From 92df4e1a2c2350b71958ea2ff7d15f905ba99cbd Mon Sep 17 00:00:00 2001 From: xucee Date: Mon, 25 Nov 2024 20:52:54 +0800 Subject: [PATCH] Add User Documentation of Interpreter application integrity protection and Kernel Root of Trust Framework --- .../figures/AT_CHECK_Process.png | Bin 0 -> 76809 bytes ...50\346\210\267\346\226\207\346\241\243.md" | 90 ++++++ ...50\346\210\267\346\226\207\346\241\243.md" | 302 ++++++++++++++++++ docs/zh/menu/index.md | 2 + 4 files changed, 394 insertions(+) create mode 100644 docs/zh/docs/Administration/figures/AT_CHECK_Process.png create mode 100644 "docs/zh/docs/Administration/\345\206\205\346\240\270\345\217\257\344\277\241\346\240\271\346\241\206\346\236\266\347\224\250\346\210\267\346\226\207\346\241\243.md" create mode 100644 "docs/zh/docs/Administration/\350\247\243\351\207\212\345\231\250\347\261\273\345\272\224\347\224\250\347\250\213\345\272\217\345\256\214\346\225\264\346\200\247\344\277\235\346\212\244\347\224\250\346\210\267\346\226\207\346\241\243.md" diff --git a/docs/zh/docs/Administration/figures/AT_CHECK_Process.png b/docs/zh/docs/Administration/figures/AT_CHECK_Process.png new file mode 100644 index 0000000000000000000000000000000000000000..f32d5af3a31c740febf1a4783a1dd0daafacb0df GIT binary patch literal 76809 zcmeEuby$>Z`|VJIpn!y^q$nbwfG8jhf*`HL&>$i?G}4VyDj|q;7=XkKIn2<564DJa zq;z-ZdB*+4{(f7(bN)F0oO5li3z&T8eV@4Rb+5JV34N#{cb4=LDFgyJEB`=74FVy; zKp^-eB&Wb5@_EWg2;_{IrL^=zd1+~uhmLk;me!^a$b--rEn;o;#`7t9QIV1s{trLB z7$JOP_~}IlE6D?5`pc&&6+-;ep2*SB>X&O{f)FpSqt8qBz5K32=xIdx=wV-7fPs57 ze%T_|XyQtu$jQ-6i*H+!i0d*Vq({X`=7Y5cqaTBD)m`DMesAL5wyq zb^=$7uGZz_-@J8(ay(rviMxSTEs3*%*i@jP^F~M_-b1w?_O)}6&m~eRk1)!?m$Hv2 zMM&N8FGH-(gm^nSI=WM4N?M<_k)c%F5>xZ-kUvQ@o6o-%94-EO%IOVlx};Rf^~Bo? zCrS+`+(H9Umzm$?XFm;*{+R9*fLw~J~lXB;@`W4p8eJ^&O`>_`VUr2xY;NHaK z_Gdi72qLFbseF=*?nxNlkh3i0=gs6^aP9Wok>aI)g1*-gAK>M3qqdBaXKIG1?z(l! zE2odNRUKt_ZoSGH<8iFzt5!3LxT@oz6nMOFMqKZGMAmt;+G~ zb#57xCOQOO%ni9rUvO3TQngTRrp|16Y}zUFuh8s1^pUmx zEGnUWJNC*e<~AbO1X;X;wD4g??dto|)m?w7^->ctFJt}J_hz17mtfHqKc5*=_>pEC z%^@Ko)0B8`F-nW_BS4A<>=ox@V93mw=M&L^hzN{J;X`!!ndFus)6f2@=jOs@VuacJhvMN*x2thScW3s;Iy1fDae z1bqo#d?4E>{M5H_>)V^`l5E6R&My6vIA-_Utgm}!XLnw2w(nm)5d9t$R$Tk;NpJz# z_lt{EE(|%uXBKJt{E&~?Ke@R%i@kv(F57h$x)r8{k1-zyrR3g;b`S3juM9Vu^xiv+ z?-IL|?|8qcHemC$*C}eBbGv6sA{TfQeoW3z;`?nLu#Q%ZbeN8wec`hwqBVKekHXpB zes$NC`^+*tSoKT)$%t#)KHt#C_t?6#`k`pawjW(&c*|5)tIFL3vY0d4U-$0f367mT zl%l*q!76p*0lvEN=0*GDS2bsNiEj|rrP1W#FVvXjpIs#MtiiJ<>3KdecIGYx!cV}S zdMG$2lfD9SG{(65nuX-_d)7NL6t`q=P>R%^UX%2C!*Z1&R5mJ-<|^YkR;s7ug(MvJ z`&bg+Fg~DN=W;wF^j!ZQ_D%T%_O4eIvf}SAWCvKi5Bkg|d}>QF-r~ZgS1MB7opTnK z%PtuB+sbft9$7GYoT>~MkrC;jn}wX>HGLf(|9Cr&xc&=k!P6UOsZBQWsdCTc)LP}s z?k44#FlsYzpJN}tljJ}6m6qXU!w-EgVQ~thaJ%}Qac8&NK8!212WxhOoHc%rmR zQpra=m0Q1jKkDu$FST2i)Rq!+G;^1-5;vvfbsDuB(*GSBUeuieaXfI{!rV8r}t0kwmJxa|q zMEEEjmF)YSQZ~tz{UjS+?-=HNDfW)X9r=WJ2~r87t#t_^{OwjQoxBMb!|qRXo$qw% zZ0jsThUh|dt>H>=H8_DTT=xi@faS)nVQ(Xwk*XH19k)NW;nzX>a{esPBj4Ge_|Knau-P z%dmB(Iz~;t`Hs(?r#}0`rHX5;pC_NXd5R!NHt2E?>sRF<^Rox9XJwCN<7F3Kt6bW; z)cx8!jHrI$wdzF)bBo(?udVB4Wp95Rt;JmJk$F=1^;7R;QC5s)lI0sq_?-0Zm+`?m z2?N4K*NS|cOg2tWJGJDruINPG6urTBLqJ?KD!6;Xe;DS$C6Usw{-y<6tEY2!)j znc?m4jr7hW7`{C8{@eSJA5#}LZZ(=fBT9Lv6F=sdluU3p9GLJogfr{iDREeYvFouT z)Jwb1nrA!ZZ+Oj|n$hBR;r5D!bGzzWBB=Fa(E_DD&Q7k><-O>wvc&RCv=(}FyJJ0M zU3=M~GkWaen9%43dPa^%FwZMb+R)d1(9_&~Wn=lGIe)l>Z9kfuS)Dn&ojjG?D9G;R zipwau1hquCQTnKf?`_|d6WbGWC3>@KP7)iYekOi*$1E_O@91FM3(r{2U!c;a`hMxt zMH;$dq1i|Imi8X@&i1|`uy2cz-S1y?Uvdeksneo?!VyuAWkJyc%@%f{B_~W1g5P)nep1sp;OeUvJqh^)ZUka z&fmUiX4F#t-S2x$!OleP#8n67HLJDgiJb9KcEW49^0N;ZqVEc>DMa~1v1DD2f6I_s zA>#g6t>e>HbQycO3U`VZ>}BuUcy(^&-qZxKt=cPg|c3KIJK|w5~Q^Z=R*jCrl*D-z`r*%&2 zwAQfh63S!cQW$?AtgKH(TMrdpfOtAQxYgZf#OcH_SmIwORrub-WVb#@c{&klvtKA= zveCNkw~i%!{?e3o1+`kDKR92FG)w$Z(q)rcLRK<5aIWwpqN}jbn%%*?rY*C4+|^*W zZXz~&c)wiH)pz*HPPL2^PSi_Zml1CJE*Zit$+ZTBcg$F;^9^}x(iDz8*_lI113d+)&Kjt6Rs1QXZ=P$^_0u4`Vadqs3{ zbSeg$rEZ5&{plvLV%+^k4&`e7<5R zWn>p75Yc055Um=mTk=@Dy3!cCT&J3)+MIGxB4^%VUTB1VXmH!BYh#)216}ID%afkn zqVe>t<}1E?C%s*%-$#!W4y{(V*1_OyS2(*5-l61Qoi%7HZ(mUqpY{HJ&^a*?sCqgz z#XDs!aMN@`D={x@^h=f4g_es9G!C^419^~BTnX<^VHU(752GPzHNGTGSNHZ*p_F^^ znn4)fFYC8IBRe()7sj;I?v`_6VXy2JC{OGQm)v! zWuSN7@7#T#>BGy*Z*E3rm-)R}s)h&$dNc`fXZwMA;-#s!yqU5xgcIB*fe_+df)IgQ zc;HtYkN#h`W$~^<2!1|}4}k<*LJ0ry8Wr##_Y(5r)`2T!0 z5hjh`pSSTzz;h5Ob!mBd@L%1;(bUw|$-?fL5$&WMc;K}C105#_MA&X zzomxuGi_xhVG}zWZsVtRPfWSpZ0vEzfrz>ZgPS&{&x~2zY^-gagx$ngf4)K(+{Qi3 z!^-mWCC^}DtlG*CS)}b8O<4rEdAWI6#YtIMSVSG4nhC4P$o}K);GP((#j|Jj!aO{# zuCCm!x4G>c&3SGK2?_D=^6~KT-2|_=>Ev$v%-HRwt<#l14)V|A$e22rI9l32v$V5i z!5!E5iJkK^F;-UG2mR~kkMlHjv;6lb**g8>vcLuM;GW^R#m&p}uVaI^isBv>erV}t zYONzU#e1B{^_az`BqIQQ%7k#8}OOW z#Q!~C|9JDCpZv!gMR{e%W1N3J3IEL9+G+N!-KNkLzy)oVy=^Cv-}K29GFo-MxR$V4jzJdiZBlf#PvqV0?!(WwA;i3!t&G@iLLfSlkcW6nLH(+c+ zlc3zBzZpA8KSBu@9wTfv8RvJ3jjDE5O7P|8`pcp7_5f{x>`0?;Zb}E%o<~|2x$GW@-E# z>VFeVDF4p!|3ByW;9aJ;tvPGYxfsjKDR0y-Q}Xzq_Y_2VAMd^YB_yOI0+21z>__t4 z?c726%)n;?D$gaoh^|TS)wqnpjlFpM-dyaNA%;dkBj zY3F{T*FXR9uO*}O3%*lFICfdeF+m%EzXnI_g*$&e?MOG=5M{(cM6W(jp;iQUv{mSz z%l>tLQSnGZn7U}F{elS_EuR1&&(v&b((%^-B{>d&s&v8=a8wo{4&EMK0+NC!;bDF8q;VygI-#b0qO%Njt~ zmz8gUqedoOdk5|mBng}f`^Bgm;s%l9??L=~5P$BOzgObl+xgFd?Ek-*=%8~NV^_Ha z)hl=snCyGJce&A2BFy#J_-l~q3gwrNug>2rlw)$Q6?R>==C|s(zIKt0$I!aSyuCzh zXQ-PKnj5#{C2_p_QS9V!1DXT9DKZ{%WqmvBs}%m~-4-ennZIU>rW9OocVe1>c(o?* zZ?_7LK8^XTheBw6et6kA*Pz^`wc6CJEWj}=4n7UW=I0Z3u6+)R`lPn@Y50AS{&#WKiX6mSt{;cY`NX8v=w*9GRo2! z9k4CzJdbXu?7s$4z2!jg*K8*V@$bMTMpor}5W{MpBMqT&EhF#Vz|ug%F;dsTV#{dF zbu26oSzV!$sl*{PMk@2fsoVmcZ@#)Trrk=*#Uo*hC=X{q|9}GT-vvYru5^gWfFe& znfj4EJf@ixQ+>3pmnh*|<>|G%`lG~a&#`=W{ME2`Z@%sK{P$#-9WdA$9B&$!JX>r_ zr_OKS+sEj{3)&ghV6&Uy0`BXR0jVEj=5{bIafVXg&v2OW3PknXZ$?p#8lZtt zfkwRDUM(XVQtKlA7?nbWOs-44q zIzRaI5BFawNm#`idSvP0iCcf?b@kn76?EnQ@`@Crh0wS3KG=3{=a`pB^;!?*;ME#@ z8m&A;y73|9}C&$ntv(_GIX0KKMoP)}mQ}o{zc`Bc3W^2eZZYbnhn6#L+CZsd<-_B{M0W8BAmz6JRYCF^PG^H6cYeT5jL(+keK1rv zmd9vBLoMBLs;Mp^rTXM}kX(3{_^ap^ znu%Wx;yc_RZX~~e=;I-@swUbcPKr&N-@&^fhluiJ$0X#x|iD zhK271Ci4a3N(11^RusY+d=J;&U6eIXQRQz&dUl%X)zBogAHoek4PpP zwyWARQ-?qEHKA6jK85-#w{gL6TZ{&UOG8MATJ37sDnorz+`+Ot(S{n zS`wR_H%8eE3ang<%W4y{_1d4ybeYe})O~*H?Bemk3aWBvWN^!CrE+I+{1s0LouOMz zn6k+Y70BKLJvfrULnPOI^I2o z$!!d8VW7yofM7L{j1C*ho?@{v(~k07sqCi_UP1O7F7wm+<-FVOlw)4H2kWgvK;gP0 zYfnYc9$Qvg5qf#I%v$1#&vG0cnYSfbR(fo478;@h9O2ha_80Qt(!u1m=@k-?m9F$x z;M`qZred_pCXV|%Z17i=&Mp6<3?X5mtisK7hWuF!yHea^Y@C|%7DAI+pTC$wXfpEc z5QrWY$->T@PzZu$FSn@8(SLO=Gu5`zbH`<7i+IdKl1*MCK_*>BL+#Vur8be3XI%Z7 z6kgvVFYBl})X{38VWK}?P%j3Maeu?gQFu%YI5yv0sv%}B{z@Ss3O|L;wXIl_r7O|; z{LmP_LFt!w|I4rG`WM`wHlwmsBd|ZY7DpO}yqG@k$hEnR9j|+(oG$;e=yZmwO5l7p z-g3;f#xt1yTpbhhB!?i&!0pnRlm&s5O~dMrQO+sH$v1Lkv{RfpT_8&qXL^{b31BU* z&`bDK^uqN7m(V9|t3STl451ykC;OaNP@_JUc<6nrmiTnl3MWcGPpZRTl#rB?X`8rI zTnKXDNUqLp)Fr*E*g_O?8runFqBdNr zZpH0X0;icaXHz+7uJ#Xs&x`$eMx4B=Vg(`eq?^bly(xuFZ259oj%Phslq*g7v-_vW z87w%Bqw$M$uqyxesmh&AP8VgAwXB@h;F#e@&omM<;7Raa@mx-P&`Z93U( z3)FoR&rz=#Yy?j>KKA9Q+Aa9@oj}*~8ZNJO{VHscTmTEhE&w15kawMPP(_d2xG)kY zhfWK9@I*$ZmRo%Y1CeqNxP~&KblD7&K&Uvli5hxB%LOfdb43n8yJ<#-;jiLQ&p`X> zrmGjvA11&Mx8UE&yELq(j&?=`iCQ>~KFok*(wG6$u%wIO=J?cT6Rj+u!v!%aws@1( zq9CsqS@3ofsj%;bzZyll?)BID7~IQxK!|nMC;99fAy)b@f~L$A zk0zqJuR&*>Or@5~SH$&@Rx!ygSWA~KdG>(;^Hdwdv4y;LxEcqio#PU+Uw5#?ru!{& zUB|gXlSu~8W!k~Hjn;1=P9a9$V=g@->?SfmFDGB~Re8tuLSA(l6(^Q*!;gU6p5D;P zsTE#=ZHjRlur6vP6^mJjwIM=R-Tl@--4Z_`iW+v&L-|{jR5{Q06r8`Q`&5Lcw1EV3 zMUd?b$uCgV7&9*7jhu2I$C$ULEaCqE`RTjROwxo5jlOEaoyHi+EGRsI>>I2vckZ5E zZ%H4gJ<>eIy zRxuBH3||E7@ge>_f>ps0x39M7AE&fL$^rISMh95OP?Un`X#;|hD$!WKfon1shvQbS z)*#4NmbyYCWzI15j$ABOw-Vl$smiQ%;4$0re%WW*m&s%H@=gax)Uod0;5|@nTznh! z!y_0f)qFX*J!t1@qO)*XhiMnUtRb@mBi|#WNOtciX{YOuL&J^A4G9^DZ9VDg;mW!2 zUl2|txj#pEXoA7dlU|yfN%T9p`0iu&aiX8`oeK$e9T!4#c{0|>=NA0Z$?il1F0{HF z@6BZ5+xHTj%zlhe%OzrZu{;2K|++$>_Io8z(vI&5AwpL!sj_C1o z!ZE_J;~j!uro<0daIBSntq?@(Lay>n%~8(?v2A-+LkJ>_6Dd42N<#yy+qA1bG9yi5 z_TGFXve_X$ESsP!CFZ{VR4ZC92UY%TF3MxR*s@#68HIe4(Xa9Hs@{geM+>ER<@a0U zB8!n8yI_7CxKLm|Cwffc1!?SaKD`nc)z5$IFOu7F*u<6h3=a*>^sG6;p&~{Rmtp{X zOVVh6;7&V!MevuYMn)RPP`QUVL3{wdPgL-)Sp7m)vNxS5at>hIYjI%3ICFhKMtOpG z<-(6bTJ68&LfG?vK@Lm>(izU;uL30ef>l@J?CL$E$yYp8_BA^Iye&Z87u=Cny@ex{ zp5?s@W#s&DrG6`C?{jIi%Z7vQGsy;(PVm=x2IVC?_E0ZDxp>H>>#Ey>`;)d4Q_&c}xv?Un|`^A(yo&_0lB0KaK?1;P&5 z86o>+QVID3f1T@x3~~87_G)SkL`WQ4+%{{mN9J#NCfbxZ1I=(r8{HTO-BSGQ6g93xR@+N1+rX8 zxBCksk%jUmF8oYiLExbkQa{)4fXf_L@OupkMjP_14sB;N#oaMK*1!)mez1IMc9m!8 zO5u0MNfw4mi?UwJ%VUR1os`obi|>vR(2IMaHM7*%mY(63g{2+I@=wRZ|M(;G2QeK2 zgCLr5VP6vzJ>RK7v?`uS^&RQ$vmL2$FKD0e{UFe%v0)cCCt=vL1X7GPf{*>anBc5K zFNH4%-9y={_o{e1_DscLeK+VbJn17&c@JOTsy3apDBnwEM*f56ma}wwP4tV9oAw&8 z$-#HlK**J59lK+y4dUDxRq@#Hzrs2h@SNzU#>;=R)ql;#f3wwpQ~rP6-v3v1lY;aA z)X55}PMwO7lqb|(93I-UIY%OuW|TV8 zcal4DIf@3+F;dHx)P*4&yHz_$K{|AhcyhF(66ld}J=HfNp~2o z6W|~IxJeM*!uFpC=^PbHaA?O<-nY)&xQ|KtfA?c#6dnT>$_3Q;dSRFNa{*5PcwYE} zu)N5cTZBF|;SEZrBEfy0zAAqtRG=;J#X&|8ILvqX6q>n%{N7C_)V3z| zujQRR0VlKs5aom6_KI82W*_dD22_yR=-HO0gSr{nvHWIUj+{Dc?lJFzwjaZ_3wQC{ zc=M7f_r4}Z2N9S``bkunK8`At`De~!xrPr|xpJ~VMJIH-_<^-mj4o#hP87B)*9)ukJfr*_qK)Z0~FMQ73pKsvW_fPvMINKa#C+LB>% zjLvVD0JmhD?m6FxXZKB$%|v7S>E>)_U#?D3&qZvprO7Kg9+hF9$)Ets6QPQkr(~GQ zh6?e(V}wqT88%kP5K;wX2c713H`O!US8IruKn3G4^|V;c5YG*;IJuyZ&k`T79r8I? zT5dj%ziKTk8YEdv1ZKLG;*aY+jdAL-Pdh`h8jL!l#1|X#PyACW^LVZ+UEoP=NPyfy zzmab|z6}x(^ldcU=X=}0^$&u&S8ccgQejx>u?^~@3?>Rk>G$bSkr^_K7F^df*1#pc z6435h>M*w5aFOM>vebp3FU~~O;9Q-I3l+lO@)(KtdT%cdY}e5leOiv4tOqj91mZs4 zB9rIh8{wFH)+a~z@K?bo)|a^~C7_fP=7}7K+)j>maBOnMPSEu7r)U+0g+0KLVgUi2 zysiDnl}5!5{UZqGyz#}>_cV>S<$Gp>-~cPQxRzvcj-^jt)xH%BNC1{w=>7_b{zSj? zXAX3KHU2{mhDz6GK9#Wvf_Ao`pbXyW$*tZQFlW}{3xtSrQBbf_T7pggxEpZ3EnMby z_^ZDTr>AKjriq$1(V+NtM?6=MKxPnIjq$)k3w&VUeJnXPvv8WT{f!+F8o!5(8;vP; z^vr>mIBumQ15gSvoGyU8$8k9CHk{2{6Q-bsTnw56oxZJs$iqT+06ILr!A z7TCEF?;QhAz;_Or;HrG%sw$;b=p7hQQB$K^x&%#B^;$jsvM`{JPKuq}T}uEPfuq7J z$}Ouw;p{BPzTT~{a#=b^yVP;2Yya(J_&w*aPM8OU*!s6Ch}@U1OCDlG(|~I%jK6JO zwuc4lw=y$#YmlrH^cGu#73MzgRstFF%*EBnIL48Oi3FqmbV!n=0GD(!-u;n5;_=+t z!Wkr4-UI&#!xAF*9|`nyr2;qEzYsZ#JU$lfxH?v|9Hmgm@qx}S*f<(6DfjxE+Qs?- z_4xxz4rAK^am|KQkJbmawZh-89}P9qGtsH^Kn^BtywkJ271&C;(>q%2A@=%~dCC>Q zf7tJWD)pO}!hBV|8>rz28`)EnJaRwNXWv9<&crKo9T1p3 z^FY1fZ!M@|S+&Y&ew6cVgFj5l=tVxhXew0$Wk?3d>iO;fW=zKvp(G&f1EB;YZ}C8_ z^&fdV5`q_)mYM2PmX#X<)sQ$`{R#!s^28vX&JQMCbGu!%NPFfXFMNM09#r6TIYWU^ z4On_nldeU2Y5#J?h6+komrb;|ARQW-QxODJreGEyssj2Ks;m-ZI$LYw7gZy$nf+v* zpA=i8qH@h~R%Xh)0DAM@T9^R#Tgmq)WOQmd?MXsTL(Udc9-~#>TMx76u(oA$*I-?r z8g;jtk?%97pMb=g(c6g?RokkbX-zZ-;#sceSvX(+Q0%8H{m|(aSa*i9laat@uTZUN znRGKC8VJ*ixa4xRe=NNV2$2e~fbMmb;9^k?Q zQ5DMyp|=juA*2jG7xEc5cA4NEHIMviDt?@HmPl}0iPI!()q>8p0&@j-TD$pW^mTdrZ|28SE#DD&ZYY7H}hI6(){A4f&W80jKRZ9H35CoYBb7<)Nr(sGNzJM4^l`+unBx zV=KBxH`8BOy)h?Stn?WX(l9zqk2Q1zYM2R_+Iw~eiB@n}crOS{Mp2&y+^RB!S3!ku zLgXfXHT*K=Bd~5BQ~wM=b}KrmZ6&dW@$XO+#ENobA1TZ-lF<&`Cxe|LOAuED&9u6a zR-05`pFg)j$Y@G(r6Z%<_BZEjL$((BQPe7Tjp6xx-*zh@`tLthn>j@~Sp=>F3{=)f zYM(4^j1b7v(2j>&ZYcEjLeu8#beG_2tfV`x!_HdjdlB~%n&1`NSQxibfA+YwGMnb+ zN9&61rlnAer}e9WZLw44Wt_k3*dv%?fM&tEHQyl(_?vss^PbOG!}y#6(nq}h4L z6QCW9{J>N@Gx-W#3|t+lj~>9cuY5Nj3A>L*DCP{`P86u@Y4VP_{YZz}xA_c))`yFb zS;+B|rL-bH55ydZNDQcR4{$Plz7QMOX!ln_NN1&kcEYN~y{51bwhv#;wf_ypNLcd2 z2{o)_kVU=4YWo1BJWIc&!6&^0*t{a3v9@PJ;q%LM>&!e5o=x^4`Ww;(P_y3-OsG zCme1SufUz@iFWq2h%dRC zEew~V<|^G9*<#Ua`w^b!_XDJ+3~(^AIhF^dW$0cfF#JrtKL#?yQ*T2U#Rd38Yg=4# z&?)i(h?VD(F9iLmAw=>8APlVANCD-Y+)*S9`|Ui-1k*~00Nz7cePr_sg(VIFQbQe==m=c z7kDwPdH4>)S{wMQK#!&^70Nso#9WK>F}A$|z6k>CK&Sfv0=ybIM+*#mv$ec8{s|9( zd4!d9buwBNyVY-Grz-}xU&VoOyORN#M^c~YfWlXz@aDRV25g`(-2i9{mhT-)n%D4G zyFTL~)Gn!KD9L;3^x};IRuxAb+XlLr@h0}|os4!`t)3jtNNj^dQ>wYL4{vzJWK(jT zAP>F((N8x4)Ge>)OtS0Hyfe|5?f_!d4N$2iAZugOq@L?5+u6O|htu|v))mE&t?j5Q zZ{REsVxK&wNW;l&NXL*;=8xF!7gHSq?a|ptX4dGO1re(0TLoZfxexoQg+CismJJT6 z=M3a%WQ|+d<@BNYHJT=Y9PMD#HhUC5z(=qO`0mzl@qLSKvpCMV4?C%Je&*tW{oVpK zEo@&WNM!Utng0Ed64VqQTxCF!ent4!nSbYgi2v4&e5+ngdI9S=F_8Ccua+;BB<9e; zX)8yv4FI|(hL32vllFG^Dd=x?&trkBB_rnan$bHtKd$`B{rQ}uVA3i$MuW@mwwB+* z5a|!3V<|8L*~XMrf0C`?iR^roe#Nv1=%_jRrH3mXPJ*8dDYM3s&PBbPRbjIOF{?4WJbADXUpnKGC5-pu%Tv27Ckgd4~1g7kR zaVg}tEi}GeZ&H8kxojYOjaqSig!8<{$=8BX?+u%eOYa_?lao1ttw; zUDwLsRIH?KniE5?k;5rcjHWR7>V%$Rg=64fD(WJ^RBG-&C#G;Q)uB-U)`^o697`Uf z`Y1FC0P~TU!A@-^-$RG;=>*u2)ebSUR|mXmC&1df@%=i_fNlvye?=^C7W-O#%61yS z3Q)5s=oN4e0-wvbnCJmewy02TzT02TVIj?{VhFO5aC7$?a z+y@Undvf9YpZJgkc}e=S*(FH)d;CP-0a#TYeB4F$@Q4d@^i^{#H>SbxF|d-|M}5#@ zy8*ynZ3G?^_8VON-`2=3U!R| z&~>!U&kvor)G^k*%q=`*a4AP2(1I zrO=dytaE-1mL(Tp-$9(Ok@+vHiE_37ps#snw)1PuEe@k9FRaB&QcPuAwjA7%7W+x< zrjxWRNQ_~Z#zrn|4gyEVVoM)*f#>$3jy(kNP$N;u3|6QPfrrUxs??1ZkLz&F=2dQE zkpfh`{BB(Bv}aJZ!@}keL>Cijv}Tb3S8S#5h{!Vfqo;nl9E}BVYK*{ac4t9?kd4mX zSWf0zgy{26RQl=E6zvEfLx$`ohM@+oa0abVMsK_{N1p8Gh;4X1oT-FdxFDkucOY7f~=>A5?Qom5Uxo)of! zek7ezFry#W1L#HSytkn{ z!uP@I$gxU>MJw^QmO>K`W(FBokJz<<^=Fp!kTzw(i1;Z2($BGZKcGH?hs+Ad#rUhh zQB=x9sWIX6F-%~+QcctrSPV^4E||^%s|vBxf7v|Rl3P`@O;+7faC^<`$vH%)G0x<@ ziqKU9q?IOJE-c;MQUKn!JX-BL&jvO~y0#Tympq1iCqOOZ=;{O?f<{(@&kj&X`~2dy zg6|}Z^WX!sZ!-#iXp{#G0@Y1Yvn@710ZWZWYX07wK4ddS&pnU!2Zh*XB*0>Jwsoan z9DBcS3-ZK~i$Ju5s4F8Xdb>v!Xn;On`N@&puyVz~WuQ(roFRUH{i}q_N(o4^lc56r z8WxB`t}>{%G0XEX!I8T_Wt!mh{TMTDwLcmN&4W36>(k@8>6?c;1YZX6Rp|{VR_Q9Q zaDv;Np~im(i@C)9fTe0rxMMkfugi;v88>~3&beE{=>x@%2FMSU(?nyWNtJ5sBezyi zRz^9_b6s_w*OySxM=+-jFMf=sfJ{!N=ItY37XlL~9$Tz0{t-&jmYcf8yi_hx98<*E}aKM*wZG7?=$jPl}5Nu@H4`PPPxd z9h?LoBDL_!s@-cg_sKEHwNLdK>o-aBX_s@VN_}wf-!{EmAVVXbF6R20AdrRW&g=)= zGe$w{adsS+J{@x%5blONxr+#29`^Gel)jR^5MfUH~|ePdJK3z*IUBp+z-<^^jk-h`wbc+RiI%E`k)gEUKFf zPZ%>iP49i{L)rR%R4v(;BQV-upThRL>HyzYu)t4?7zOlDMt^tH2GGI3!wI!^5j>WF z9*p)#ww?(aHz6E*ltf!!i~uUcb9w6D;w=)g7Xa0?cme%XU;ZV|yg`I2d)f;X-=FT0auGjKF@WU; zBUIN1Qeu}107=wOR7&cEq|!+j0}S4+9X7xHQDAce?#GYTs?HJaY>H3$U*WqxgFxs7 zaNh-B)^fqT^P?Qa&Xg3G#G#E>*d&MV`Njf1hi-#ri8lJ)_Q~2(1yJdOL^`DzT|9)J z?nXi5wM6ZyrWk{pOTc0^v|M#yE65Z>_GlpTL&At6}p`!wLrvmDn<5C9f1Z8&waeM}SwLp-j=fM(6*+d_0 z|Gqr0zq83H?_H@U@A%1ONW?DTtqL`O`zh)be_sRKco+rIH%`B&)SGn-EJH(@oX@OB zt18K=iio}sT-V^NCHtzGI0z%Xx&k&@@j8tmWO<9DaRr16GBLYym!%=uw*&jI=sG!O z@1DTCUge!qN0|NIoS@IGl5~36MVP&-Q@kR`j zmrQ7w*dY;LZtwrm3<9S21Z{h7mA2r5b6SK?y`i<$RMab-z&%Q)+9@FeM54XnQa8j=>wl% z4$U{fklF!Lm4k$CY2I0WBx|*0cSd|>i^r%ZBheT(L?d0H7^}-Bt8q{s`Ot_R>V84U z0s$sz-Y_SUc8s)oEAR{8x#k71H?niXRdRhxaf7xz@qdUgSia!v*1;2ovkP)H3#Agj z$i}=S5xJ{DlC#S1#E-L7FEznu`85ST-BmV$qCGHp#Ary_-I>*t38K17v95X(+g4D| zBR*dkvIO53ZVPQZ=bL!jT%~WF=UBY16t2uZr3=m#sSrUk<5ik+WmHvsuhvE>YbOx; z*>`U$7V$zJF+;Pz3s%}wRnfH<2VG-h&nepWid{$C8!9FE6jvs_?kQ1#p1Wt`7hJC6 z;_8LpqQ{@Afg}fj6tVc6nXkiegiIFeKM0w>0`s4gOgi|g2}9D)NqhphV`sel?b7)v zFux4|$K*(JZ2FGFEs2~s*=;i%M-$4h2O0m*#>t1I;F#%tO&lgTkB@aW2#dd_I{u$O z@vCeQU%&uZuZ`E0oE#tMf#|3xHSe2=i}ATGOW2Zb6_F{gFdQ(zg-bx`hBA6C76=_o z3FkklBL#k^x4`4{6@Z3!$iXN!#YN!hEe5F-izCgEs*%L}({tUKgTR<)PH&wr6`5II z21M)pxhwy>$&GvqIjp5tE#|4({elxX2aSUn)znC%wek#;%a|wY0jZVL=l$bLU|)fW zoL>p^IF=Q32@4O$!$g`6^yo!W%@K#ExT5#W0Q@^v4u58`@Az;3?0u;H^m z#|{I*)uyOb0N1vW>rLuyzqdYRn?za@AvArV97KImZ>z%%YdHT>BK| zgTR874}=`}7J5hWGTtsA4IhJgwh#<0_LF>cMdta1ou6vvBe*U<&V#Jyj-Un^svYMQ zlborT{qV{f%q00{($+vc*bL&og=;vQKvR+*^n}SCg9pu2NmeW0E~N6a1E*TjDN9e} z=mn%ebv(51)()<$0$RB4g1+uWpPol@1BZJX{le3}V?cE*0tss5|*J%gDT4%(aVv_z`KvX?IW_&)Sf40xpZ%S^;c> zvFC9io9r#HEj}S2CT|gX`=3H!8{O^+@rdt<_rhp(HP@UYU-_3ZUG{`zOQUFv#(sU3I)b z)nQPR(pLX{Tz}KT$8gu z^2xJ5CINxP$Ff6wJobGQ!>)N_H~;hPP) z2Uxj@R(?6qy#{9A#d+769M!76#wW+PgmM~O*-wW5mkC8Op87f`WaoKLj#hh&{G+V5 z)>~Oe-bbj3OMal?uYJ2qktdz|e!3i}-RZRIKLQ`;vO{2ZzrK@lDAbRucp2z7WUp|I zD><4u@5suKtcM_GI@X{CDwBXaG#N0{eJH!pp15ZwU~w(qg0Dg!`(iCK(;0V`Z|D|( zd!}ra&E^9n*|M|Tl@Il|no)lUYY~Qapb3pTzs;)^7$5rnA*+Rw9rupH_W2|yI?&I~ z>RztKHAGdoZw$S3sSKKTvqSbmN7Si~5&?a>iL+$Djc%tm2svfC zgPc-@fQdcW>{eZh(K2)}F2A<`8m8K|hJiqqdoPf5M6rC7Gx3ARuobX3JL$IC+q4LQ zhBMcelhk`weq0Z=k)*c^z2 z!&@E^2dRm*gSbKs=V|(Nq4vkdOheWcl?sBpx5Y{Pq8W?}nXAiS#b7-w$)4UufiWoQ;cN)pw_z^Q^@kkvNV zAOY&E0o}4kBGo}g+>fs1D7)Vu5-@K$!(3t-iaRGl1qYN>nz z@8RC`o{l%~$^ferYWuZWKKfd^7{cBIFy~w@kYg}^@X79eiz zpKedJYhZACO;&-7H;-TvQ!>#sSREIDbK{%>uMRey_eH@~4E-)@Ja~(Feew1p2s{sZ z_#JM6CL$g@c!y@_+xv>|2GrYCoS(0ZqEK50Gwk6vL7}b?ooiT$CF%{d4T!%9+0pab z?36>axt7HAW(#t6cadU{W%`NM^NQzsFZE}{lTIM<%t2Li^tBkoffk|xto268psk|F zboEE!G15xf*_E;d1R|w$-oF~eA6wJ%YP;zr&`ed9FqLRs7-|Eq-7=WAVrOMkVyWQs z2oQ}0ZvXyD{7#%)KXAW(B?a;SPI8qWqLpkLv%3qr4Gh9yHg7M=LaG2PqPqjD+W{?0 zIGc+yRzFr2f+(8`W^{?G1g0^>sZu}=h-U$dd6v&^OZ;t{jx;Gm2FjOrpH7yv4ipu> zbWsNpdv-a+ue1WDK*Mhl9>J+yikV6{#E|}(fZfQ@rf>H+7J$-L@LhC2IT_4}R0Tjr zxeB4PqPPC7D*3ySJ@r`*-|6Mu-(pKE`=VPj$A6OHeB9t%5or?Nz9zx55$9Uf0(9o5 zo)zc@zC87rHQg$c`65I^R)34jQfa+T&u)DEwfKq9EthK2FO# zT$^fdeG0Gfz3X_pA?L0rZM=_Z&CW|6P`KpB1KJkEk9SSztQHc)fjUzh`%veN&(Zz> z=!#8oSp)=zBiG(hGOj;JUH+XH-frY&Y5hvO6?eihv!ngZl4J9_4I@dn4Q(uFm{Zh? z+sLE#Z=o1JENXH7()Q{nrvC%j-@-eYvGtzr8>hYmxcf*Bptr@dp1Asgu!&&!b|SW3 zt;e2ZA7DxA2K;ivbS$71joSet4tzFr87qa&+!?y#xF*UYu=bbba*8#n?gRED__GhX zI*YIooTe3f^0TNDWA!wI$KnX-A`bL0d2e4sQaubl@P-NrIhQkQ; z%y0wushB>{F45zJ#5ZI!b|f0(Om+m$qw-@;qjg~GxrhhcV)JL;&YZ$?V`3n$lLOP2 zL_4+?FDU!(??(Z91Y8*Ys#`1L$NP^BNNEHiTGs(P2Sf3pfqTn6n4w>p7g?xxIe%W6 z%gYCVB?o}F{2#fM;~*8rkkjZ!)?Lb&4H> zjf<89)YDE0fNx?pqK4k9K#?Aecb{Q}m=n2S>Dd|>@mCpmMH#>p5rYQvpHuX&{{N6a zF2~JlI_wQ=K7t6S9JG;EQw31ZoJlzcU44Sp7T8TrKzrKcy?!w5RC&NteOM?4nu!sM zAy9QsAD!?SKZdd~Si&u`{^XWl=acji08 zIGi)UzVEfxr?2Z;ru%(hfElG8k^oKpxr+sWajgNui|zYr2w#O$UUy?IoSdf|q(&X7 zo`4LIdt(!%BGn)$d=^wf5gLbZ#7|W&3GAd+?t7qZmMOyN1JTa$=72yCLL@NkH-e8E zANSV*)KDPxlhCij0^mVs05W^DRB)q#!OEBcMSab>V7ParH18DntO}^;1AU;h!WGR9 z-^)n8CWvkfYKm94fVG&-y4RylczuFMQB5I(KIm`!hWEf#Vzs zI}>?#*k2>%LR%37`FL53x-oC*fEGDp;22h8Xm*vu@_tMU8%Ao{NXJnC**%)VAx=Z#JqFpJ5GUx4W6T3_qIYm9bA z(+wUILJwC*^RiMLMHk?X=4p`7@urM?U>Nr|Y-EdQ(`)@UO61Hby8-%eyf@lIjF~(h z9nEl*+UH~OEb7(a48kX?oFMmlwR`}&)+^lYLz4n~Luzd}jnGgEDiJ{ds7#)kmI1Cr zvqunQP9s)xtszix?xOs3rGmThk&YceQyrE*GdAh}zz8i`;oich9gz3_aWE(XLObm; zf1BML1M*^05rwj_%CHoRUJiovn572+$Ycfh3$4_``8>LM zkY~bmcFy;?mnZ~XOF@r7H@E)ZeeDl%AwRqpEyjno0ln!3S0kfhvJpTaJLH*EUbwVf zZ4A0XYJfBAcn0((w$nMDRM;E=j09+3rgNZeHWw_BKKo@-SjyMM#s4;`vY#FTo}V4l zM2GL@LywNkoALk?^U;sSU8@lO22}o83zA-jHz+I22HU@OD&1m22FmqYg5W-!tHwCt zIHFSkx^o{QDt&FfBKIpmXQ1Qyt8`!_toSpaP(KSAw1#O{_G5h4MAfZ&Va#K4wx6v2 z@g4BA+@RC^Q=S0;Ys#O0p&e|`27S;%tI{u0x(E3UL08F5<~t&P!mGbxsxt;4fu+f< z=z)>_Ls%YHJ?J@C7MsuaLLKKvYC7{@Ox|RtI%$qSn0E*Q`MD*?0e|M_r&O)j0O26} z4}=5tKH7QT6p(OAS7Jr+(ZB^%GxbEb`EZ_U{U@l0plzTni(eqO&tnr`c2O*513Bwz zhvhlB)azw=Zh!R{Zn*w<)Bv;+h5);Gk)`xW(K!e}Rq@kgClD`ts>a!Quf2?Y5s>k5 znL|qSo6txmF8~H*y$m#ipM%D_T-^ufw>c>8085tjS3lTg)N#3_PRR_g!YCCWv?i2- z|2p|!WDWi?11ko`3Z48jhZm?=t(w$;A@+pkeOB2>DYMoCDS+gy3!2=3`iiA<)x3)D z3pmvk7WpH&TOVOxKkFT-C1hrH%Xs{~dZU3dV68d=3M@Z{at(1h3M=PuDtwFqd2%O} zZ*3IdzL&VihaQyrYNr^OlxLvX?rls|6ncP&TW-=rcAy5P^n-!PL6ojJP&F*TWVR$c+?q~av`FH#A zr;{c~rT+)m3g7LQlO9!OB=Hu>hm^(yJ+9RILp@QH-~HDAZ+}n7xx*8u3I&}IJX~60 z?l-ZQ&?NLq_+JO15p(O`vv8R>l=K=Ru2k(SXvM?;_q4amen<#GFE0Hq$Tvm*W1>jN z(73oRp~y($_dmUoJO01%Q$7;dn^pX(gP+={@h!kOUPGD65B3JQKQ@uy^%Yg?zwtxV zs%Y-(N<$7W*umKZ-fwuY11Zl0y-L*o4_^g13P{2LOcq&GM>^Von1nl+=FM}ehuwFF zpbA+Rcqk|r7gII2Jb$Zcucl(wUjI54q?~b^-F#@&fTY!zsa)f2dxS>OGf_zbRTYBk z?^s@Ec;CR6EPf+eY#>6wwIA^kW0lG2KG|C-MfT%0=QQzNK7MDDjo#_0uI}}VQ_q9- zRZ!8GrrB?F^Iy31ot)n_4OJ!Z2_vf9{>;+T8bUPn6aiWXS)f%)Dop37hb|%V_t$_l z^>b%KdqcPP!QNQGjTzKzPNz3aCcmp!iXRA71uYwUJ(75>ixpP0io-d4uHu?H)Uvyt z+i+oEc)^K{Y}U+TVXyg4zPz*Qo-1Ge11-m<6p&QUncd6`tLD zn-mor`3WwIqTDWDrY1-IJXjt@d6_y_i*r>)Q^Wzm3^xD6^L>92o*Q~LTNmNRy-dIM--sqbO zcJ6hFPZ}jGIzz_=FZWo#>e(=gH=tj;XL$*JR{%89(3eI-W|F?xE z(*jo(k6w}$_=J%TEr||Tm%Vt_HT5XSy4n6=-SOz0|CgHRGvJUI-}Z)zkfOKiIt5I; zACVPQ*hmxn{QQllQ#6XMu%XVNDH-ISMs`(JzWviJ64U(j#_j~y{IA_Zqt*9CtF#Rk z5d>a&`fy1e#Rd^=Zsh&Tqxzt#kx2d{FmcF=I62=AQcNZGNv7ZIF6m35t8sY$$$n5a zM1&A+&^pC{+j@}i6RV@TIvRZHs*6=x(Uq-n3iZ_Z-~JppJCSOv&UK{`cn%M($_Bcw z%bw#7vL$ku|8lC=EuvAAm6;T)wMaQT;NU}dz6^)qgVPf2^N{CX&!GsO19ER9ze0>p zHSmzNtU-1AN}7T2weZ|tnSZ)Q4{%DdZ4`#+e!FR(IpB;*7T*?-(ol;F&|S*3e)&%? zoD9w)6lGw4`3y%{;7xU|xviy^g4ZEeOO5{L>l{O`Gn1Gj{U=nm0mlvNmDb`E6A6S% zU6z}={yP$akO(3IFe?xdbpLw9A2HzARa5Mb^P7>*mGNZp{dr9ATRywMoKoxARU`jw z;Y+Ynx`@bf6MtY4VOQd+@BDUcAX1S`o)Wz~a)N;*eM%H;U3{9zERBostl{#wZ#d9Y0@FGejk z-WdmvOeg*b`}3IKn*nLCO~>sLf`5_$CMB?vc0%LH1ZW(soE$1Yvi`Y}S=gQHy->jW z>k(BFz&4G1FB+Ma?ZPjtWB*F}=P^Ng@GcT;({6Z(EB){HS3!W4oO3VbqC+pdUbBL2D(rezSQq<>M%T?SkMqxCf^Cwa0^77qPPF&uB)#SZ zE7^AR+(HVg6Th!hBsb-sD+zLh8h$882>mN@(E(|OZbFN$8{<9k+Wq!Nrhgt2+9n~e zO@lnQfBZQ~BL6+`KR4^Y2mZeY9=HyW!2Z|6|KH@{OI!v3y^0<1EBV399GxqlVhju^iUMzt)18rf`8w zQR#A4N-_j~Y@*Ej^Lf9@SbV6Ak`eFv{q?≪HEf+YRde`Q^|E5NsqnbfsDS8bMPGphlNobL`(Y0j)U`&=6*|&|CYb z#|M8#KMdXW?8cwk)+ikOf&B2qV+)A-wF72~w`sp*DU#c_T;-u3myZ8u!UHS<2TCfw zy|MZ80Lvg!3!E9gqYT8-_SpMs((I4@rmU?Y4L%o=1t#2WEN1Wj5nQ1)RE2V?xi3<` zqoU7ss1$A%RZVzF1P2qZ9)K--Qv2}v3M5CUS!RAi^L^o;kNfqFER_F?$vggexB(Fm z(aEGlJ!BMK10}MBf{JNovj)&Pol!{Q$b46w_aBRZuMB=(fZU4UcS7=DOUSfPO}Q5!F9G@T-mRoXlryz9WTa#&zOu{h@)$)T?_6eQAOz!>{*=fBz|b zA7&^wGHx`l=R=2pJ@x>q6+d+N?Nh8G5MPwfdoTANuk!`nM383!;q~R_&H$q7L$iq$ z5Bu3kntAz{dDqgd(kH)9n+WH&~*Er&%QN|*?SV|CAOS^aNk z9+@ob#j&U-FboD$co;VTg2ZmHLD|M$JE0e2W$({H25FKQ_|uwFVrMc6NC2{uN0_a`TR)wsvDNX)oCx2ybWQ1_!8|nO!gPS|O zrw7~QBN`rDoTuGQ>nEG`y_{4YwbTs-#-WY~oN{gA!gPx+`x=$EE<=jga?Ex(l z4|mXTUjW2;F2Ev9TL!Xq?Y$CHH+~&bpIyR4zBOy|jT6G1qnY|n=NE6U^01kXMKNkw z)|+|i41sA|on_!y6jNc{xryh_OO|~7<1zH4TX?Hc|61(l*1(ukQYs_V?a+X#4G$o_ zJQb~BDXjgN^uXSviO&Prj|_gj4JWu_=HWv2{D7)$sh9@Tu(%;H)MA z_CN|4hSYuGekA()z*DC+He8%h**CQr_PqPVbK?=;Tv3G5>G@Hgmu`{Jde_C-%*6wO z(=07(Sk8-XRp~@j4`r@~)9)~x;g!(87ydpb*rXoOryV)WsOUw2vss3`3C$l!fsn^v z&xna?V*S&9fvNohkN{*F&uuv0D_j7`N=}Hg+w+qNTw%TT1A?vep13V%CU8S&y4lQx zm%l$rd+M>un~p6V#fCxG8~GML z5^!0ohP3Uza$)pP6wTC|G%jZ+$E#}=>(~AL+rc7SVC@PoKQ0?vMVA7+N=Qw^dGZpT zKtIB+owR2f^A?*H`Z=JqCIiSPsl+hwnY?yf6f+zNT}c z8aJD>4QYIXL}Ti1+0a8)mw6k{os=B&=oPFBcCT}HadLW3ZNqS`?L8T+5Ruc8^t0~v zucyYI9z)Fy7j?E|9KP(rvj8ByDdc`JF>`K0d{+Z$uvMrZt5X1YlnWINXI6fBMgDhY zl_7DBjvXL0**l_T5W>)H5PI*`g(u+tCjzWm3cx6T)doz6qrIj8AkLG-nC?D60n~c~ z|FNrc=#-wjb}M^=!?j!+Ywm52pXh!H5E!$s(Ai#LuG&n%q+)Nel!*i9IlESH5<^QpH68 zec=xwxUky()sJ1uc$Kn=hY)@VZynAvE8o$f$hw+ z;9`wpjn%IL%=9`2#vBhV{LvORhq{&(*CGbxW9gMY?@dftxw{==(tRkVl{vLu!?#s4 zK0TVQrDZnyfUd{G%cV%4*EM~zW%r{n^WT9(1UE5MXgF zedaj{Bn%(JN&7lB%n`_H^w>}WTzL`@OP_EC(3$(>R;AHL0NR$y$eT8SH3k_h z;%-3M*hP8eMPfg9#zC|+YuHT4h#MFI_iT6`@QZ8200_y^wK|C81*6iO)6M#OQbdgro*nWK8B_4U*@@D_RBl~7M z9h~9ECta-;x0AkbpUM@jR_`cr(|D*@|m5rUCkS5GZfBk46LRKp(>ON3K%vMGMtAQo^Bu zDxGJ>-CpP$rtbGsMa+3EIu1H_dja$p{&NtI-4bBB0s9@t&~kwCjWU3#;`wDC6n9Xr z95)|lv5BH|7*ZBmp+Bb*3OvWJ{su5Y-|%nq()rD+2BSu7D$9@xeDe@pS_~4Cp%WvA zWa%!$b__7CVI65-3MT#VC)?j7@-cIsF`V~^D>G1p01dQmiH^8Vggp2?Z} z{?XVl`KbVT;P=#1JM0!QnYc^*tFiwI%{l16oa0{~HgNxLZayiJI!tz0QUP?PY6`E00|;JQ#}T8#NJ@XG~L5w(?Cif z`|xnkpEC)-40UVUYRFZImDlvokX!hk9^K~001`}Ik)*;5e`DVb35-F?+ec1*CzuHY zv1ePR-HBhQ^Kss&UdE$b9j6Jyg`qGh8jIDg=OiwQHr?7didEvfGpfVrz0-_}dI}H` ztfLDJ`1}4OsGziIAO%5A@77UBhtM09O&RI9!pw{lxqIPRy_pnfX7z<}_Cn**=*h7t zv!8n#;D{=dfvXrng5O?W%0Cp$`7%j^!T)#`w@NfH@}{wMo#8V|Dz9Keek!xecuOf> zRqG=wKRb*WSe?2N85xdy5+eIA%--HZt-Y@lKJ2A{`d3FJOd8W~gf`(j_+>W%+o=}ea38eQ>0)ST!Y;479@$(oo zHo1XfLPrlo5A=W0P>`$O&aavd*eD$Sugt(j452=h`F@yiL$pegGKgiN^x%6Oa{cNn zY!Xg@s}!Hy0z%6*P5b#D`aKxl(`9?ACyQuqu*3@~mocKn({F;3V|c|aENO3Y)xCrl z^@^}z)Uv};(~+Z@M&(g?u1V$I<%_}_s~$&Z#3|&>C6>iUS)TDiP{RHi6?Lo&iWsSc zQFW7tjZoWORhFwgqM8{D&+6nHk5lZ}7Miv6J9_xDUbS02QV< zId+ zJ)Z0{g$z~^(dSRlg^xR1c2-J%7Vn~H9~1oUmumN+8^L&ljtLvdO&>iBM+PJ)EHKlm z*nj~_`6h-68LZZyR+fz16%_DSYYVZJ#h%AP+4EJHEG2=x$E3ONg3#={i|NrtfNVGJ z1>%kBJsl-dIZ{QeWq`vWxBw_04qrhBBMr}9ta}?M`6mO2?=(XLeZ+&zTm}68ke%?+ z$WBUDHc<+gI?BQ9^IqQhEA{}d8khn*jKBnpj&vJ1yN|PH!SyM1b7Oi(%I}0SJ06*n z_5+@@DvD@8E+Jl?)n#HR0Jd{hT6;?9moD8d_ ze^38`+c@-IIh)0YDwDUDyfL?d@}q`IBz+8&wbOjVV(6Vugio|i-4=LxP|5n7X*b|- z29v7RmTwzq?k%8y2X{1#Ff?3w9DYU?R-@R7FBYT%WCzVREjvP!Rha7U$737tXYgl& z+B4876{?Tq@vGa(EGji70WQpa46X72rGt}_y;ft3y??&_?P$H(bk>Pnvb40vdv2f7 z8TCAmb8|iP7()1JNOm{I@XARU&vf@jweQtssm|EC15Mr&mIj*dxSShqjaSI+(vIdr z8y4NF&s_@?E`;iOSiL6M8mi-Fq>_=%RR)k_(zZ?}Q$BwwLP>#FeCvN9{86Ld>@IJ)i{$~aU3tjgj< zEyxP5K2u?W(!Mc$zpL95WLlfF+*>W6i@-`!{jS*KbpJJ5IPwhAPkEOHuhRoLRK4bT ziS}*80YifJoLGZG3imxK>oy*RrC8zftw`4W=j^BmBkewc9R)vpj?#HatK&}jK!di> z@6feClB8 zQhur+>&GYE54p2LpXlkS-5!v#LAZ>z;o$%t;&ARERG+)ra9Hi8Si+;2(INN~n~$Gv zN7MNw96}|xd%h*J2Otfz?qY|)0I|_lJVWk^k%5{Q(As5fx{ZC$;|Or9dO*Ubk0n2# zp>d7S{(L*3VYjBbHPZj$b-xgMQS9~oBS0|j285yobck=53|(~fEq&JMv+I>6=#49!g)`t+@Y&UuRa{$Ku7BIv8-`nC-xEB?RXNP*DRLHG2c(D?T$n=m zNe{9c?ZqJyYu;2&Ds=~_oR}x7%J2#!1d<;XZ6)0a!BUDy2TBH9nN^)0viFsR(jLB8 zkloc?J0dQFRE**8lyupMku+2MEk< z5NgaFi6YjaYdnPc;N=jo_%cn3|I3y95+zS9AY;}8k?fvmJj3ua-2-j7welXs15TJq zy5sQEz{;t5cy!`Mes=iG=>m^u3DMWWss*wgkm|P}Jod+q_U`Ia0|Mrm^)0DGkUi-Z z!Ja*4lZh0rf8$JIr3<)nCIB(c1rlFwcnnb_!uIa$Lsp{Wh44dABu!ko$wu9WUTEKo z2_vU6!I&4&pmg699c=LOs`vp|FPso<tODw&_H#$kf zJ$(RPF+Qg*|IzvI%X-uBo5op6HSb?{=|nDD23}dxD*7={PS`T;)fD3KSsCc0d4ZdtBJ*8uONu?n}Z$bXyy*51`uaT{t*- zwIl26mPTIm%*Cg12Qw3}a~43yRB?#D+-WFmfC&|ml+2q$e@|dh0l~}Opk*s%;c2Xo zDov()+hM7nrl|ao_9!0CnrjqYr!AXo&SC+A86!FSf7o2UHk{xgLEct(mVOk#CO1b- zLj01R!UoU;*+x4Ak_bDWnAnXD0Ex_(K+@k6P;<4JuGc2j*~zESr%L!|A-9T#H7yx5-lCh1UN;h52UIL`3M4-%NSq5Wkd1mgp}+Nxq6 za-zoKBj|>}#WuvdGg}=5k8j!nuLZJHwTH0WN1mY3Bj)g-2{rKwzcx0h-;x(7dJ{py z%%SH2{G#18wxb&icc~RHCpK#&u#ujrg=#+-XDRH~x7sE~wXDkGQ`UZr0CH{k0!Vl5 zuknn|jP3%^dv(g$j}-}zIST(C7^=X_h~W?s7ijb5Zv!w};pjLav%$}B+c^*b@vH4A zKP!yv&=ynCW__cX<`5+Gi%*7ngEK*2{w3I%U(>BV(}~sH^8;n#?TaUL4~e zVzUV3$T@(g)II0TmwwGiAq!>+Iu~g`hFb;|QN3#euG3kt@j4;b)1k1fZ3e7lm4j40 zNQ}7(5D|Mooom`22@AVeW|1etRan0umQlOAJ$ZUWnEci&eLBnjRxQ>h8t*<5 zh(xBDMj4@gA+%XEK>Nvo?<{Fv71EP=p~P|6jx)#S1klu@Z@@^-uH@|06C$>_fQyCB zMs9l;u)JXPr@9iz`>nERBNGeB>rC;YlSZ=T-TmRG6o#$`>uYILpisF!m?@v&s{^mc z685|PDEQEq_ZC;mVCYm6K2vQeGH6F6r~QP&hwlShy+5nvRCQUC+ax$ugI>LU&E1a? zwufHxHbMJGTE{>m-3CbW$u(GfV=Pg_PNGE>AdGzSQsgPL*De3K*K+|RE%YpL z`}b16F)qWoOxr;>&C@ZL=zqqPNli#3j1M#0zh~0=YCu;z^+h5+3xN%3mg4qnp9&d!Cvn-UoDjJhA5vYM}NK*hJxU zuod=uD_TGd^PU%(75~g2sBXeVyo1uQPm4~KHZhvU%ZqH12QiCqyfnmX8DvR?mF^El z>;2anCu)+p$qRuCrVn_c%MJj(%yCYH+R;-2vt z-0ihYA(&AP5pAs%kU`lzvQx36?W$InM`q*1sXS;32{=`--_M!mz7R;`tc}H*58#y5 z-lFAuLu;qB#UO`ru#%YhDPNO{Lkg`jJ4>11xh^PoVz&T_6v}C_ZxlZ-eRB*Et|3a9qQYK8M9Qgq?$zRHm+6*Q{8XLPQ?j9#DD)}gF7@O!z_j@5x}-$$F>g2ZDW_B`8sl}`X`~&-7J}r~=vV*nt+vpq%{@w_5RA~U8y5}c z-9iA{HV6>fq?MpVwlSHdVA0b-Ssd(FM0uq`5GqCf!`qv+){(64zdECH3dHVzoPoVswu` z4pNo#wDeIJ4eMGcHpr#FYCNIxG$JyJxF0EWZiE_HU+0z_TkXuEp^mFpi=rgf^rEHV znHrQJUKM+d)Cn66k>*P4^)JH;{895G?>(a8K8=8kWk>=q?E~Gx1nn0gH2IXz&_CS} zpJAps=H@nOL$__lY7X@+Qr>nX)OJ-xJoN|aytPERx#CLHy_fp-pxZ7VA2nC$xNo(Y z0J#qf{04-78Ul7v2$#kq=kB(nPPjUI#(Pj#gogI#A-+yclfzJzNSwM zM;S07kdXm(35Py}^?q4!?+xwGR2fwVzM>yRGJA(mK00yH|0zw@1NJ*Ei6Rt>qF0m= zns=)UhvssAAmkXpk<5MfsBjp|eRm6uWc%BC(g86-vyZ4IWl$-%K$`@EQNsr|&ssAO zR%aB`aY;0ZT9R6xNS7N2D7!+UlREKB)#6LCA? z8s#LoX310ZhFDEheyUNNkkQLRlnQ`j=xgg}pC1nr+;VZje^vbS%(X#JO~|8JX`K4W zi74i+NBtBqhG0obhS8Ik^;g@sz@3f`(`TMq8Yt4c3zNZRy*JfrQF`SG4g5%0*whKT z4g5 z4WhWw=$mL%)^$z7MY^-~`Ss&@P^Z{rqi%oqJ;&KHhOI=0e)j@BV?Yqc1Cu$i*HN{E z#TGD8MR9o>D-)zKTNODjK(|1;{~J7J>cZ1L-}wMDf&W_ z*k|FVd0YIS%$u*xgb^IA61ovoH3^Y}`0G~#s|W6)vyyR6YYT1t@HJeUs87Xp`RE?b z;KIuLiP;^BFg;HfBRB?4yYD_fJ2Z@BzjTuNq=+>XI$$C7(%8sZC)uS#kXu)6+GFLy zJ=Hc%+Dk|y&1=JjkC(C&t_7EY)(2N>;Qpr>0`DUl3YmVQaa^Q733kVg1CJ*1TX;Xr zagn;alARl4CE3EYC%b5eU;sH!=tgXL|WP%?F+`I?)Y%k8PS|8knH;KSW zY8Nkd(k~JLeT+A~QWp&#mH0~X^$~Wbu2MT7b8zSumoYqQ&G-_?NBtVt=GK*uO2uQ? zOZ5Y*osNyy2|#C4((lcONAZmoHnnErX<=NEf?JQ8>;kXwPB{oJ@8Ve$IYt7wn&YxjCBvmS}WWunm{R}~p{1_d;6)HM&jskC% z2UVqSoL_(%#6qca8uX^Lb(4_~FcLy8MJ)BmqiX1Y+rL>Uc|#^bN_6t^T?4lmzA&+m z`eC4^MBTowL1ouU(EFa;#zU85(*SKNrFd_vF=WpZ=weh=(-&PKmN*7QUk83)DtcNi z0_)Xl6eSJB`PoU$mL&dxEPEaJ&qQn@9Dw?mFmM658eqq4*F8vl0P~~{@r!x#A9ie% zYEVMd?~yqcz2bd`7M#hKm&J8*$$TcVl{nwBR=3`!J7x9?<0iLy9*9S3R6bhEy`%L_ zxipDb*WE0F)N@^C=kxo*#mLIt0r@1+>;v{7Dpy-ioma%a+@AkH<-v6G;Z7^+47hq) zyZ44bX-l)^b^h8WK>EJ70~+BeU^H8$JpAPvEn5hOhnY1hqMsdbLbCzE-4t=ahsK+> z7Tf`@*+@xrq*V8Dgq!?SMg6gc`8t8^;0d)xUM&801qiyj+KLol@yA~9({2vE5VMok4o zS+Kg@hYfreq{NL4hjY00K+A?a<{9BYK!Y&Md(qk4NK}@M9Q9ofZB&%^>UX2Yzlwe_ z$-87$IhW9?H;0?3SFWd|datweL}+6w5CHf0@czvoa&6eum8o7^yqqqd?_pR`*=b1I z4=4HIwl?|V96uyR70|{G;c)p}fN?@KyhY7<8s>wMp)VQ`=edQ(>$?Un5>m;KD8~eY6oCYQv$6s}05irb364>XO08?RLyn+E4}^$oB%ZG=Ah3B)fQGU0TtZ*M ziqMMiGlK>e%K(t&B9RxYyq5=qw-TAZOGNQ(!XV+b8>Mg+C&o4V>SE8Bwu2XlHSm zraC^+MUmED{C;_QLs@Vyj@&TD<}&UI!FPf=mZwHA^_Z;j&tzbN@JUMHmw`LZhW{N@ z{?CVz$>(Wb5BH+p{r1}Xrq=aSnUQ9X5~|c z$&+a=og`V6j}H{eon@0WvV8ec1VrSBqT`Bg#4`n_w_-#xf89la?jhKTyGBV;{HmYb zpTi6Y5Kgqp$NX$YmST7Lj4p0m=(Zb~pj=xdZ~jOv zmky8y3!wk#Fsp{8`T|UUQw$>>v;zre{*C)|Qen2!>mb*B>(;aoV5$28|C}KY)Ul^) zG#RmBv9>(Wwd~7)+l}p--?9&S_D-`#G8!AWvZ4f?Bmg`huuK{xcYUlY{&f!bM>(ir z93A`bhH-yD#kI>%vqx9a9rVnczVYe5#9FG4$!JnhXO@CcU?0}Kxh{$gnDgn5UbQw&;zeHf-_7yGlHcx>Wbn36tC)6uzcVh?Ed&%4Qt`q4IdPY# z7_1+peXYmO!l0x;#XF) z(oFt4?^dMx29$@|0P2ACDq+9BmI)3c<#nK0!U^UQ8gTnn=h~;fTf~Me=HlkiGAF-L zktRk3CQgj%aOz0P3*1|UWjGq@jDnRyO}On+5-C=_G9ttHz@Kw zY6QEBXfAcjJ<(RM-$H|P8F*v%@iTeTIZ4I0qi=%tK(!Gng=(Bpget~{1^UwZR1JA^ zE;=q{A7C|e0Sv{5F@Q4lO+j?72=);K0=36Q4d68?gFn$bwAzn#Y*~NJi`PW46z)Xc^wC!<`N0&&R$}mGxmbbkPi6H%RR#raQyCK=(>iq1(#j^zE zbwRw%_a>P}zqJ}<3xF!y#l{?_pstA`Ept081kZRbaxf7^=>k5CO!8|^oVTK+u&JQg zWKlxtxOA(DY6~%j`V7xD87Yb8F>l-iD*aV-TT2%>0tlHcs5cxxM#?B^#nnyT_Z;V+ z_}Q8i{*TtAX7wg52T=oFA;w33=UT`Zo5P= zPqih;EUNtIq!p{R1+g3hB$3NPwlS72@wCbE*JZRF|jIs8s{nXGex`RQC{uS8QN>^3c=6 zc6RWhP9S(^^7fYnFK|aejM(d4pt~4wj#W;j+kVG4UH{GkDrLU90t%x9Zu4Cjs?0!e zEM@@wD}w(@?V=#%?C4h@(jBnFD}9%--Khxvta<>Aw~rFu;XF9c^SgIy+i4BYM#M=i)ij5s~y?;Q0M^q z!)6)gF!`UGaPL1ip=NU(bP#)ySMhGqNOWrV;Yn?RB;BghwjTHyzPI>q$6!0lUTind zcDrm-APGVF){@W6?{Cgw8rTkU58j=}(PdP)^qr>7E!BU8V+#LmoG-yR=+OH`bzk}n zF4LM9sza%V2AOxaXSwIK;M3`~%4_F>=U8PGR{JdP6~spPf_so+Rv-j;sh)d@^Wcq5$L6U;3f z4PMw%{WKXoN-5ibo%bCdPRdEeO z4t-*M0VIP<0e*5F11p3*$x$Vo_Er|zqpv1UAP>d+aNp{+90pccm4ny^;}ylJ$i4j> zkx+9n^pE1+4K5c4eHUWGT>#V?;|3zV{jdd%X*T~tzJ5x{G;+N(-!_FGq?7hqmc^32 zw{z_Fl3&yhPqda9bCxcqRDl3C$rquz9=UhzQ$>gG-px->>4wTovtKM&R=%1fQWlu4 z*P5?*&8n9s!Lt_gTMGaryc8ZKbM}5#+-BhuHUO-3wfyPEwF&^Kv9>7cDJ;5N^4?Hz z@GP&h5A!Xt_ZafL z@U!m|IB~a1eSS5qCx6joaeunOuxZq)z9*t;B1=hrZ_Hr+nREn|u+Yc!(IRl!ka6#A zm9R<5iWsM2ajVg~O6CVCOZ{i9kM;G&Ul*9)SgBf%ATUn29BCHoS?xOf_CY0|GiU+V z?ClQnC0@70^=jfS)9qe&FLE4P%m`)0QSSnBNWE6%g02pJR&7rXxvhdz48CqpoZ4k6 zr6%iUi4#En+JnkwU!wY49%S5oeCR z{{{&KB5q9B3*e~&>2o@D#!x~xhKhJ*#%GR$+rs*H>3vzsr z>uv9|zdQ?iB?#!|nVmg01%gaJVeZRsI4cVdB$|%(Q<2*MCH2at52l~5iI+BsL86U} z0FJ1FQt*R~Q{KB7!HYYn0+AVcxS%C+qmWGbfsbot;X8M%p*nwbfHwA8>=kl$@PWTP z6xVq zS$pc#+7DW70tX-}^5l@{Mq{8(2C{ZfEO0x>9$v?R8Uw@cg-l~@_=G_1&74EE2a1ed zZii>Ru8(VsS8h$c&Lhc+#X<50^$YEL-f5#^yz8x1xPiE87qin#k2O7vD?CF#Z)2EN zV`x_k?)H3;oq(KytDy94+|{RMHYBqD7&pib3bM|t1{OKNmi%rA#aGYu6g8e!iy1-46wN0CZ zJc!ZBVSLAlIRh`POM?)}#<+m-GSwhsNc8hIvjqR3e&(j;t!%{<6KHCh5bv2}{0iHe z)g{R+N60Ay&qu7>H7h;l?hc4lwpLH^Yz+ksCgX-7&}ISMY$n&ca4u^|2_rO6q!^DN z3m{&j&uHlc?65-a+~nzryLGV{Bz*H^GZUZbRe;!QiSs*V##f1Q_Dl7dL}rggER9!Gp5+I92vxtedh-nv)-zGd z75(5ki01+1+y?`Ao;}cZ$BF|Uf3U6Nn$04A@uxej&JoQ1ONRg(3tlB;9A=*Ch;KKG zi7ncBLGng$y>kAVIQ-_zR8h0>@^C70s*mVTMvIG(Ha$2MCQ!n6!t)C8#nmk(#k%?v zzEIR5^14`n|Anr{^O#C}rf(z$0-m6;TGRj1|6VEOF{=X28I3m9GjTGOb6z2I94|b! z+0#`^F8IU3u3MCnvXO9t{=QZ<&7$?W#B1 ze|CaY-jnE3w##f9WXDzeCt@|x=e0(KF+-^_zz%0|?uHOW6bEA|4DZ;|?C^~Znh_Z$ zb3jsqp^=AUmL1;j@P(s;#L%C&F81)uOcpGX_;Rz?S!ocPN-Xlk72y*%hMXM&|JuGD z60H;_g^er@X0E2eJ-EUDeSGtye{+k{qZf3PLjctnop^Oiq5?<`x1LC@HHuS;H36jA zwy*#_VS4(_M1iHPk1sC-^@1^6!EL*hg#sws2QwP8vk@duYimKtCoa0D?}kAxrpG;I z6e|@w`+~AIYChH-rS;pQYts?9VvcWJ@-b9piy#%0C(e{Hh;Qwt=;4)3l77b*00~c+g4H= zMK>0bVfZj3N-jMkILRgqNLURIc}an(O5hf3anIL8J0ezYH+P788g7yHVB&UX=^NGU z8vVhm>oX%zKkc-7K?5li82qUY-4qumV;%xv`)@Fz^5^L}?HlM`=?L7#5RIYWY%1PH zt1KLh>oZ_)l(!mjy;~#jKy|OByrj@?vv1}`KK@+Q0dz?b1pqj%>spu^R=Y9wlD2IR z9PaD4pG`%gy7=LHx3u97+M)3pu$TKf3t(?V()EA=`YqilWR38({h+H{2Cn<7X3$NL z>XE17^cfP35nYlJlIW+jQMpCH6a*c+q5lAMn6EX5`UJ8ESDG4nr<4tA zb~%6{uO(0*TSvVfortOGxjBIB2&7u(+AM9Iyb zvlZ6J?+V&g4mB~_?Mm_v9nD&Nr}|+B=pk_Yyv;c*Vt;#nNzTg8F0O{JAA-IL-s5R} z#xF79;!80!(VIcOs$u$iFG0yLQEE27k9(1!9GpdNQ(IiTh2D~~Gea=96q(AmOsTz1 z{=E=gnRuEFnZ@X zpQvpxl&gAI?x{7&=qotwt6D* z1$8ES+`0k|OouT`RG8oxX&~*2hHW;VJf3$em{QMclCfgdL`%O|!?iz`H0&NSbFPZG zTh-dv10%6HZ047RSux={*Wqj!w$MIOh`LsBi=jU{EM>)w0jE4T-Gz9B5;kQ?Vd{ML zjjR*5_8o>++XT;QXop#5j8w1dIxskdI!^V_fUCm6(sa+Nj+7oQ8S@rybHP=;x!PAQ zsxK>eMwShlO^UOM3n`0b2?#VHw$k7S9e$n?SY;$hW0egXQ87YnTT-B(g~t2jM5Blb zu4HHvvzqD|hzs+SZIzkbxKy(Pq)DC2dFFUwl}RCH^M*mr;b#%ILI-j7`6<86lE|zs z1uW-Wz-HKbS-AbNXw0Vi2<7k2n)t`q-d|dsTaorSo~QPn=k?yX>UE+mFSGjeWsY*q zsEn=moA86RYXN6NiI`x30J{#CGRS}1PCaQuK?s*>Ua2Q!SOXxVURA4L5em>Wvop#V zkw=MKh=CWd)`moz1(DIJSdi$}B0#5YsFlvYgXA(Vo=w|lAa?v+;%=7hT(Mt{@jPL* z!ViJQ*;#Q>q`~n#$Q4#8C9EhmFM}?oVGaiaamx+mCwiM~()xJB{-#$fbmi!~+I3L}pzmf)gg860y)`=c5a5o=B-yaQn*EJdI zJKd$-l1QW8vmL5;<~nOxpE{?vpuT+=91dSqm*d^_*ztnRvQbXrRR+E2ezDQ9n{=Xf zh!G&{6r&8gJ_u{*o^dhsnulA^9U5l)o7#`jNB0sd4@5rvF(-0K-GswmJTmU1SFR(n z>&hds>)Xyv7ZfAj$Q_YftALef^0sTUWW^xF1n?|2>{vF<1bNkW+C0y~SZ3=%*9?+n zfEuZRlK*a`z8+?+y*Ui0dZs-;<+{sP5=oD++?f2bw-T=_oAj&V4IVA^Og7& z#t5@Vvp&)3PYN`@^I!^=v#g=&n!D9=?q0PK){Rq5yw@BSwdq$|7%9{1U~{hLv6W^I zH$8&qdXl4wknl?;kKJ1t#b?&G8TC?qrCC#WSMC*`lQFio>yZSf$?12D@b&sGsvc&R zyDQCt?DoDSa9JF7IQA!eM(>32SBlzJmJbC?8vwT?FX#E=d_|b|&Wn4ev~{DNO;+03 z!NuANDAI8h97e$@pB4_vG_E%ccwMmi){4Sx4a0$F1;Ps#>#eng$sA64hu3D`! z<>$0HuURM?At^tZzxdvbx4#%iq|65H4tU6LEt4BilL!f;uEpXf=8atcxvgsdv8}|g zTCDyi%sawi0w`OJ0og2KN4?ziSjFq7Eo27w@tz5Ix3{eu3fDfv?;>bW=3A!sOUPG- z`>EeG_zLo?AJ;;o!j^i)b%*fM?&;oa2@U1_HY>)2o%OmM8z}&=J>fTMKP8%zF?!ou z&fVrTjtQE{nG-jV2nfL%UerJoqHpekzI8YuX9|2Ij4K3jIMLh%-~gF%<~T@tZ!!N2 zwzI_L-qS*cJ7$E9(1haVpqGi$W;3%{2vMWUQ6RDvmqT}3@gw^K7wn20`Fqpq#9V6s zi>tE?i@I&MKHwlRBHi5}4bljLfHWAu&?TibQqtWa-5`Rfba!_RAl(eDAl><1-1oEh zyZ8R!;TI1MocYIjoolV%qHMAJ-^rn;<25d-jR_0T6LWvmnE$C~JLVk|d4U7wBE6yVxV zx!^TwhnyWo&a>GYjc-Bi3*9i}&V|9|_q1E(rv?I*R=@hT>n^_ZCp`nzS?ALz@(m858D8G!J1ii*G{YUfh|BtWezsFH*FpjQ-$SW60OG`*w8lRz3 zkL-(d#bNN^?8&b@78EcYH&->ErEA{@0O8$P<{!9a?c{8(K8M+nQ-X^sVmoxr^i*hy zCMZJk9v(jhR|c6RT_BT;=LyLmQrMwnHakn*@Qn>mW5jGFa6 z0TsSS<*6Z2RFsIMlEdAYcVO1NN-p_xIwB(L)7#p3BINnt)GscbYmu0NZ>Nv8Y+r$h zW>TY%2`2xS2k67n6vI#B?+>HC6_;vc|08{*WzbwWR~|?z;_5SFbY;Ep1YG^)96y#L zZdz{|D3H_l<>uY*^@-bPOEmkG57cgtN*T}ZqSF%AhndfRqwX))J0yLD?B8$uIZ3%H zhFlRrCdg%BDV~1kk=Fi{k~X1+ZNk1O_S3@C#%p+A#2=$humkngC^ldpzrU{tG8PuIxiS4Ej8D>>v8Vhe*?oQ6+`d{4abkyjW zceSK@$_H<%TAdtSV(1e8UVmc-PoFWYS!{A|us-#zX%lE^#|$ri zys2I|jl)`;d7{RlQDjz=chPLzbha=J8|^x%F_yjc?)=o7@RVut#b}jL{!P-`mT?7v zpym%rcbd1|0~{K?!!;dux~!)63$iQe8|$Pos-DU+dp&@nwt|OU<$a_tk2-ni^w*AK zzpMMgW!vhoB>jZqq~Ohg*1%c9TOW!Gi<82h%cON6a8jL(Mefjf zBQZ1c7Ij!DldR9breh&CnoSDqJWa_ZoD;R+Ve1#3 z;T+R37B+bXU8|bZMz{;V7~S_XD)lz zvk5`m?_&2)$mIS9VhE^z?VnFaBrj#Rw|$=%HMzZe!b94B@Sag$FjFCbukAsvcno0x zE$ub>+)cg#lcPxH_jsVE5Hn1fP*Q0>b3bKA_iVrX?pG5>IIeWBaDFuUbB=?}5GC@r za%|ovK$4bRtOweCYibgYCbVfzUA^GOqn^44qLM8i*#0DWB7J-l8P3>tjLoO+~`3f>uNXaSb*kHK(-1}LB?%wpb`aaO(U2vEy?)Iv3Hu&+7zDi3Eg=;9~LsN54 zGEhX})aZLQjm@G!P4>z#*r!?^!hMjQTgA|9wm}>iV|_A?Y@B6Ul7x()g6XySOiU)J61Zqv}iaAMtb-KaMGLZg653Dd{np zT!YZ*GM)`@(-g6>F`gGAOD&86GKe>+`;e zx;Xfv9)_`eOZz#7{Z_Z*1~3C|SM^Eu)yR`Nqdi@PzOg)XtvB{L;tfjT?bKnM$M)tT zkT&l$S17{~D)zfk=Ri(}RCflN)=StM4RA;zr{7Jyj+KhNCM*+q((GCK?7XY0XMpYQ z&fMICWaaXW;at^+DF@Y_n=E{lz<2h#j&iWDR+Vep=KLbCi)FO-n8;dzFsar}qj&-SWanV$1bA0?hYx&{+ntiH zT)DNJU`Y8?Q;hoJCQJM6nZ)tn_?Uim7hSIj)CuBH@kYYG46L0DJ-9TS5KLk5UQrx% zIeqyMp>}Ij=uI`>K}3e|W;?&k$urmz*DA~Yv`Mru&%#p0wZNUc9HEzAb>h;7H97Tz z`4Vg|xaSE!*icov0lvXe0dWPF5qe~_U6BYL9U zu#X2#LzC;IrQ&pZ-cdmKO7L8s-Aej{ScTxsJNz0?5N`jN!`aR`;7Wl-Ek2LY+c{&F zQrjR_c$iJ7eowl7h(#8^)cJt8tj8_+IFvDs&c~g{9YlSd^o?9!)0Vp-rzd}D3%2ZZ zkv@M7*#~UrIy8N%+pn=94zI__q zs%bwD-q!;r4qU81Ypu()$1;9&A<@J4)Ut8KAu8)*7MLm-o_S9gJcTr0AF}bye)3!r zI2lHz-1>Ea?zoY?(nr&T1aIO{dB{ zrB;G~3r#*ZoJ7gUnf#!mca`B+H)XeUdXDAm{UeJco&iZK}lG#W3e1lpLcssCHC_*7G)JBYhqGTu3=#VCnkG zvX(RQj4L?Hv zew{6eM~d1Mu8?7IwV^wW*J(tGdfutXjkkK>7j55Z!f%~Nw8v&?Qg}=7zk__Xu&CT1 zf3(z_Gi$LQv@1`}%*4tu_+oQuZg~g%-FXlqet|elH&=HI&Ge)%6-0e>{wlxPi=PObcxgpg%H(8-je0x z#(8A&-1mHy>w{rnbTSUM{iwrjnHTwN8*d~wpn5u5RhIaqM(@45Mmqc~@?Cl98uRsC zV#(VTDQ*m=z5}^t#RlioV8ucmW4c<#6w z>u;cVJ2+N+D=NiCsqC@a`Z-Y2qU=Gu?NEiEkeaTN_(lx;A$O zrN%(OJyorED4oN+5?GO?>T{1GB4^89PYVH=fwVZU*IR6> z{-C1Ts+2hZ$)GQ2FXEP26=31rQrYvMg(Zk}+4VC*nMiXDnd;>?JI~o&wrgtc>Olv? zZa+eNOwsEWTLvFfA_%Q>2!bpj4C79|7>$g2% z#nXKKX#e%xDw*`P7v@wP)w56W?joo>trrH2g?NYrmNe_?6sV)L?rmkfc2h}iV98}! z3^1yDY#Dnlx!*lNmHUrU-Gyl+a^6yCMr$>jsAKcnEW+L(sv+~?l@CW7f3oXc-nHt> zA%`O{N%j04=rlZHlEkjXi=0P11-G^uhHbL{P>iH$tWO!#21FPQrhahyBkx53i(MWj#&QlzWw447y18kMQXlAKPT<1E|T;EA2 zya$Kjk96rs_FE|%U~^0`(ef01IRq9!xKdvZ0&4YlbKjd2%i+P#B?(?2<>R0r?t6p> z0?41^aLE`tioU(j1Sj>M5lTbM4BRFgo&dwNwTgQ2Yzm|b$PeH7%(&%K9&WD?p(n_q z{C*7$KENFEd@X=l#Y^|!MR=_DuT@fn-m~7XR=}z4=W6cXx|AGhlX<`K2>muHaaMGy> z+>iew_t1E@>T1r$e{&||zXFNvFM&$ngmI0Nf#ZN%{}oT<678qqBRh%t&iqa&S&3bM z5IGrR7R=%L{D3pFq-1~@Mc7zag26*7V52RSBne!{Mfel`nQNW9vV)H?rz>CND2dqx zKc@U+>`@VQv`kCJLpiKR&eR?g6Njd1>{k)h-ob6(kJ}T`Qqa0--yn*}Fp=((KNTH)?D-t&E#BZqhBgK>F^t~xxyrG@8#Vs(HSdrXNpblw zVdKt_hfc6p9LV!Mw3{TIv@i(XY|cI}{HU+{$`G~U zX*@9Ark;@P}pJql_s=eOvm`e?lZPm(tJ6a?zw2e_jlJFQ)RW5Gh=A^))PAU z8!)+^|AqiX53a!f0f2MY15DmWK2N~J`Mx>*W^!v#i(cdmNb8zDxv9N$zS^PBWWM+*u9-AF^(yc@t@8o%Zf-_jM!U1)kIaeg;v7vWXR)d@dY9k|mcQz)9({MGu} z^E|XQy{=>hYLTYKJXM)gp&4ROzzlN2R&Y8EFfq>w&#ve>koxv(e zkG~G#(L>5Q_Ias1t^Pf0i^EmHB%AhKOawy*_?pv60)EcYwZ+lMU@38y?nDrBUBh&Dd$tU~Qg-caf829ki zKkH&oma)8l<3%|fJvl?CxpNy+qWi8*L~Fh9g@VoD+POPhUD0u zt|iMEQdY+8Z(+!zT`Z4x$EJCC68zsVT4q&;C)|TBma$%x`L(3=YZusJ$ z*A^?A(*D5F!g}ZkDxu6~D=j%0FgK&lgzjvwqw#uN?|p1aecg(LRF%rf@y3i4D1jqf zAeLuWFWi$&nPxZ6@0%~eqqbd^`@6ZF1ZOx+3mqh#4Q@q91UX%ObUwFPGffsK=T2t- zJhR$J9bVF6ROD{v=lPq$(RL?O*8Yr!WP^o+YWdg=Af`Cep#uV=->$M?paJiKOeg$PqhZ1b&ZJe4YkKki~w9(vw@>(Al%2Rc)@m+ite{Wk$bw z($rcRy6G{~2`eefuMOY;2-EWH|d{s}bYCyO!@Mu*C-ySHGH{b4^O`R6nK^ z5h54ZLAJ?2itsf0eM-NF##1Hyc*@@a(`eeTy-;N53FZ{c%F@6Coj|O$ZUZ=7!C%e^ ze~_sryj(K~`xffZrdG=&Ty}K@)8NA%P#e|y>lH;u0DDZ=)F0XldnO|n-|<+O|+F=pmcBKw>$R)F>4Ya1i=$f zv5+qeT473QPM0P*Y;?-)EHa#`%sQ{QEWMi^MJY<=pf;}f8ASPW?=k#@It__jjb+T% zg4_!upAzaA1OlAUiHy-r2DOIU9tOQD)psTR9LRdwX}A6byupZ1+np}pG8FcBZS?YG z`Zi1~x44*o)nSBG54j^)8N@$<*msz^i>!Cu*hIKMdU<5kM}%oVC$^5*F)9?>|F(_D zH!)b)*peEM!elx;M}j=Lez&{AY&UWaoGx@~s4`XFZR~}U3$Hlq(#i@w^gkhSIp|1n zRxVWAMv$_lg0Mn(5NrXM>x|YqoX%mLY8!Xlun^LI0xMUwEkW#H26RRWC6lgC4{8Ha z18fnffDjl#WPsC-P-H&>g~yi@PA4geSC~^v_g0gpcp3_9E>Uu}##TdWu!$D<2}B!- zmn_)Sv;M)Tw>4W5-Ysm!wK@3iZobC=ye3-K|A~ZXz5x6)`hWwxC&gBPJb_v^PFlb!y58w3{)eyfG`Z@N+Y&yobOzOGhI$rbnzFC{lRog-%5|u7-4aMLp zZs8kc;3T(R5Bt+5PNcITLi7;?%7liY_x{nf;t+=T+88dOlKu9QcpR3S%M&)T_V862 z95-{~<~L6`e8!ljW-Ep%t#6;M6E$xP(4tXV;JVi7q0d@}YV}!Bgx~>5#3*_#9;h_VpPb>JBj!Kn#*njdios%?QwxfL-Qd42I*t2_&PtGm8;3Y%&GS`Y zt}i+!kgQXV2=X2i|I_iP=i0&JhfD5Sdv@S;uq*qHK8jAlbpi0B;&wS`%lr>$5NLZa z-bIP?Wq*}Nxq6F2vV@|~emxtfCx9pO(C>Yg(&O@Rq?PqRPXrMs@oT+7@<5ntmq7bVk~*CTzG$E-Ck(CLE20f6S6a) zHGAf*)7Jj1l{w>NyF=f5f}r(=XH|T!Zj&mB7{p|PG0Xx=Ibb1JQLY5y)WB|De3l2G zEuVl;$&F=0+{t8ocvx=uih%Su-0zcV)C|Q`&ujNfz$nlz+2b+WWh+^CLEK8^4ESTi z&hZ3WzFTwGX{#eOgZ3l41sp3}@|kgTb7zZh;3wfqqT)+*divwAA%cT69ZyU7 z1}9sV+BL`W(ci^Bcbv!mWz41d$>*N!x5I6vVO3u${`uIoZ6-y?E|4<)+Bs9Q>?SRi zposuEeJ1#remBql$7atn!{ydMu8Oh?|7tF{xzKw?R--H7zUJ_p`|D%;KM$qWt`E77D39r@)aV@)eC?XJ%LtsqPKfV#I3lWlB4k1 z1t!amm?H36aqB(3Z^RkS=?DEGcB;}@bZR;f9FcvIRa9c^LZ+^he@f`&D?mYAO7hHvCbIv>V+8{e^+gRGU<_7&l_OivOiXufds9NpZjVvjFn^ zSxQo;n3{urh&AFDC|PChv{%K7QU^DYH7;j2R7I(#3);J6-qG`O!-e#CB3EajI&Jk5 z)=#R`Xch}~^RxalKwUl89VA9-p{p_DpOx&6x9Gb1I z^5Ywlexbzl3ZFUrM?fh|9MtH-*Ts}QR1UagiM&JnlS}L1BwB~j7XN$4! z?jjg^{65bT2+cr44?Eus6IhY`H{}q_xbH&$>uYz=y?&%CZE=jBj`=lgNNbsbrnV&h z_4mDw$3f<6%d~JswH@P~me)`|cI(}6zd!ew1QOm4DJdz_RqF(1t9%6^r1`JTG(OTk z&0z?{@fSOKmv_G>c>QmpLNA-LP~hw|Sk z#Sg4D(1ts{xz;i4NXZo7lLa1qxx4kqF|&AkoINz23_@^_ddy(UsBM!n8}I+0pMER) z!(DK!#%0*gDdAjdOFW&KNXLqY83mt>?0|d|-HaWNGs0bp5p`c(L#s9NB3(i`1FXb-C_rAN`MMYAHT|4Oi`HWhuBzFMBk8uA@a{UF1 z^X|;=3qHspn^cRlB1xw)=jB$C;AGW{*VyA9SevIS6xv4_ zfh^;$8i>U6McGHTOsGHS2Y zOKOovB^Fj)_w>#{q_(tSQRDqqIJWh-^9^JX=h_E0@`vp9P`O*_COq8!P5()u zmS&m0u>*ry!Pv*qAeGNNDlIU6gF6-BX!*wlY%kF7d(qgcojCydP4&>59NpS4IRZgN z;GBFYFNehGC;n>4EX{g@v%hm=+qkKYC#fa;e6VpCs!41$ z+ps{Ta;@Ko8Ir)c7K=cpKp^*EG!8d@A1dqp>_4P*O9lycP?+xPfG&q%t$(7s$5O#l z7}!^@&REoTtk3z-Z-K*QaJL67h5Ts)1x!9&KHbmPiIy8Mfq*<-EV&{rl~${eaRW(RqQp8uuqn5 zFp`ZS?y5VDTSEDqdI$o+_3n?)g6u4c?z4kKsZxsVpLt;DV-72!%p$f<4hs7Y@y)Ah zZXhgBZ?e2kl79i2`x$5ozERm%{~C5athbZ9`}tz&j_hA|&-sUsY3Nw5S3B^mv~S=) z#Su)~XH*($bN7d?z)z78Kpy#MUyosc$F3CKRxoG&*OWYy*fn{KbCK9J2IoP#C2z>G z680a^4O>cDqf|@4>4SbqaN5Jx0D}Rbh{<&j{zr$*5U@V+ZWN`aLWeQ!5*UjLqJ7J{ zg8l_iu@z$rc_f$f6Gh1TsONb8;;x4z3A$*w9scs#eoog8&lWVVg#iRr44L#eQ~FdK zyiZAT4`<13XJeR6hD=n&2z9L=W_qOxH*fQxZa=x`3cfLUxC+e6(9XSO`%?M7uRfF! zdSP4P6%X6%?u=%^9|MUrJ`SLo%A5ruvxaAcYfujUc6>mxD04O6YAnAh*;-Em|35rDMo$Ows6d<@BiCcj^T z$t5j&CBT|5>&XWJc9PTL{algvUSpe1H7x(03;vu8<7v+g&Gsqpl-EaeybMRx=ktF- zzCQkSK@%GCmc-Q=*w+43ZcmGh%|tq?ZY@tcQ4(iOR#GY zW4nl9^%B)4IMXwGjez~$ORAJf1G}9%_lupWtDE;HZ@?Pk^S^@G-$Da$4;S`6T>NwJ zEs~XmKuj8)XC?m!_YL)f)LawvURPU_`IV~nKq~)p5ZiDe{$%Xj!#LCy4k?lUM*j)h zZZQhaED-9ZP0JmKz@qjQ* zucN)`B~a&j=!3`~zL8D&DJ@_UD>6dNIUBNGr4IrwC%BUrff(^0M$qPH`!J1#BpRoo zNuL@^0!X*qZ}0#+p}}N{V(O*p=IM{I!SCUmWo{B%;!L*sAt_}vAuf!v|!d}7QHs4+G|L&(g8 zE71Q6HR(5>F?5(x68qXP<8{)FBKqZe(r*{XNZYp(S)RA3KxmG4yNRqhO!K}NFo5A+ zD>?2XU#(ABNN~YFk!UZC-{a ztQPV$Gz@})7Eeit13{J?sr|xYOhBB2K7~s7`8y9d<3*D1Huy26t}#trOzG53IAf3T zjiqbVn|qyz1^@n0TwLsRrKY|KGLqE0I$-nAVaH>>rdf>Ydfx5;u_Kb>VUQLDqypD- zhn@#n8zkC?>=zgdOofzRZdyO1&Vj3FW?zu#a;Tr_kCAS_)GrU=8J*aFq}SiMPR1C_-#@A>-%+k9-O@MnCf)%)+sJ@k(>MUyDhUnLgcNOaJ?|P^H|7X-5{R!0sV7 z(+K)715*K*rk!@*l0a|<%03<-d$7D9$0;mxW)-}6o(eH(r3_OIS+#0GT-YIETOxas zK8z3B^)&2dHl!{TIfcFcgmEshcD`Cn)*~i-^4gmt>Vtjs^=2D374$=b0xa3uY?a>d zZw+{-*S$}(*X`R(k;XBq!D)z#C-e8|PS|OF=|`(k@BNOPU&FrHI{+Rsx;kiU4$4@a zuFGDECNZ;psG|6xWFSq$2*JsRQ;ROnd(8d)OmwqTYckYL?$Pjq#^JTWdnp=kFW69> ztuod3h_udUj_0opzLBj;(hntRwL(8&8U?LWR19Ra&|YJ=^VwKV={hRcR5Sw-+-x5p zgD94@q+hKk*Wov|bmGR1>0_h~7Q_kkwP8VFpZ zwz(_i9vWWno>5FU|lJ_^1n7RWKc< z75cCzDUI&jKPKPvlPZ|ZC-86sRANka+xX|>2w!_>(iYP99#JA^3YZMtfUP3xS(vEd z31NZLLsIEeyLRn>DB`wfRtYL2^d2#S4wx>D=*z?66}6wKHHVo{)ERxckU3vBpa0o2 zTUm7=hSns6=sY@9< z3C+&xAtr~fp11`q5Q-D|3Ok4eE-Y|DHbNQ#I}xDmL)d$9r`5bhv^#*k-*tOGKl4+6 zXr~b{DD25GqS{4}&O95=L4W99nfey?+hVWBI3C;Iax)bp;kJM}{fTS=X`g&$-eDey5_@^f0`#(}o0w3l8j z-+i;RqnS_wG0qQYwozOW`F!y2{^t)Zn2l=QhBQ1td(8elRE>C7(vCyQP$}TZ?$E2I z2`Ngah*2>yAY3|XRM9TMPfp3x9^+tf`$_x(r<$F6U>dh^$H61?&FJ?{^i9aBQ35tHMGfOejoKHi zi7SwO>SILJDG(2uH6?~Q+*D6O4xTst0@ z@W$YWh{lG;c{7`%XWdl5-kV5{j0>G>@RVUa)BCQwia$~tyWpZ5ev2!z8Cl;t?>b`&$x+WCLon?&fgr1D%=5Ied|`2SmVTgKfv&s-8dC5(aK#B7l+UBJ~Q+gsbO8-anCPK}Y5i6^>7D42in zzkM;e_d`aqC75d$kbM}HxHP|5NOuFvp`K|Zqq}`Aek?!I`L}3vYK$m>eujXJs%_Rg zbE91IRrC7lo5GM<6z#X3fQjdCAO*Wis zz~vG0COl)?PmxZphw%}?sIl2_CMBz1vE!^|ex0lBIX&~20vtt*Rrx6U3EubPEH8G1 zvPzA6_?3X^N&Ot~+V{d%n<0u$7|VFAH+!mOs-V+yi$Q2Agwpm$58#sb;8C>97aA@C z+626Y&?)He@~Fj#`0yqK#1ag z_G~XWk)770!G>%r3r+Px*{aSjT-|9bP>TxXa#oU+1ozb1&XV$)qkt&1ztw zu!(*#kDdDQhFS0j2jOxVX-~rYMz)C*WfU^a@{2_aCyvV=?uYw&aJSfLXB@(c z@7;56$4f5NsI`B#KCS$d!#A~|arDZI<|R>P%UT@YUR)K?T>$5}C4*Y{K{oE@z>a_f zfIkd9B)3{Vj@xf2%0;3ot{Evi>xyinJ>y8Uvkq^g%i*ubYFM*(_k$)~2b9t7+Ivcw zwE0meIvmG=Ja!lAIy-~Ua0*{fSIp`x@`Hy$pEKRvt$U`l{@`<9n8?;WXO;O`23JHX z8M(6RjH)3Zs~%w2s~^8e&S9U^+@iqkmWP3v4)LuSM<4~Mg(8;$K20EeEtI8IDZDe> zpVW8v?gQQA$~jAqIiW6WlmWrF4X8ICci$YAe2Cw}dqTFZ{71N-G3K3=Y9Ugg&^fJ& zWZjQf-Gp=l-lsF>Hq0v1et9@(m&!~x3`DrUquCOY*No-;mpT=gjg?E^SVliP<+eIt zKS`J0Reerh{k`3v@{N6HmvN!%xu?mT)nwfL)X}DW938l&lzK?+cu{FFQqb{Od<3;e z*JXj4pgyKuiVc?DBE<^K zQ;x^#R(IDx-j@r8C57%yFmgfvonG$B*GJ-13wg~WecC6FF~i;qXK;TAN7n*Ocg@=# zR-@gu5|}u%T9J&j-wcKIS#UEliiFr7?tuNV4Q;ksoorv6+9-?d>)}_NzOV5=F?oc< z982!J)k+y>S;f?$wr36GmQq_b2K9zEykM4bkU0-9$ou7sMrDCs>H(BW&7TUI!%MfP zf;BkdEiZ_~W`6b2{Zx(Mu{R0h!oThGrYo*2y`;VP`|~BGQ+&lY+UURqkXjr?mD2_U z%|3_l(rcdO2jq2wkM6$OGd6IQ5Z#ziWS~NcwUStflL3!Hh^72MmRtn)+UG_T)y-0f zg%M{&wmP5hvxp6Asth`X~#0UD{td*TmOHQOZg*VezomGk0D`Qir zJ@$Ru$apx*S|jWg=jR(ooFXvfiM~N6Uj1%Fqw?rYmvC-$+q=Q``{`Zz8+$0b;xgsM z<3AK@zn??OpJx-TN`4(oy18Q5Al=o$^*u<+*z2#NK&JQ`Sof}3c4agE!m;Z<6(?$9GZ_bpC3W>Z1x$Oqn0f#+~Xg!iaOsz!$(r> zwLyUzvD7XMK8i>#EjWy~phz1i`C|L1yb}+!E7Aq$c9JM+OfVG^&>wXX}6?Hft-g5 z`5F*znundULjIOCou;;3cB9?wEHu>MGbIachLe9Bc_aoaswnz48W#{I>)r9G*#jkz z=~#)WX)6--#fLXvBiPn4m)XCUx5{NHw?B!sjzhFc6d7q_0csS^j#T>!E|f^x9bhN( zh=?|KU@NzIc&n7FREcrygXLJ`cV*xg@?56&!q%c-;yGP(7~rt!nMg6u)cT|GL!!i< z@uY;M+P7+p+QimI)#LVp*RhzeZLew1SFUW)9JW1^cnljR!bkV$zy zk$NO+hw8`A-)@&CV13PcrWJ)06%vtmtYx0D?#y(Fd7aM7?qdRx%ZmCIM?Fvom};UM zDZ~{6akoizoWH><$Ym7|8n?v~vUdHfYd$d}_nMP7F&g;tC8Dm5SEC?y7|WjxB9giA zT1{FRhHNUMYQ~Sa44UUZ?#|CRNfpk2E>+V4_&|SkkpP-&38S0d(;)_o0ZXPlE7pAd z0Ly?NDZpYg#>Ci}$JS&h%(={lURWD8h&*`E2VFidkg`C}&(HFjt#e>y@R0z|`EH%% ziw})XfC+Q2=8V7~*8!QRV!COi(;86?xeNqkrn;;zk$T7i9MJoeT+8g3M!2CxkovwF z!vl(@^PLvrD`~5oO#VsOS6JCH#p(=5)Khp2OBj0mUTSHX``a7;?G<|lI8C)w)U3>IiT_KrCZ@~jqD%S0pDf%qx)9CpvQ>>%syi&}B@U2ZeR-*B`1)Lv@HiKE^?>TJJaHyRQV{$G;%lq8UH-lQ1cASy=bV$e|OAmY-u($?12m4JPh==u{S&L}UH zeyZV)*lwJrBx*fyf@2T+swuYwJ*P~<5uL`2MphOI0$K3iwr-E{+Mjv9;2wUtmhT1G zckoN4&E+N<*FkEzfxE$%&J3h9&gZP>+Umr9*Y?=hC&zQ4q|p55yFWI!VA~PtK{o+r zTR08(olFwF&pinKZ>4!A#iH+dkHqb0DX?_Yi=Mbi}y4TfS3=R&t3*xq>y4k%b^J8pxVD7yreES*#MzRTe z)U2x7n!`{YpFKcw$C#I)MRKQ}0`+-hF!>7ZFm=q(qO_fQ$z-EOx%U%;DvX^Q?t4vB zTBA5n6c_c{qIMTU&=Na8>1`|dcTQ&~&iY5l%I(E8Mi(`X(#SzpFS8W(3crNMCfY$- zpa~uw|J-?pcg)(-Q6RCt-Q4qw2faGmu28$?H-b=Z@iO#?Dxo>~3x8Tp9;Qnk{$eHV zL;m92b>(+0l*b(OveA5kOQ#LJ9mhgn8c2t zEzEFZ^tcyK(CCCkvBGbbx}B&cSD=iS^`O$D&I{u!_GM>nSH09!Qol*D3b|(vb_*aY z=`Qu>P=sF5{yg5987uu7D}-^+9&LFSsLEw_uE*UB&g}D>qgf_hTYBB^B$3Rm=ttJE zDr^p-x5QNeaG*|1tHMt*n_h5)7}tUuMJt0V*xvZqAWX@TufJlPyxNYwm58# zw3Ff>+y5~y>{Z2^QZS)N@GfZxS zJUs*j0z$!CLr&x2>n71u&(fEbo`rN>OZuSulSJBe=GKjLN_^kHdyL)~VQO3#dS#E@ zP3T3!*612l5Vv3bcJ|K$pP=oYdh*eTG64w~If|H$^Z{Y0kiip#egxoA#XS8o+^*BF zL2kYz-jmMv2ZdSeD$%w^8EqTSv~IdV0U7(UR4e*^CA-T zBYDMbi?uh2F-$yz{6a!&(9YNtbssEvgrN=ma8my~eKoQ3IjDqyK4HER-Vj>gW9 z%DBO;h_{L~OsJ9vv2z_A=ELsE5;;0dGVq$=;2oh#F4f^LkUv^~XRGp$7?oEsf6y)d zb`ZnXGKf*@Jld&n4u@?EHhmb0O0HpJ-)8aaiBE+>Y70Mp8FfJd7#`Y0Zn9TDmuZJ` zX<#g8hTJ#4#p3n;sg+s^=CZ|$Q;|?9WnAPUqMIHmS^4G9d+ykUsz9r#6cD*x(y}-a zoIrhBvKm0%P3g>H#1m>Nm`HaX&bW@&mKzB!d8f%4*eExT`Dk@=w4L;O_SQ0e^Mkm9 zs6&rmDgjgw7r#^PHd(8FRVzzVD9hxtMa)cI@nu!73*#l+3Zu{vRr1oEFIeITapVHU zPDgf&a}$4OQ(8-@tiYQ1CV^%%PmV0X_YrQ_efji}66U?nkHWL=*kd&#xvtBG?ws&E zsl#8_${vOXT~p`TO6D?+X8jVRgKeVK$OuWY7;TH($O|E^5+wfE&q%lQd8FSa(EMc= zcfghowWB6zZk{(`pT@QEXfI(4;;rR6aJ1a$J?>%`E64vnLgeiIENh3oD*Dvrs_uJIhStsaz!mB}PgIo6abjlqQec)_Cs++|U>H`V@VkRzlHHKEZ zBcZx#;Oh+Tq^o<|9usg|1M7G3ZimZVdP_SU`YK2sF!GJboW2aMurCZ2^*uZfzY%U{z zxW-1)!CA*kE$G1qj<||;1%~L`In0;B4cX+nA3UKOh3iUim0Eh!aL=-~-}5KV4*DPG zkDLg8&S~GS?d<+o4&E&HmRl=4i6}_pnFteYbL-c3VH0j}n#ic}=9VFGdFB(YZ>Gv%qzuZBryurVi!cmk zg6{$kgR-T6^)6kpgJTX0UlL_q&re|PefIEf=FdX3JlHXw$5bEPJ8BeYox|Mp2rBXS zN;gMm-WKWBvn3|i6S#SLGLw-n$wMyKzCJoN=1p`}X7k!%Qu(=^brm*nZDwvu*ll69 zxU6!ezCLhy_1FB>4P6Y={aZ-KSJ2#LbFHu;pW%7Q3` z$w`FFvGAc9M#Sol5v21C>F-?L*Nab(g~YSlpxS6AdZpY>kkzei#mNg~+uH!E`2gdD zY$2l?y#B!9=(1LTkI7CI*2(yRJGR33QCcwf|oXT#AQkR@hG?d4y&R!LBvZG=nvi+;gnizjktRhH*{u83 z!gK2_lI5H!Z3=C5zN0fyVRKvG;7 zJ{RcRV=Mkvn<-sN&D6?nT+LL*kMF_`fNxHIg2f6rmeai2-*@ljrZx(rrkE`__2c-q zJG$_iK)e$j=;1Pfj+{NQ&xmbN10~n>*VPTAGt>~oBH^QU0chX#=eDN9ng+aaQi)cp zvcOk~vE2#mO+`D^Ctsr_c<5h7^PO?Hav$Pwn4j``{#E6F1CE%)o*kU$9%+DYuY$y7 zjPVgl?WjT^u^;2hWYf;g$$WayCtwIY52=I;x~6a!x?== zL?miyE96F$Kb_sjzBQ8}TAZa{YiG1v|0ELSJTJ+>^xHMlALg4F|HpPKf>2HcFp3q? z$DCX^Y-j3g3W_2RCB@x5l>5g&R4D@L6-7oNknsb7HpNN$$@KdV)V5B}?%g%k%KvNc ztD~asy0&QsP(lzyq)U-dP>~K1R3t>DJ4K{LM7k6N6_5@IL8Kc7h6YIq0f%mehM{NZ z@BH-fx#M~6`@7eAzkj~9Uf28q!}8SLXP>k8x%R%SXsPH~8QO0&+BK584Me_QrfsQB z&lZ3(U7`WI{MTKYM&@e>4@%!n=XLCced6*)ohX&n?IDFJ*UO$0SpCL4{(iPg>`gP= za+Zx;KDew~?3%7p^ZspYT&x>wC;HyhHVUmjfuefU?)g~xtuep^66~~z;$Z< z4bOp|;UFd0GFGHZtp^^KRu*wssvIZT5S)00bAu&e=P2-Gh)ClD#Z(a8E<%KS5#UYE z$)aq?CFf1v_3Tm(x7(=J8bsYv9fvpC+}vX|W~ZEc8BNMNBmuz9Hb#Q0q8sbK*q4)!3B}ns`R`@zWCsq(1VJ#Z3C$g1$vaM)-?0 z1=^94P4JQma`9^B*Rlj`Cd?4p;pIh;c3O^#s9%MFq=-r@d7Uh@e~l-{!5MSu8iP24 zZSkvNKjJ$cYu_V1MBhfEpDwriGl+0zZ zF)RqS^T7!Y@YO5?Pif`S5&m+Iv(xN1sm4kT_@4`Su^Vz%F(ngC0=QK3DBWceXMD}# z%_o{gCf`@7Q!v?DMe%k@wRf{?sPgP^O{PtvzkO6t7$L$geFiu}INh{p%^M*QdiwST z-pDOWA4D8*UvrQd5ML`(V#r8go3I(pso?>}KsrJ<#Nu{_eVYDE9Hv@Dykvl|#cg|A z7!L*#w?8=r3N}7nad;G>k%12gsAdBg&mzam$nL(x>BM7;>?I&&hwa~5;(3i@IO*qq zHRU<0GwYE zlNNHH<#9x(gM|PEsrASOKRfuu27!!Q$JPF)y8&w;3v-F1dO9oq8VirTErVUBmb>vT zWr%CIDBRyfXFjhbz zQH+Y_+lO(XD>vUdPI^b*tv4ec-W!a4=OtsTbHMuQ+*Ii@`va&>Cco4%vw&Bb?f96M z`COvF4&ypuO|d=g1i_Y!T)iwq|M`G#0lfj+n%O4n0quAM4tNc$Yx#Uq=UB+8&dJ0Z zcBWdF4mLrxC?OVyE62Nu$K|q{`Kyg80`*eWFUSak$qf90@a53n_{0@2cKz7-?~xK7 zoiK=NGI?{+((PhL?qxOo&8C1SIVAd@3jfrjm%i3yjuX0`5*a~2m=*(rHow)@UNUq6wiKASrXiPWpGVqAu zUaUu=Vb!u~vOsDc`zPGM>*OX)!S={i0>LImvVIoRqNHeMngKo2V-U~1FU2P6&bO*M z;Pey}$Cl?s8iC5XT^0ThbR8#wvb>7qX@SO$W7-v^1kFb)~6I(7cc#wA&kXxDMkqli6k@4Cb$}3-^>K6hQn6*Pu70v7D8>+dZq5SH z?KI;OvNu$wWqqWj z2p)2Gn$G4`2^{Y}6f)k@-0Yj;tZQIJet;k^3ysr0l^n#ds^u2xV)?I43E!af@)0gn z|Bb{3*<_UwhUCbbe7qS2+2#c~Avlttn&6yGpcV0nGlr6fTlcvIxlh+pEm5sZ>n0ic zE62^7%xBr78iiiq#_vxra#o%RI4w>)46m$zNE^8Vw=-sSXbZp4`H-d`#Xa84`q?#c zJX}T>V&)tjs55?C4PI#4DTZ#d%+~o5BfQ!)<9l}^l!V9J;^;-p;~B`@7y&jlh~6}( z+Ihr7EHO<5>@FV4mPNO6((@0@s84mfiA*Y%d2U^J=v5o8nAcJ=`hplEv@NXhAW8lq zE8ZY$ExPjfaPHVA3|P%2NPGo4tBzvmO2{B3F)TC(+w>t#t{DoB~I6(^f6d z$#RLEfrf}V;6yD&7Wt@jYWooPYcH+DpH_EJzv6((CUou8rYD-S#_5hfUFQHuiVQmU z2%YD$bt2+Ryqu+wJmT=qxm}fuH06%SSi#Tl@U4tK6nXfKimWOPXXi6rc%LQ!q`Fml z7LhZ}b(ehhx<{^%VT(w4%>gPeka^^FP2E*MSe~};`IvBoMZnFF4nDHmt0E;~p(jvo za%2EvvJw__&AOhA82zdj{sNB8$Wy}+WwgjuL|!}pY>sNF=1V69)M9~*8yRg;uJ(wF zl@eq5yU`N0{K~Fkg!zaQ-~!g@B-(%4eBi{1ZST>DX|4KJ(l!3X^=VM%$EkU8 zr+$S0bA`t_evZXLGUD9qlb6l~YfQdq7ddJ-IF4nwzBO{%LyG^5)CCJ?@re8WZD8va zhe@l?wdc4!(c{N^`@>dJ<&&#r;@~<}p7#38Bd7@Wp1DE7*$>8eT8tV`Sjyr{o{_hJ z@_oquEb0I%=}J{EcyN*l-@(W>>N;RgMu>5%Mc6va!%fzGtipgWEAi`t97}V*1Gx}xn zh*<~2w#tNb57W6+v>G+yY*n}1Ijna3TNf6OGYn}u5 zJ$mgiRuMuvq%+T=jB`BL4JJ&Q-u4spd&Pg&W62`S_|Qwf~9p!WlFJw1RX_t6GAJE_!o8&JrI@3 zc;wyEdFqx`sMvM2jk|RF!QT3&7)W^SZ6)ezOt%@ZK9Nhf_C83;@W5v}j59tvX;wFJ z!uH(pO!%+$hOc;l7wYVHb7UR(WOO%~HkKnLKVj(8Z*H{h`dCpOCDJ)~%X-O=xJ?`d z3=m6B@Ev8^7x-my9~dw{8!-9=;Gwg?z+Hy&34@}%_SxN@yrMoNI#fv0OX_y+QR!89 zf8buvuUfyd*1Xg8aBj76f1m3azKoZnYiepc8#CB5K%B<&f@29w+Pr7Hzw`vc?V!SQ3g+O#xi^ISGc$1lmAW({0 zRJ*s*AuA0uB7^$?O(Flt5k)ZyLp$@j#JXbT{gU8>h;AFxc!tyqEF`yvk6n` zUO9Wn()bX2G*A^mnZqVI3~x#}oXH5WM_+10WT_;rHmS4utFgvWZ_swD2yi=`qib(; zeseMAxsuXg%f(N6R$sbo57GFOUWYqZ**octuN59!v@3xt7oxY}3%&F*XOeYtqw(2- zQ%HSRYZJXY<(gz$WzR4HOYHUiKiEf}W0}tF@6%A%S_-=-IqlEzr=wGCM*zpYuALE{ z5$zoSg+DJSBYfx-jygM~Ktt-Yu*9~CcX)v;$}UApDR%65;)dhV!20YFAsKtr&QkC2 zL4|YItq;{e=lfnt1FVA84Mk_mD|oR2+^!#gq>l0ByahDz%2#lKJyBW<+YY$O-3=c1 zF5@0#q<;`ZMg))tmgo z3QoRS5)Nm`k@AY@^L8=^%z%2`rBLoLA!5s^X04vAla0!VH0a6Dc)AL+MM8kxeO{`A zo;`62KRadu>U(b3waL)h=haM0_xlO^Zpay!yt#Tp=1Ms^6G78gZD3qVgps-{?#t`k z9WHYQhGUw00N}fHG_ik8dY000fR&iYdJCXw#0ugz zw(7QWKoq+g0_&*fn@&f~qX2Y%x0LxBFBf&nN5sMXczV!UH#P znP~EfCt0E!HIr&)_4^jk3RM8HglHE75idtFTHb&WZrwzw>a~=5Z&j(InfnF+rNDyc z#MXU&6D2y?Yb~Sw!Us;cDxns>q>`!DPE*z zME$d7-J9k>?hlWi)Lt>cw^83NnYe?q)Cf0C*PV^f(6>hhV0oKscwIQMbL|bhzQD^K zz02a38Yf+t1-y_?`3;|VT`OwkiaW!=+gE;XQY`X4hz{GSFJa|t0Ma0V%-bC^+7Afj zzwMqZlMUItLC)>wUo^^`xRjRNwK=Sohd!&ZcvByvbjJ{xQ`AxZkso%1c09~QEHCS( zJgNE~S@3=E=9RhE`2Dv5-#P-X>%+0AaI)Fr3P2j!Qr2IkCslLY|qma64>WyYoDlWg=`UTd3ucvLOUOQw#HH} zDvq#;_t?-JbJ632%>=I%v`lw7V7(n984Vak77mr4U7uSYd;^2ZS#y);zVy_#ig{Eo zE1C;vtV5K$#R%B^3PGyPc=IZ7ArjM++*Pv-hL++H7|<673`;HNL$10LvS$Sj0nQ9ZPZm z220na0^6X|dm6gQT@4jcU`d|z_th~UHsUY-RTB;!(y4s6E3ogQV z<@@VwDrmtO{x1uDFvg}|#zlp5O3}eBKto6?iru_dN%*9VH>D$RO^C;-J`b1K+Ma*4 zR)vaOM}DZgd6`(#^%PCGUzY)1)g*CQ2--3GEJFY9=*FD=)@S1l?j>`h>X^Kx# zh>zD_u5r_@w$i=b9;YhS##y`i&YoJ}8X&O^*6lfrPK*t`Ce4*1p#B{@&&AqZSmb-$ z46I!NwXs6*nMpj&p7ijzc@>L}Skz*zPo-+&r2oQo+<4an;1Iq{U>7Hr;;kqkBQh8i zTPeP;)v=CA?qYo|5IM9Z!P`B#k2rTPk>Rp3<#JTQ6`;4-2xk%6iGXq5^H{?MRHM{$ z;3l8IgQIKKGnA9s<7^QU8(-76u75jGd{kY4qj3tC>J|lL$kSha)(+$Raggf#%|Y6B zgF?d8Zb2rbT^7%}qpo!7B}7z~5D+Z=rnX-F=#Iqu?NBRF4cL-gbUvxjSN%oSUET9E ziUC@%8@J_3jJLl}#WzK0t0E;bWhQc6XXB_oHpiN^*T6EzAGbd95r`}IWtXi|03@~=GhX7r z04dhC#^MM+lxSG;5Z--5jMDzrRbmLwF_za04^4eUQ{BY^i`Rmf%d6aX@< zXsS+JP5VwDdF&QLFJ@F&Zn9c=ORq{<>idc1<0UYuzL&K>(Tsc7K3{fT8A91Dp%Hn5 zhKJi$y|7WJ?B{o|$TnAHABGtH5Uk5T73_oH+LOYg#(Zy^Z!Rvu_id1zZIr#M&DQK- zjT!OsY6|+w#a*@vntd6v3)^@)`!N~m@iY*CR*r=MblKVDs&+B!1|(PAe=66E^WI;& z#4VZzaALY7k7ZSDVPo0*PXaRT={v9WU&gB0RrV6&6Z$4*A`>dgeS+{SjA69Gg{3J`(AT4nM)i}v;Q$PGju$WKuE>F5+fGhME{ zSW>(JDRt9>zw&dgqcRMA3cexWuZqk|0rPmbJ;t^Y1e9|5t9+6N7cIQFwcra-8Lv{ zZDROo7LzW6en!rq@2M0x{Lm$(f2vCrl<=Ls@mR8K+cmqPIc~-TMH=4Nh-%KY$dYJg zvz+RJqn!n*qiLz^@6JIBE{hi=6`>pU$y;EBiQFYIr5L5xde3us2_W8EjsQ?~sflM54HPX(0T~ z70B!|95XJFOoNG@>-yA9Pcq^EIa}_7=vai;C&jZby+p@exnx~!&DL*V7CUEJnTRRBybnxa+blKURu&1iDcX4pTnE3n% zvj0!I6_TDvld3VsH`RXv1>0^}DS+JRIc_GpR;xaNngpjTdLz9Le$=_jLhiY1biKA;T8rO;Yh}R*H@Z%4BHX06S$kB<~@`LknPo77y^A?pK`Z zhO22DRJgQ}{42M{iY-Tcv4!6}{B(W4=0_!tntRm;+gW)}lG@2SfDsN7@1ajWsxKF3 zolk>qp_}0DS-v|~{sF544jFJQjAtjAK&kS43F+<&bi!2kw9n13(wEp!h0?f-gf@u+p-h4czW`o*ZJkF z@4nwdf$oUb_vb7rgJWjY!24_nD_-xXu1nM0N`b}CkCpeM@6C~4Ww3@DaY$V>fPy?0 z+f{~>DYxDeZ|#@tKJ2>B?((C{N~p^*=R9sZ9VQz?=uOM2G=Ux3`VQb3klH8X|w9{ z!v)T@FHr`fQRj9ia2{ z$fvKek4hScSrJrr^PFGDlEiazEgmc328 zd#m=c7#0;`s8>oZuw|lOzKw(8$7$o$1ZzFPZ9MDE+#dv`#8AbBZJ8mkD}vr)wsB^q zqvlKU9&!?Kus%P?NEjlO1f_wXiS)x_qebz$YSy^t=ne{+6JbN8fZ-P`JNHv5t`^0H zx{k8Z)kd`E(UO6TDp!yEr_uk_NCXQI;whSkuVCPi{rx93yf)6Z%33ew?p2ILK1+|R zkK&H_cK9v*lA5~!O;T<_GCueFNb_}_=HEu9N`-f-_M*?dh~Kve{VZKUqU-Vfs(DY} zxZGJ6P<#R$%u6}@zPCKmYTPy!(vgd<@iCsB5B$*m>1Df4=noOq35(RYRG=Ur^zruc z`jOZTR{Ia1qyiH0t+kIxVJyw&Mxwz6d_-w`SLFW;AOQXDA zPfMa5G()S^N>m`7!QrAUu@+O z5yiX(_5tw4e+^#y6lhv;s3PhQ3IfEL8eDsP&~*$pRsX1+Nvat)Q-6oHFNM(fZl^Qb zuDt2*S&yN7XuCBXx>{W|lxv zq-4!&D5LqeW`jVpFGBm>0R;RHEwg+fpykyy1)K45URA-BM<@s{h-Vsh zxo2A9u-zWd6r z|FB@G{$OUsl_VuM{x~sd0=2sn>)eUgsI9%ea&}41X_rs$3~K=mhe9v6?X$jL`L`OH zL+8z)C;ryKZ-(YylIHRTrLfz+B9`=_1dCXFF|-A!2z-Awf`{w30dKQ{|1UY>r17i8 zUrY3x1pwc8^FRt|R-38+=aK$FB1w|aio8Os^8D7ppN9nor)matFzbZo_n=>@^KW7Q z{)fI-V0rfJ`t^QW@;_<7k6$zI0=!!UZq|#xpTQnv#+X+tvi>ab-**`x9YJynCr{Au zp}^nIfEmnSsX@>A^nYEhUtfL}1Zwt>D0}hmXRvq!%)lMKl>1-S>erD3{`8Owh^o!& zVb$Nyz#Rr=K;b<4@b5*{21KPnpPxzhYp{P1_^&TNQ$QPKG8ggsZ$= | 0/1 | 后续可扩展其他解释器。 | + +**注意:上述启动参数实际由各个解释器进程进行读取解析,内核并不实际使用这些参数。** + +## 特性范围 + +本特性于openEuler 24.03 SP1(6.6内核)版本支持,需要内核版本。特性支持的解释器类型如下: + +| **解释器** | **目标文件** | **说明** | +| ---------- | ----------------- | ---------------------------------------------------- | +| bash | shell脚本文件 | bash进程对打开的shell文件进行可执行权限检查 | +| jdk | class文件/jar文件 | java虚拟机对加载的class文件和jar包进行可执行权限检查 | + +社区开发人员或用户可基于该机制,自行扩展其他解释器或类似机制的支持。 + +## 接口说明 + +### 结构体接口说明 + +对于每个可信根实例,需要定义如下结构体: + +``` +struct ima_rot { + const char *name; + int nr_allocated_banks; + struct tpm_bank_info *allocated_banks; + + int (*init)(struct ima_rot *rot); + int (*extend)(struct tpm_digest *digests_arg, const void *args); + int (*calc_boot_aggregate)(struct ima_digest_data *hash); +}; +``` + +成员变量描述如下: + +| **成员** | **说明** | +| ------------------- | ------------------------------------- | +| name | 可信根设备的名称 | +| nr_allocated_banks | 可信根支持的度量寄存器数量 | +| allocated_banks | 可信根度量寄存器算法定义 | +| init | 可信根初始化函数实现 | +| extend | 可信根扩展函数实现 | +| calc_boot_aggregate | IMA特性的boot aggregate值计算函数实现 | + +接口体数组定义在内核代码的security/integrity/ima/ima_rot.c文件中的ima_rots变量,在该数组变量定义中追加可信根实例,即可实现IMA特性对不同可信根的功能扩展。 + +### 启动参数接口说明 + +本特性涉及新增如下启动参数: + +| **参数** | **取值** | **说明** | +| -------- | -------- | ------------------------------------------------------------ | +| ima_rot= | 字符串 | 指定IMA优先使用的可信根设备的名称。若指定设备不存在或初始化失败,则回退到使用默认设备(TPM);如默认设备不可用,则无可信根。 | + +## 使用说明 + +### AT_CHECK参数使用示例 + +#### 前置条件 + +内核版本大于6.6.0-54.0.0.58,glibc版本大于等于2.38-41。 + +``` +glibc-2.38-41.oe2403sp1.x86_64 +kernel-6.6.0-54.0.0.58.oe2403sp1.x86_64 +``` + +#### 操作指导 + +可编写如下测试程序(test.c)进行参数功能测试: + +``` +#define _GNU_SOURCE + +#include +#include +#include +#include + +#define AT_CHECK 0x10000 + +int main(void) +{ + int fd; + int access_ret; + + fd = open("./", O_RDONLY); + access_ret = execveat(fd, "test.sh", NULL, NULL, AT_CHECK); + perror("execveat"); + printf("access_ret = %d\n", access_ret); + close(fd); + return 0; +} +``` + +**步骤1:**编译测试代码: + +``` +gcc test.c -o test +``` + +**步骤2:**创建测试脚本test.sh: + +``` +echo "sleep 10" > test.sh +``` + +**步骤3:**如果测试脚本具备合法的可执行权限,则execveat返回0: + +``` +# chmod +x test.sh +# ./test +execveat: Success +access_ret = 0 +``` + +**步骤4:**如果测试脚本不具备合法的权限,则execveat返回-1,错误码为Permission denied: + +``` +# chmod -x test.sh +# ./test +execveat: Permission denied +access_ret = -1 +``` + +### bash解释器支持脚本可执行权限检查 + +#### 前置条件 + +内核版本大于6.6.0-54,glibc版本大于等于2.38-41,bash版本大于等于5.2.15-10 + +```bash +bash-5.2.15-10.oe2403sp1.x86_64 +glibc-2.38-41.oe2403sp1.x86_64 +kernel-6.6.0-54.0.0.58.oe2403sp1.x86_64 +``` + +#### 操作指导 + +**步骤1:**设置系统中所有脚本文件的权限为可执行 + +```bash +find / -name "*.sh" --exec chmod +x {} \; +``` + +**步骤2:**设置启动参数并重启系统,添加的启动参数为: + +``` +exec_check.bash=1 +``` + +**步骤3:**验证只有具备可执行权限的脚本才可被bash解释器运行: + +```bash +# echo "echo hello world" > test.sh +# bash test.sh +bash: line 0: [1402] denied sourcing non-executable test.sh +# chmod +x test.sh +# bash test.sh +hello world +``` + +### jdk支持脚本可执行权限检查 + +#### 前置条件 + +获取支持该特性的jdk代码: + +``` +https://gitee.com/alapha/bishengjdk-8/tree/ima-check +``` + +按照如下流程编译: + +``` +https://gitee.com/openeuler/bishengjdk-8/wikis/%E4%B8%AD%E6%96%87%E6%96%87%E6%A1%A3/%E6%AF%95%E6%98%87JDK%208%20%E6%BA%90%E7%A0%81%E6%9E%84%E5%BB%BA%E8%AF%B4%E6%98%8E +``` + +#### 操作指导 + +**步骤1:**确保系统中所有.class文件和.jar文件的可执行权限 + +``` +find / -name "*.class" chmod +x {} \; +find / -name "*.jar" chmod +x {} \; +``` + +**步骤2:**设置启动参数并重启系统,添加的启动参数为: + +``` +exec_check.java=1 +``` + +**步骤3:**验证只有具备可执行权限的class文件或jar文件才可被jvm运行: + +可编写如下测试程序(HelloWorld.java)进行参数功能测试: + +``` +public class HelloWorld { + public static void main(String[] args) { + System.out.println("Hello, World!"); + } +} +``` + +```bash +# javac HelloWorld.java +Access denied to /home/bishengjdk/bishengjdk-8/install/jvm/openjdk-1.8.0_432-internal/lib/tools.jar +# chmod +x /home/bishengjdk/bishengjdk-8/install/jvm/openjdk-1.8.0_432-internal/lib/tools.jar +# javac HelloWorld.java +# java HelloWorld +Access denied to HelloWorld.class + +# chmod +x HelloWorld.class +# java HelloWorld +Hello, World! +``` + +### 结合IMA摘要列表实现解释器类应用完整性保护 + +#### 前置条件 + +开启IMA摘要列表功能,详见**内核完整性度量(IMA)**文档章节。 + +#### 操作指导 + +**步骤1:**为目标应用程序生成IMA摘要列表(过程略,摘要列表生成方式详见**内核完整性度量(IMA)**文档章节)。 + +**步骤2:**开启IMA摘要列表功能(过程略,摘要列表生成方式详见**内核完整性度量(IMA)**文档章节),以开启摘要列表+shell脚本校验为例,配置的内核启动参数如下: + +```bash +ima_appraise=enforce ima_appraise_digest_list=digest-nometadata ima_policy="appraise_exec_tcb" initramtmpfs module.sig_enforce exec_check.bash=1 +``` + +**步骤3:**验证IMA对bash脚本完整性保护 + +```bash +# echo "echo hello world" > test.sh +# chmod +x test.sh +# bash test.sh +bash: line 0: [2520] denied sourcing non-executable test.sh + +# 生成摘要列表后签名并导入(略) +# echo /etc/ima/digest_lists/0-metadata_list-compact-test.sh > /sys/kernel/security/ima/digest_list_data +# bash test.sh +hello world +``` diff --git a/docs/zh/menu/index.md b/docs/zh/menu/index.md index 087a14cb4..a76ce1905 100644 --- a/docs/zh/menu/index.md +++ b/docs/zh/menu/index.md @@ -61,6 +61,8 @@ headless: true - [远程证明(鲲鹏安全库)]({{< relref "./docs/Administration/远程证明(鲲鹏安全库).md" >}}) - [可信平台控制模块(TPCM)]({{< relref "./docs/Administration/可信平台控制模块(TPCM).md" >}}) - [常见问题与解决方法]({{< relref "./docs/Administration/可信计算常见问题与解决方法.md" >}}) + - [解释器类应用程序完整性保护用户文档]({{< relref "./docs/Administration/解释器类应用程序完整性保护用户文档.md" >}}) + - [内核可信根框架用户文档]({{< relref "./docs/Administration/内核可信根框架用户文档.md" >}}) - [常见问题与解决方法]({{< relref "./docs/Administration/系统管理常见问题与解决方法.md" >}}) - [运维指南]({{< relref "./docs/ops_guide/overview.md" >}}) - [运维概述]({{< relref "./docs/ops_guide/运维概述.md" >}}) -- Gitee