including boo#1069470
- preserve errno across aa_*_unref() functions
- see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.12
for the detailed upstream changelog
- drop upstreamed patches:
- read_inactive_profile-exactly-once.patch
- utils-fix-sorted-save_profiles-regression.diff
- lessopen profile: change all 'rix' rules to 'mrix'
- add 32-bit-no-uid.diff to fix handling of log events without ouid on
32 bit systems
- no longer package static libapparmor.a - update to AppArmor 2.11.95 aka 2.12 beta1
- add JSON interface to aa-logprof and aa-genprof (used by YaST)
- drop old YaST interface code
- update audio, base and nameservice abstractions
- allow @{pid} to match 7-digit pids
- see http://wiki.apparmor.net/index.php/ReleaseNotes_2_11_95
for the detailed upstream changelog
- drop upstreamed patches
- apparmor-yast-cleanup.patch
- apparmor-json-support.patch
- nameservice-libtirpc.diff
- drop obsolete perl modules (YaST no longer needs them)
- drop patches that were only needed by the obsolete perl modules:
- apparmor-utils-string-split
- apparmor-abstractions-no-multiline.diff
- drop profiles-sockets-temporary-fix.patch - obsoleted by a fix in
apparmor_parser
- refresh utils-fix-sorted-save_profiles-regression.diff
- add aa-teardown (new script to unload all profiles)
- make ExecStop in apparmor.service a no-op (workaround for a systemd
restriction, see boo#996520 and boo#853019 for details)
- lessopen profile: allow capability dac_read_search and dac_override,
allow groff to execute several helpers (boo#1065388) - read_inactive_profile-exactly-once.patch (bsc#1069346)
Perform reading of inactive profiles exactly once. - update to AppArmor 2.11.1
- add permissions to several profiles and abstractions (including
lp#1650827 and boo#1057900)
- several fixes in the aa-* tools (including lp#1689667, lp#1628286,
lp#1661766 and boo#1062667)
- fix downgrading/converting of 'unix' rules (will be supported in
kernel 4.15) to 'network unix' rules in apparmor_parser (boo#1061195)
- see http://wiki.apparmor.net/index.php/ReleaseNotes_2_11_1 for
upstream changelog
- remove upstream(ed) patches
- upstream-changes-r3616..3628.diff
- upstream-changes-r3629..3648.diff
- parser-tests-dbus-duplicated-conditionals.diff
- apparmor-fix-podsyntax.patch
- sshd-profile-drop-local-include-r3615.diff
- refresh apparmor-yast-cleanup.patch
- add utils-fix-sorted-save_profiles-regression.diff to fix a regression
in displaying the "changed profiles" list in aa-logprof - add nameservice-libtirpc.diff to fix NIS/YP logins (boo#1062244) - profiles-sockets-temporary-fix.patch to cater to nameservices with the
new sockets mediation, until unix rules are upstreamed (boo#1061195) - add apparmor-fix-podsyntax.patch from mailing list to fix
compilation with perl 5.26 - do not require exact X.Y version of "python3"
- require also matching python(abi) which is arguably more important - don't rely on implementation details for reload in %post - add JSON support. Required for FATE#323380.
(apparmor-yast-cleanup.patch, apparmor-json-support.patch) - add upstream-changes-r3629..3648.diff:
- preserve unknown profiles when reloading apparmor.service
(CVE-2017-6507, lp#1668892, boo#1029696)
- add aa-remove-unknown utility to unload unknown profiles (lp#1668892)
- update nvidia abstraction for newer nvidia drivers
- don't enforce ordering of dbus rule attributes in utils (lp#1628286)
- add --parser, --base and --Include option to aa-easyprof to allow
non-standard paths (useful for tests) (lp#1521031)
- move initialization code in apparmor.aa to init_aa(). This allows to
run all utils tests even if /etc/apparmor.d/ or /sbin/apparmor_parser
don't exist.
- several improvements in the utils tests
- drop upstreamed python3-drop-re-locale.patch
- no longer delete/skip some of the utils tests (to allow this, add
parser-tests-dbus-duplicated-conditionals.diff)
- add var.mount dependeny to apparmor.service (boo#1016259#c34) - Cleanup spec file:
- don't use insserv if we afterwards call systemd, this can
have bad side effects
- remove dead code
- remove now obsolete 'distro' checks
- Replace init.d script with new wrapper working with systemd - add python3-drop-re-locale.patch: remove deprecated re.LOCALE
flag in Python UI as it was dropped from Python 3.6 (lp#1661766) - Fix RPM groups - add upstream-changes-r3616..3628.diff:
- update abstractions/base, abstractions/apache2-common and dovecot profiles
- merge ask_the_questions() of aa-logprof and aa-mergeprof
- pass LDFLAGS when building parser, libapparmor perl bindings and pam_apparmor
- adjust deleting the cache in profiles %post to the new cache location
- silence errors when deleting the cache (boo#976914) - split libapparmor into separate spec to get rid of build loop
involving mariadb, systemd, apparmor, libapr and mariadb again
(see the discussion in SR 448871 for details)
- libapparmor.spec is based on the AppArmor 2.11 apparmor.spec, but
with minimum BuildRequires - update to AppArmor 2.11.0
- apparmor_parser now supports parallel compiles and loads
- add full support for dbus, ptrace and signal rules and events to the
utils
- full rewrite of the file rule handling in the utils
- lots of improvements and fixes
- see http://wiki.apparmor.net/index.php/ReleaseNotes_2_11 for the
detailed changelog
- patches:
- add sshd-profile-drop-local-include-r3615.diff to fix 'make check'
- drop aa-unconfined-fix-netstat-call-2.10r3380.diff, no longer needed
- refresh apparmor-abstractions-no-multiline.diff
- refresh apparmor-samba-include-permissions-for-shares.diff
- spec changes:
- aa-unconfined switched to using ss (from iproute2), adjust Recommends:
- move libapparmor to /usr/lib*/
- drop %if %suse_version checks for 12.x
- change several Obsoletes from %version to < 2.9. Those package names
weren't used since years, and 2.9 is still a careful choice
- include apparmor.service independent of %suse_version
- techdoc.pdf is now shipped in upstream tarball to reduce BuildRequires
- drop latex2html, texlive-* and w3m BuildRequires
- techdoc.txt and techdoc.html not included, drop them from the package
- run most of utils/ make check (some tests expect /etc/apparmor.d/ and
/sbin/apparmor_parser to exist, skip them)
- BuildRequires python3-pyflakes (utils tests) and dejagnu (libapparmor tests)
- drop sed'ing python3 into aa-* shebang (upstreamed)
- build binutils
- aa-exec is now written in C and lives in /usr/bin/, move it to the
apparmor_parser package and create a compability symlink in /usr/sbin/
- aa-exec manpage moved to section 1
- aa-enabled is a small new tool to find out if AppArmor is enabled
- package new aa_stack_profile(2) manpage - change /etc/apparmor.d/cache symlink to /var/lib/apparmor/cache/.
This is part of the root partition (at least with default partitioning)
and should be available earlier than /var/cache/apparmor/
(boo#1015249, boo#980081, bsc#1016259)
- add dependency on var-lib.mount to apparmor.service as safety net - update to AppArmor 2.10.2 maintenance release
- lots of bugfixes and profile updates (including boo#1000201,
boo#1009964, boo#1014463)
- see http://wiki.apparmor.net/index.php/ReleaseNotes_2_10_2 for details
- add aa-unconfined-fix-netstat-call-2.10r3380.diff to fix a regression
in aa-unconfined
- drop upstream(ed) patches:
- changes-since-2.10.1--r3326..3346.diff
- changes-since-2.10.1--r3347..3353.diff
- libapparmor-fix-import-path.diff (upstream fix is slightly different)
- nscd-var-lib.diff
- refresh apparmor-abstractions-no-multiline.diff - add nscd-var-lib.diff to allow /var/lib/nscd/ in the nscd profile and
abstractions/nameservice (path changed in latest nscd in Tumbleweed) - add changes-since-2.10.1--r3347..3353.diff with upstream changes and
fixes in the 2.10 branch, including
- allow writing *.qf files (for disk-based buffering) in syslog-ng profile
- add several permissions to the dovecot profiles (deb#835826)
- add a missing path in the traceroute profile - add changes-since-2.10.1--r3326..3346.diff with upstream changes and
fixes since the 2.10.1 release, including
- allow dac_override in winbindd profile (boo#990006#c5)
- allow mr for /usr/lib*/ldb/*.so in samba abstractions (needed since
Samba 4.4.x, boo#990006)
- abstractions/nameservice: also support ConnMan-managed resolv.conf
- let aa-genprof ask about profiles in extra dir (again)
- fix aa-logprof "add hat" endless loop (lp#1538306)
- honor 'chown' file events in logparser.py
- ignore log file events with a request mask of 'send' or 'receive'
because they are actually network events (lp#1577051, lp#1582374)
- accept hostname with dots when parsing logs (lp#1453300 comments #1 and #2)
- fix python LibAppArmor import failures with swig > 3.0.8 (boo#987607)
(libapparmor-fix-import-path.diff)
- refresh apparmor-abstractions-no-multiline.diff
- drop upstreamed profiles-ping-inet6-r3449.diff
- add %check section - runs libapparmor (including swig bindings),
parser and profiles tests
- add BuildRequires: perl(Locale::gettext) - needed for parser tests - add profiles-ping-inet6-r3449.diff - latest ping also does IPv6 (boo#980596) - update to AppArmor 2.10.1 (2.10 branch r3326):
- fix incorrect output of child profile names (apparmor_parser -N) which
caused 'rcapparmor reload' to remove child profiles and hats (lp#1551950)
- fix a crash in aa-logprof / logparser.py for change_hat log events
(lp#1523297) and log events that look like file events, but aren't
(lp#1540562, lp#1525119, lp#1466812)
- write unix rules when saving a profile (lp#1522938, boo#954104#c3)
- several fixes for variable handling in aa-logprof
- map c (create) log events to w instead of a
- add python to the "no Px rule" list in logprof.conf
- let aa-logprof check for duplicate profiles
- let aa-status work without the apparmor.fail python module (boo#971917,
lp#1480492)
- add permissions in several profiles (including boo#948584, boo#948753,
boo#954959, boo#954958, boo#971790, boo#964971, boo#921098, boo#923201 and
boo#921098#c15).
- and many more fixes, see the full changelog at
http://wiki.apparmor.net/index.php/ReleaseNotes_2_10_1
- drop upstream(ed) patches:
- fix-initscript-aa_log_end_msg.diff
- syslog-ng-profile-boo948584.diff
- upstream-profile-updates-r3205-3241.diff
- refresh patches:
- apparmor-abstractions-no-multiline.diff
- apparmor-samba-include-permissions-for-shares.diff
- drop libapparmor autogen.sh call (broke the build) and remove libtool BR - add syslog-ng-profile-boo948584.diff - add several permissions needed
by latest syslog-ng (boo#948584, boo#948753)
- add upstream-profile-updates-r3205-3241.diff with several profile updates:
- add /usr/share/locale-bundle/** to abstractions/base
- allow dnsmask to use /bin/sh (boo#940749) and /bin/dash
- allow dovecot imap to read /run/dovecot/mounts
- allow avahi-daemon to write to /run/systemd/notify
- allow ntpd to read $PATH directory listings (boo#945592, boo#948752)
- update dhclient profile
- allow skype to read @{PROC}/@{pid}/net/dev (boo#939568)
- and some other small updates
- drop upstreamed apparmor-winbindd-r3213.diff (included in the
upstream-profile-updates patch) - netstat moved to net-tools-deprecated in Tumbleweed (boo#944904) - add apparmor-winbindd-r3213.diff - add missing k permissions for
/etc/samba/smbd.tmp/msg/* in winbindd profile (boo#921098 #c15..19) - add fix-initscript-aa_log_end_msg.diff - fixes ugly initscript
output (boo#862170) - update to AppArmor 2.10 (trunk r3205)
- profile names can now contain variables
- improved profile compile time in apparmor_parser
- lots of improvements, refactoring and bugfixes in the aa-* tools
- new apis for managing and loading profile caches into the kernel in
libapparmor
- lots of profile updates
- see http://wiki.apparmor.net/index.php/ReleaseNotes_2_10 for the
complete changelog with more details
- add new apparmor_private.h and the aa_query_label(2), aa_features(3),
aa_kernel_interface(3), aa_policy_cache(3), aa_splitcon(3) manpages
to libapparmor-devel
- drop apparmor-2.5.1-edirectory-profile patch - it's most probably
no longer needed (see boo#621394 for details)
- drop upstreamed samba-4.2-profiles.diff
- refresh apparmor-samba-include-permissions-for-shares.diff - systemd-rpm-macros and %systemd_requires were at the wrong place,
move them to the parser package (boo#931792) - update to AppArmor 2.9.2 (2.9 branch r2911)
- lots of bugfixes in the parser and the aa-* tools (including
boo#918787)
- update dovecot and dnsmasq profiles and several abstractions
(including boo#911001)
- see http://wiki.apparmor.net/index.php/ReleaseNotes_2_9_2 for the
full changelog
- remove upstream(ed) patches apparmor-changes-since-2.9.1.diff and
apparmor-fix-stl-ostream.diff
- replace GPG key with new AppArmor GPG signing key, see
https://launchpad.net/apparmor/+announcement/13404 - make sure %service_del_postun doesn't call systemctl try-restart
(boo#853019, bare systemd edition)
- add samba-4.2-profiles.diff: update samba (winbindd and nmb)
profiles for samba 4.2 (boo#921098, boo#923201) - only install apparmor.service for openSUSE > 13.2 - Add a native systemd unit which *at the moment* only
wraps/masks the early boot script. - add apparmor-fix-stl-ostream.diff which fixes odd uses of
std::ostream which are not valid. Fixes build with GCC 5 - allow lessopen.sh to run /usr/bin/unzip-plain (boo#906858) - add Requires: python3 to python3-apparmor package - readline isn't
part of python3-base (boo#917577) - add apparmor-changes-since-2.9.1.diff with upstream fixes since the
2.9.1 release
- update logparser.py to support changed syslog format (lp#1399027)
- update usr.sbin.dovecot and usr.lib.dovecot.imap{, -login} profiles
(lp#1296667)
- update the mysqld profile
- fix network rule description in apparmor.d(5) manpage
- drop upstreamed dnsmasq-profile-fixes.patch
- update expired GPG key - update to AppArmor 2.9.1 (2.9 branch r2831)
- fix log parsing for 3.16 kernels and syslog-style logs (boo#905368)
- several fixes and performance improvements in the aa-* utils
- profile updates for dnsmasq (boo#907870), nscd (boo#904620#c14 and
bnc#908856), useradd, sendmail, man and passwd
- see http://wiki.apparmor.net/index.php/ReleaseNotes_2_9_1
for full release notes
- refresh dnsmasq-profile-fixes.patch - Fix dnsmasq profile to allow executing bash to run the --dhcp-script
argument. Also fixed /usr/lib -> /usr/{lib,lib64} to get libvirt
leasehealper script to run even on x86_64.
dnsmasq-profile-fixes.patch. boo#911001 - rename lessopen.sh profile file to usr.bin.lessopen.sh to match the
script filename - add apparmor-lessopen-profile.patch: /usr/bin/lessopen.sh needs
confinement. bnc#906858 - delete cache in apparmor-profiles %post (workaround for
bnc#904620#c8 / lp#1392042) - No longer perform gpg validation; osc source_validator does it
implicit:
+ Drop gpg-offline BuildRequires.
+ No longer execute gpg_verify. - fix bashism in post script - update to AppArmor 2.9.0 (r2759)
- change aa-mergeprof to the final commandline syntax
- lots of bugfixes in the aa-* tools (bnc#900163, lp#1328707 and several
bugs without a formal bugreport)
- small additions to gnome, freedesktop.org, ubuntu-browsers.d/java
and user-mail abstractions
- fix mod_apparmor to not break basic auth
- update perl modules to support signal, unix and ptrace rules (bnc#900013)
- don't warn about rules not supported by the kernel
- fix logging of "audit capability" (lp#1378091)
- add support for the "hat" keyword in apparmor.vim
- build html version of apparmor.vim manpage again (lp#1366572)
- see also http://wiki.apparmor.net/index.php/ReleaseNotes_2_9_0
- update apparmor-abstractions-no-multiline.diff
- remove upstreamed apparmor-profiles-ntpd-pid-location.diff h03-ch2c 1696247589
3.0.4-150500.11.9.1 apparmor apparmor.vim apparmor-docs aa-teardown.8.html apparmor.7.html apparmor.css apparmor.d.5.html apparmor.vim.5.html apparmor_parser.8.html apparmor_xattrs.7.html techdoc.pdf /usr/share/ /usr/share/apparmor/ /usr/share/doc/packages/ /usr/share/doc/packages/apparmor-docs/ -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -g obs://build.suse.de/SUSE:Maintenance:30900/SUSE_SLE-15-SP5_Update/bf7fc34cc3d034d75e6790157f5ae668-apparmor.SUSE_SLE-15-SP5_Update drpm xz 5 x86_64-suse-linux directory ASCII text, with very long lines XML 1.0 document, ASCII text XML 1.0 document, ASCII text, with very long lines ASCII text ! TN^C LA; utf-8 50983d00599eb5ae5dd72ac58428a2f176e0117e3b5ee95fde776ff1595a3402 ? P 7zXZ
! t/`] "k%{=CQZuǡjע|v=X&I} Uٞ\obCBA 8 [3e]9`lN"*Tn}8T6- &C~9
0* &% 3O8R2'BpNJҠgyй6B܋UٹoY@ CF~s*(_ʭVgT>4Kɥ^~Ak; -c z1 Fpljk+>ǒO}Q%8t.>BGbNҊ;r,{+Zt #H ~ 766yo᪼a< r~\e3ib4]VfW bK/EyaF 2 1
D#gGAc,&gbH?)UhѬz5̣1c16|9,FZЄ`Vd(4& [$A R7
,haiH oѪzY<8Ɣk]ϋpPMTʏB5Mh䅸M V*SdV±"hB w_g1Ȕj in
jmYSchk%tu^pֶҎOmUCC!!ג#Lߺ}OԤhiTµN끉7`
L]b c'#
+z[ᒟ0eWK yRS#p$cZg[ V.oC6ҌlmfY8V&
(E&X[ղ텟@⤴mq%G q CI5 N2c Y⅐xJ>M6=L͙?7*qd&fn7Ç Y aAAGim3sjn9`
cdF_ŠI id*ZXIe;ch3ӉX&\'ȑ5-P4/ )-#!S&Ͽc/|uUzMq
h[;ȷ6[OQyΖY<|k!ydc {P+Q 7PU<m6|&exH5 5
s$ ojυ+Ɂ
}jI%n vyhCD~s=-Syn3n_{ [e+ƜپMxbsw"|-`;( ( H} CA5-ƕ(Zi.kR xL^!hD/ZB&= 6BkU0k&vd%++]zE|rvNQn;KԩAt JaxPG9c`7Zؔ&r)3J~LS l*/LMwD*78 @ JP53)F yx w67e
hBX1D,`&M5JqH5bfј:D!Os)5!q{ ҃~cNSsVWKa2S:$Q7P"gQ< ? =_b~pR BbAr|BC=b =reyINl>E,`n ':a#xЬӷg
`4ZiE@/,c[D yF/G._GF3SYxKsom2fq7--<vEm[c0p
/?s $EaЩD7l5k"MNXTYfC/H >囲 V
! ΛJJG66Y+H븊%l >D M
һ?D~#'p"\p2K5OC-Րkȉ:;2ݧB(^bۥaUh)c) Y
-ERK
$XE*).pwس=?\XHk _r +ͺ"bVπ%%RD}e_ )hXI.'Tw]U,ҟhc il`]ԏ}Do!ؓ$87):6(b3f[3TB }H\$T!VRb 57;۾&7nřETMi%dk:[y =aSN"bl"/4s-qi`, Y缠BsB W9n@n|[9l#3yEqF^cr aӽ[غEN@ǣ#oy&{}jtͰ|;{2ki+ىDN0MS?2!o*c"SM1 sD'l_vA_8Ꭰ-(I
@\>_k)dBԩ/kr,
@XljwOcmN ަHEFNj ,^. |c04t>ŢwEbcMuMjDP +Vp:EV ̝Hr] τe
YLFk`ʸz dd]T|Y8vɼrLcʖ=H3 x)Sv J) Z3@ߧ6 A1LJCLEl}uZ$SV"I3}
o"ƍհd+*f\#|s:m1F>V7z~1v=^j XȪ#7R1u'u;h=I㉗1fvbZM h(JZvAg :%{ia|ڎ0f0sp
GSNBKHBAv`㔸}ot\~#Pz4sq&W=~U0!}! ܢڳRMmolS582*0L]le3)g,^8һN+
'=j@6($C
ukD;ʯhfPsZ%{ XV|=.jy(E *ҭQ Yj>dбtN# G9
]o|f8Jo+}pvI ػf2KٗWmHLQUI%H@95gSS-4hr n,y B2'֯s2z 6Z-o$~W'afJB"ޡX ywHUD_;ˠ`6+1dfQm Xn ֟SJeE]"+'nw V^?H5^L*V>!sgjsNP%X I?|ɻ//
1RPNx++Ei'QȠ@*K ᐓ
wN{rDgP*crU pXssm y}]P l*
M-:߷} cIZ- ,+gu Xk7Z_)] r 1M *$sI ̏$G{R)1Zr B} }B~I0#&EcV?K W2r8sIj "ʹ, _D0aIoî^r.1HϩCGf ş
W%;!X-R)7 H}¼ñ0Hy3zS2}N zd"~E JU
davԦrsan0G\5ㆶ]Ǝ v95?^0rnh@ĹgfG pW+=~,/nJ\mzt{'-V߄W:!mbYN7. Pו$}r0T Y :'z|#!.>C:"Y$Bo$ XhjJd!ׄr y6/˝vZAoe# ƥyL7M$i˶o8i/%+*N}GbNaB
lƤ%$Tw)w9`%0>rχ13+
[(Ҋ@u^cԕ{Y.'LR|ށXx=>=Q~jۉh) ƠCɑH"Ԑ+KoiXO/) Ȍ%ʚ R\p+.j#
#d"x[. -n+4ⷷ?l O
@~ G!DKzQDGDβ~Ht> ӗ-;=2w@\S6(8qS?s0VSdәtjŒ*oB~8-Nm~! )碁hjIFUxNAսnʙ3 L\Ϯ,1PE}õ /`rK/u@$Ѷ
+: `@z #
C 9ؚv1zL<_M$hAJy W$L ȋ2&{_ hnb& M7eAQEѢV୦>4JUP
UP;{cU 76'yɵR\2evp ,3C(AHx>V]:ӧМ) 8Ϩ}:lW{*a\s.}X¼Ҿgxg ZGFhktKkJ=Qpwı5d_vCKxS'Q9fVx}0F?x nϙa#<}*q@_ctk.PW̞e/(>9zq-4}VmD"a-)>I*?0G/ Bw`74(35I0% { Kad5o}.ۢi Hޤy6IxUXOA
RU}|vI2'8q* @ R$"`˅[+diᓫٙ 3f@{ Ju[2wf¼Fyjh Xgr yEu"M;U0zV2]kSg?ӕ,mP6Y24n~K\n?O/gu/ 1٠d "_u㷅#
-ajT /^a0,l8`TPsOXeψ)SuЩzMb]ya*55gV&_{)Gi^C Ch:%ENE2?#ͼB$l.LTo#Bٽ+_^?oX<]hxb\S>N?梌+/~${5ݒRv
tH^kJ ZoTk۪7<[s%mCH,
3'ُ9_ w^~e"w|t(SqD\rBDҏNw2*w2 R۷ȨmMLf8^6B/į~$ xxmZq$ C+ @Ol@oJ>
統kh{I{M $9ùdSa
c9(V=9BiҰnvW<:.+A&⟈*X9| s>pf%"2WS1 >Aq'#1So fj"y62b1C > BA1D4x*6îS jHq8e~6'_?F3;v `͇I4JU #a-Z:_F{֮(6}v6'9%7:+ؕTo]nZ '%
f
Sy3RMÎL#
s(gC gY
ls. \Pi,,:^Ku2(1
X^xKjkA:oC4/Pm|خE!7`|֠zn<@'+(Mt{Y%= z16Pt1#/%Ỹ!ZSҰ/r:E{*KV iNZ
%Y"na$c8 >P(*4S೦ ~(88sʅg)r{>\Ez(-fƧHO^ ڨ9FZKhTY}>kn6^ڨ0^F;~tI*
) W^:YsZtZJKT~SS
fa sZb
n Z!܌0p8z"yp{y `6Kx)fqq&O}TZg=Pғ}$ ӮyacӥaNQ<4rRܥDn!k43sR ]: wH EYM˴]1 +x؎dq:s'UYMde6lQq&~d;6VOPt4~~T,V tu G[
xLON35(SL$2:i4s]\uKcF6b;^'yK:6lfLz2ZcmNl 4G5#e9"Eq{э/J04JD?5(?Ʈc*5N|>!sAa s^w[,]@OD1Ail=ԇST2Zh@?-;~HKS(0hMDYY÷Xhl̶{ϼRkKqde x)U~Hx\/zɭf܊ZpynpX/Cj^I )oDT겮KםD 6-4!b襋Y .Ufܪ 9:l [#M%%ȝt?Na݃?jM_um%sXj Ii(eRH:%h&p9҉CҺ 1
YQݱM&
[IQ3ڿ;ECWS' rX 7^0ͥ'#/DQ3 / "|e
AWP>ب^E^)͉Fq[oZ 9f)ҫ;(qp?R_u"&<<u- ]ބY6O}1?z8TҮ@^l]y_A;[crKANm p$ ( {V ӎV|\R"Rl_`ܽBmuoM7x8@ YTs,5
P =%)Z K r#W-4UbT C4_d!vA{-U6uk ~kNg*n4?#n0wL5&v*~P`-U}
̕ $|UbHer$ nњ/kčwT3uҒqbbQ.f9~֍Ox9$cݾv'@ ~*Y(N',%NgW)&xGwb~ѕ } h=jW& :^Dl00a#T}<\D{4wS
r '245A /Li& |(q ^B/.Yyk9IC;VYMU&XEld B)~+.c9+a*L禅Bk
ᙒfyA6'3R^ 7Jb; 75 ^1B'X;a~ x!67snJ)B<@?ЂǷKq<=ia YYxa hA*OƵ^ROh\.`ƵcɂH bE a`Z$TLL@ujeTXP B$8if HoI_l*3qo,vl0SIB&XWA)CZvW ?P%k:tT&m*hHFsVp'4)?.c0/7+}@H ińT3`r+%*pVL\4Cˠ *i ."iSY #j6/>}Flt1hځ5["PxicP8:%#ӛEf W P!G J>VL4"9"V>\7_ KNs$7 zTU ;Z\paˊ~gp.nм/e)-ֶ )grF}80ʸW¹z9&3%
iMJݓ4 ~,$J`N0 sᅓɜ ^4MtS ^Y3yDd) WdGm?FHY^'>Fzs^I}K1k D ofMM_tmNwD(=WN A>9@{7T2k7yR6nYL#(&>y DRkA ?8P0u~S0)fb6J-j숙Hq%]h^
HigY;d~Orxf@,xt#NRp?V N:nHy (Էg& Oݹ ¡*D'郿舲ߑ4?. 4 iB#)ji~QŀVA1|cK@ru&4$V.f j8J9 $/1B'm[aq7ׂ N4 s bLrW/
l .:hB$5TWg!1k>Z \zRh^iNmK7Lԣ6So'< aY}&T=T.x:Sȍ_+^w^
+癏ؤbUYpsz8 << |A0U*1D@ss={߁v;@ fx`ࢽ pe)Tݩ_`Xo9&o??yJWVCBز2e8uSOl@\ U|;T:2)2%Z6&;#0h%TBwq.C&÷~)v$p |1L
biCxKH. AH-f_*8zrAUjih-!+~^^pm5?+,q)Fg?̨8
%p ھDDgBӭ=QF5AGcUl"v<Ů+ ;z@fhP&`x-Xwdfz6egu DE}ZMJy}n ޒWM S);CU7n!5Y^MSF?d8D2~ @/fbn\-͍a@>uA,M#J0^u2:_"<6>NQ <j$C t;҈tQn&0;,b, 0Gru~֫> ٳj 1H )=hXM|%C͝Qc=|\ycU3:mnR88Ew ^OZjثgF}sWTc}Zy
/\ZJ0H! =wug՛T ^m5]FW7k`>;*(\KBTDU?r[;'\'C O~v~ҤU# -#8IX1,Υh SU!\2 nHBET- p1v!Ⱥc*oq-Z%rG=M.O.Gp&4UHmF䱺^w@gBρX5M"J/ p`ZP{L=!#]glD-I0fM߱-M a mUm| rc6|kD
gYMGhF6Əz]mޠZT%0i "
{8ݯi+$ΚZ%w VzrJ&o1Hois פ6ݧ#ǯ
n+Z1uX> <[ؼ=[ jfE:_Ɉ VΫ蛓RT h U{=u
ostngm$QU* W2W&A; Iod>
Y r 1+zi ?8'&sW957Ti{qL97&TΚXlϷ S3-:0Cao$D& :kHO [*P :8el
Rx}@qkT»k=zlę"Dͥqy| ]J5 tEg ES]j~*co\f>nq7~yTR&S=*m\nfOweHtU~ b
fYUIDxme@9]xW;<ͅ(nܙГٚ"R\sˊG ?rd0Py4GOX837- qV%rg=hơQ anY)=ZyMu mmHMa}ʼˎ=-fv?qc H6[٠r >Y,]};| %*5
Ah6(/J1X u#
Hd]SkF:
f*XK}Pq:Ș"3iBji3Gڧm6NG5B οz0$UҬ礀+Ca[az~7w
$}B6 98#Ps{zDIR)cD24} óNl TB.+MZvR{6USxap ͼS -ȈC(ddΡ1gQOJtEj 5auT-"߲gIe}ޘڶA~FgP|Cf>q3H珢6s%9-S(E"̣b֎pꀲ K| _9." /bX=5KB,&[sT}\_%x,Ұs2挊not@ZT. :=mp CJq
Q(u}B[QE8CݖiBA:])tvnCTRͬe8 ]Qmp]W餘Y[YL=#@"u-1.l
U\QΩ:ohKDTq!p#Wbڒ1?tWD9dz֛ >Zt)Zɕ@5 tp4&0 EB V/&|XqqYOٕr
5ZYI~:'bC L? $( d|S=sޟQyRex}D V gZh\aCĂ0ھ/ Ǔķ@j(4>*x[[~Dq`#;n9ғsTػė͢ [sّЇie&3/;?WN3r(<,)FDJb/xBE 0MdA[n ' ޓ98GqsbZ.ݝo~]Dq,RY/]2w FX՞ Y?JÁ=|y:U]* zgs]65~}3Cm]x&n(,3rCz5qA(z,#蕛l)MQ.;8o5ܢ DY<8$A=eR/)1t *ȒH٤=,!Fn2 8
RX1,v m \ø~ O]rӮ### WgM+(g6qy SVH!_(i6Cv6 G=0e5ffWЙ"G]-4 lM˄`jiJa|+6d\KpM^ut!8]pj[ M|8uNj,OpCjb2ך\K§~1/HWAi_?ƴD3&vf`ڈLJ,$>0uYc&i3vqC1 R}oB鯲wXH
UłVc qT"oܦA4.;B`Iu9K̗B]qxU@Bp+E/ t~JaXON+ p-tV(>k-(:ge ~R/lB$m/RO+ H WmbA]mH7 /F*
-l @G9lrD1fY[1vt"8GD[?*v'SA\ $D3U\^~&8.ٽHWϽn(Gy ݥR8. =\`-bg^.[6[FYE:GZn:ZcT@VBH"P7jPޚ^٘#`?ҐKRզnDS_ވ+;u}@/s2I2cOYL+( @*v-l8"Q_ н OQIDys=y ]}N+
M 4Ք!9X9]dU-iM.ՂI`̪^ʌBQIm{)oźU0/Lh7[Y\6bݠFxI: Dqtan5tO˾
} P~[rq@oF$V&;|9g)/>|=prx#
L_žb"+ۀן1tq ؋CwԊbBr0LP mVD[6~XfE_%~IKkNnO b T "1
PŕI rMz_; j@ H㓎 ے_E:HL a;:~Z <*{kOwŷy>SCɲVaOS
"r)]h8 9QQg+bB< 1DO' @ ǹMg; F9(Yx9 u4LgTIc)B |c
-iC:Y=M D _]ʧ/:kyw2uYMDc r%_)K y[t~ p`QPC6p]E^V殙˥?HݫX> QyELD)fkf|;}8:b9Ჵ ɱ]ԒC\Au
BTF $uj~h 2K[outZc? ˳P_ u{,tA@{>ecJX4b )2Y x2Ub!knLkJ ?IJ E|JABlF*#?a'B5"D MQbR*K \*R{ N$~+Ϥn游Ii/з=! fg\: /J
d!$ە6+I "@5[3|=^Pa8ݎpIm u%HN Ͳ[D\Jlh[ޘm=Y)> =g2 2TzR6Oy
ݖ&{eb8nҷCs*;6Flt
J_eOqtbg\f}^}|>pZ P4"µH,4=L^9Yp*(ܺ( AwwvE 0a Wԙ`*Ys{VUGyc`3ZB'8 - Vc}Ubр N
yܠ` J}S.*5%3-S{KM5G-KneUC$YY #"ww
5)M1Tan誛 o1Xufaw#C
H'MϞV
uȠ A6=T2}=?+: 67fmHR`GQcv9hg=W*{j4BSSR1 ʕ)2E.tXTO.EKa}ß!͔ճtzp`Hyb#n`Q,?.@?jM$]y8z:Nҥe K"LˁYU! ]sÀ-[n6lXΞ*^U\& sZFȉ%>)"h[ V"Ǣg</:d^ P#˳[`P3l.OUO/:t;D7"CQd˃ N.Nl GW\{>IP(zGnXR) tO+
6$`Ȅ$E<`9AE&MM{]VڮwL?ϥ0. + .ey߽/d2ev|̅RI: G\Xxh熤fYܤ^ I)sXE)$&wQI=c1;#V=,H8>Q@qӽ
vS&| ;6N?n0)oX3v{@!I ӓ@O5 Ox\
: q*D!|
ШeGc_3(̿7x~-
rx C0cd]SIJB mUb
u b]ҔŠKb+J ϕohe!D)*^;W:;烉_ C\G5(ӯ~OSo&|d/@ZL$=ҕ"wպl*!gx+F# @P%rM.IĬg)ހ}l
?贪Tn!(Ԟq9?H ' %O:GnPXYWȉٞJUn6izNfMge;=תus;CR |H$E0dCp 2
r%Xw I9^g&.Btm78؆2 8]G&
+ތ =؉и&V;]إ L<3C'fLKc]ћTD;-rQ Wb(n#}s ;f*2)'_/2쟆3sh. s'%t UL;+f!Ge|"o{oVQʸfKX.b zzdC ,W̒*BL **ژ.2OXn8V)?zz7D
KS''yթA)k B4x& ݠ<
{1anKiǶoޛ2yyGM~]fLGSL ?5 .{hZ]?civd !@pXR HtuHwKE gRᴨK'eAXx58iRmF+2NΏEH3q"Y561s. LZ0 Bsdl2OA8j{PE>#ʯm ُӆ1IY'C%R"("uX kUg ʼr3)gt3 mj??2ۀШdiz sKlhVbF{ _c)hhḑU]M~{[
˚NvPZZ8[AAi!94laݎ~^Elı^
e}7EqncGu^LA x~5JS)ZҖ as}\d2 mFno9eS t gVqdLCfe)FG|}5#c~_'C >~&LnyꏁO k8]/ zH=8& `V @dITQ
^)LF) =ϩBm_aRE{KCЦ
<0dK5so4d
K АoH5O톬c.m!:A뵻Թ0/V7\ iГ F{\JWY[u9Y֕c[8MiݣaqO `,!'m3E^l @eGD:: $]z,$D4#3l-'A~o4,PjwXW~h\#jM o;NW 2GH #˪C*ƉS? h[vpbSE`gapB (pp{
Ɋ3ZS.gnVeNFz-oҔh3ǖC
` bi_$_ +I/$%Xhu8h\ū#-0>d̩o }TY
Fx#1}p8~{Q&VhAsoL;)iy%'%+t}1Mno8/)_"sALpnnS͂ w4Q[|p.|`*iŪz]U
z59!dMr[gd9k:; G$<,Khxyur-Rs6LC*U> IBȍЅ qv $,?|o<$<-~VQ}P{e9a- uAwUܧjm,gt~|珣L5f~W 3&B)o1dLcG>&. >0E
#⇁jaR]7VQ6^GS8(R5 nXxn@T 3}+ѹQG|:5WWήMM[hr[\ ڭ.$"G"J^Yǟ2%L
ɸ.^ ] >϶/ ~(Ĝ
F3caPb)Sq\6@EדKGSOuU8u{w _Cffu =xc,Fdz|=-9 ,IQa*/bX9iǠO,OWMHC }C yğB?J68D
*MO-a]
$[pL3C ipluM>٧),p{ 0ѹ8W2[L4| 2{ė,ЖyS.?nb%e ptZ:0zB9
6~ ֟蘫A2+f &!e-YkՇDFla8j3%kqfD <|EE"~U]}NfRdB՝ӬH.R< v%T> 9 m.yu;oFMB}-U7;E[@ / 1JxO=]7,=0]! R̈Ϯ1 0H~ Yhn4-kSheZ Hғp*'AVK0uF{|Pzn=YMt|C*p ?;~blNx^B}vHH<قʹIt,p6q+@ApV>
#Hlq
X={ dujk4u_RU_y`Co~u?uPHH,vcgac')6l+y%'~0o
=W?+NM@fQIBD_AsaJ=3w%u#^o(1DgX0*:>&: O`
Q]
{3 {mz@xXuϭ^r>*
_ae9\l4(Я2k7L0_ה5+@p-?WvL ÂB`3d`T {|ݍ`8螺& ;<&osTRxrƗyFٟ
; BY]j!DL2LU]"yW&bB#k`|Rbҡ @ s|
]Aa@>iW3ɆYs#~+Iqzw\6^Wuеik|&w"W~DD%Hr_WRDtRZl,$^?B:ׇ.i4H
$ce_2Ps|@DΖ倝|_#78MR^Rmdy˯-c6f!:ղMf3G;|XYNP!=|Nx0 ܓ$`%iT\g$ 4+m@xs;itaZ:D8bP}` of$-
aYx i)Gas*\P;4Ѿx\o¥2_o]2x_NJ:;
2[UkZ 5:_p* 8pf0տAP <%֡2 hvY _Mt35JVe%.k;}'E'NIӒK|%z BFn^Kvfۜޡ,DwN
FbI9&q
Z %|Ow{VgޝZ1y >*\,
{|l</Y;Z
H1EϘ:ƤpNRkk TӘ^ś2#{vVw
p}CX^z aOmDZ+G1g)]V&g\{\+F
`m"35Z ;w_9H2i&nNufp\Qj~^ "
͈oL[*%d&!pNvکРEÞRc!U>zņ\_* YUC%4oj J !;$-x+|/v* S5K,i<
Aċ䀓XsDҁz?nTތ2ASf,G]p4;*{
;OK _h2Q$ơ%"x!g@̼+ <^ai>2"؍4
ĨԇлTJ
q/̑RIU3{q1Rm=-0 ifIWtm43hp Vݾ;䆺phxpF
"wb3=մ bF`hCd87
|$-KU[A<Cx7La $i(x8z :h@=:IӍ':[+ jd;K K MuaAbbO}kA)u)Nkk 6*ri tau!/lҕ)} ӔA레$;䄕#&M;A,ρ\R `Y9)047Z++0u*i0YaV "ښQƔP!
k~?#h``_`1Pɔ<` J8|%iwwvuLot~+2h2 ./
T3F m lw~rWL6 W{s2} ]~xа?jk۹Ygia'x' `VjP\zv.X^֝#1Q2"_Q{Z-B諎_pӁBFlf۽ҡ!Pyc8+4P%Ȁ"g\dD1եkW`FVlR)F) F ׁNfrMX}
hف*ry'Jd; VQ}jRs(~"
,^n+3BjW
#3r`7[P4y?8&k:A i-Oo!8oMM+'-fhu^y#è3Aa#;\K6l;cw;w㔪
l:-S=$<1{2ç5$>1tE#8}lZ0w[WҹyA-'߷ ^y_Ov Ȁ"%
ߍRAMv,r}#qfNH *1=#TB^!ɟ8~;^Iaz+~ވ+\55VRmVd^A͊ Ir]pl+'ri7z1^ƞhV` R~o =h.X ;*oLѤ5=VA}su5 !hh
'NEBƟ) SIjvAKv7& zޫǩ=jHq\m.eA
BBeUaSQ@HoAf7V'5SX' o#wNg\YGdW^~ QSV j9[_ lҽ $M̶7 #Cp';h*T`BvVѭ%7xE=N?C)ȩQ8g Y!s1 )(L7
=okմA[]u u>J9& Bno7XE%QiRp3P
o*%Rs_3>aJO"Vh>h ^2aP N{YIBCt &XQrM GW@([T Lvώݴ ;9-$~/!L&dϳ7!^s|aBN L=H>-i=0`A`}M k0
aRM /r,jogf)c[Ԕ B-!\]`;Ɠ" nfhEan57kDZ :I9i WUf?w%](H# z R|r<8$c>*?=^ڷk Yn{2R\czu \JE|3Ho{L%d A%u):>2#BF#]1 ˡ;MA55@~ ytJ7U
dd
L%rJw,Դ{l>Sy(XM
˭bd |$AqbY4'@@P5* 3 Blg
x> ?-_ƥ|T9jtć ޣSo
羻
;2p%~Db] yKN=gG!^Lps:*
?KdT :
~jځfLHd)6VL*pzPA(S
4L $
iKEdEB܄͎NUf,7J`|t RhvO.#.
loɷ b J
YZ