From ff7e42df1330a75298f6a7ee72e93d0c141ff2fe Mon Sep 17 00:00:00 2001 From: dlezcano Date: Mon, 8 Sep 2008 14:49:03 +0000 Subject: [PATCH] A little example to launch an isolated sshd daemon inside a container --- contrib/sshd/README | 50 ++++++++++++++ contrib/sshd/lxc-sshd | 129 ++++++++++++++++++++++++++++++++++++ contrib/sshd/rootfs.tar.bz2 | Bin 0 -> 21275 bytes 3 files changed, 179 insertions(+) create mode 100644 contrib/sshd/README create mode 100755 contrib/sshd/lxc-sshd create mode 100644 contrib/sshd/rootfs.tar.bz2 diff --git a/contrib/sshd/README b/contrib/sshd/README new file mode 100644 index 000000000..f89de28f5 --- /dev/null +++ b/contrib/sshd/README @@ -0,0 +1,50 @@ +This contribution is an example on how to launch a sshd daemon in a +chroot'ed environment. The script will generate the files need to run +the container. The script assume there is a bridge which is configured +on the host. + +Check the pre-requisite: + * you can run this script as 'root' + * your kernel is configured with all the needed container + functionnality (check the lxc's README file). + +You can log to the sshd daemon only as 'root' with the password 'root' + + +Create the container: +--------------------- + + Generates the configuration files, untar the rootfs and + creates the container. + + ./lxc-sshd create + +Start the container: +-------------------- + + Launches in background /usr/sbin/sshd in the container. + + ./lxc-sshd start + +Stop the container: +------------------- + + Kills all the processes belonging to the container, sshd and + the connected clients. + + ./lxc-sshd stop + +Destroy the container: +---------------------- + + Removes the generated files and destroy the container + + ./lxc-sshd destroy + +Status of the container +----------------------- + + Give the state of the container, if the container is destroyed, the command will fail. + + ./lxc-sshd status + diff --git a/contrib/sshd/lxc-sshd b/contrib/sshd/lxc-sshd new file mode 100755 index 000000000..de55a7f79 --- /dev/null +++ b/contrib/sshd/lxc-sshd @@ -0,0 +1,129 @@ +#!/bin/bash + +SSHDLOG="lxc-sshd.log" +ROOTFS="rootfs" +CONFFILE="lxc-sshd.conf" +FSTABFILE="fstab" +UTSNAME="virtsshd" +IPV4="172.20.0.20/24" + +create() { + + if [ ! -d "$ROOTFS" ]; then + echo "Extracting root file system" + tar xvjf $ROOTFS.tar.bz2 + chown -R root.root $ROOTFS + fi + + echo -n "What hostname do you wish for this container ? [$UTSNAME] " + read -t 10 _UTSNAME_ + + echo -n "What IP address do you wish for this container ? [$IPV4] " + read -t 10 _IPV4_ + + if [ ! -z "$_UTSNAME_"]; then + UTSNAME=$_UTSNAME + fi + + if [ ! -z "$_IPV4_"]; then + IPV4=$_IPV4_ + fi + + rm -f $CONFFILE + echo "lxc.utsname = $UTSNAME" >> $CONFFILE + echo "lxc.network.type = veth" >> $CONFFILE + echo "lxc.network.flags = up" >> $CONFFILE + echo "lxc.network.link = br0" >> $CONFFILE + echo "lxc.network.ipv4 = $IPV4" >> $CONFFILE + echo "lxc.network.name = eth0" >> $CONFFILE + echo "lxc.mount = ./fstab" >> $CONFFILE + echo "lxc.rootfs = ./rootfs" >> $CONFFILE + + rm -f $FSTABFILE + echo "/lib /var/lxc/sshd/rootfs/lib none ro,bind 0 0" >> $FSTABFILE + echo "/bin /var/lxc/sshd/rootfs/bin none ro,bind 0 0" >> $FSTABFILE + echo "/usr /var/lxc/sshd/rootfs/usr none ro,bind 0 0" >> $FSTABFILE + echo "/sbin /var/lxc/sshd/rootfs/sbin none ro,bind 0 0" >> $FSTABFILE + + lxc-create -n sshd -f ./lxc-sshd.conf + return $? +} + +destroy() { + + lxc-destroy -n sshd + RETVAL=$? + if [ ! $RETVAL -eq 0 ]; then + echo "Failed to destroyed 'sshd'" + return $RETVAL; + fi + + rm -rf rootfs + rm -f $CONFFILE + rm -f $FSTABFILE + rm -f $SSHDLOG + + return 0 +} + +status() { + return lxc-info -n sshd +} + +start() { + + CGROUP=$(mount | grep cgroup) + if [ -z "$CGROUP" ]; then + echo "Control Group file system not mounted, mounting it in /cgroup" + mkdir -p /cgroup + mount -t cgroup cgroup /cgroup + fi + + lxc-wait -n sshd -s "ABORTING|RUNNING" & + LXCWAIT_PID=$! + + lxc-execute -n sshd /usr/sbin/sshd & + + wait $LXCWAIT_PID + + lxc-info -n sshd | grep -q RUNNING + RETVAL=$? + if [ ! $RETVAL -eq 0 ]; then + echo "'sshd' failed to execute" + return 1 + fi + + echo "'sshd' successfuly executed" + return 0 +} + +stop() { + lxc-stop -n sshd + return $? +} + +if [ "$(id -u)" != "0" ]; then + echo "This script should be run as 'root'" + exit 1 +fi + +case "$1" in + start) + start + ;; + stop) + stop + ;; + create) + create + ;; + destroy) + destroy + ;; + status) + status + ;; + *) + echo $"Usage: $0 {create|destroy|start|stop}" + exit 1 +esac \ No newline at end of file diff --git a/contrib/sshd/rootfs.tar.bz2 b/contrib/sshd/rootfs.tar.bz2 new file mode 100644 index 0000000000000000000000000000000000000000..327272e052886c9d0ea1ff53b0c7c284a92ee601 GIT binary patch literal 21275 zcmYhB1yCDbwD7TF1zM;;@FD?Hpb*??q0pd(Hn<0OcWo)sB83o&)1rmou0;X~!QDN< zDOMcX|HpeXZ|2+Cxp#MV@9f^Qdyo9id1YiTCH&G5_|CBRtV)wm_=J7TYb3sblJZXNX?CheoDjJ8g9ug3cgtLx!Qr-3epCsU11e&#^R?f06RLewJ`F6=EC4&i<~xX| zb87Tc|BzD>0}EvYesq-6$bh|jwj(;vPMQOMR>Y|>?f_R2jfh}~{~?}FG7r`i4FIN5 ztE5eyv1+Qs_0v*Q)W84p{_MfK$up{tN-v9|;t8mKj`k6Z5{Lps?TH-;81JS;Kox#B zJ4HtO|2Zb$mQ$uBfAlObC!I+xFeA6r?cKX^7nQV(z_iJUN$WFWhoANY58f$S+fOKB zixmHN$p1A&jz0;=Q{H@Ljbts-hGf2E@3SpRCw>|8zYqDpoBppSFCZtR5Ej+2CoCz- zNJ|%{*4D^i1k-L87sx3o+Kald6NnPr?W7+k?|K5l@BcH7kYxRwRERLne-x+CO@PUJ zl@V!1qM!?YFu~>7(c(f>)oBXVj|nkgtEUq&#lkKPXrV~un3&j!#Sp`&-0SfeRcXqr1$@|x@Uy;y6 zDtj_J_K;*N>39sDG))*yJ61a)jo-OGVkIu@}iemqfl zvZW@XS`*=J4Sg!M=c6GFG>v>>BFeD)e3_w@ zT{C_wjW@qph!c?T7eQ?17g`x}=XnWo!J?89oj7G!nz!$>gRzfFwIS*yUj6h`ue^EO zWIi9e!8#&#UG&zwiu;Gp{jT#qMZQrY%6!CvSx)>KWXIpA+@2b`vw&rB{qS9A|;!Olke}mX<*sM#)LL*x|!+5gj89*W!;XELdk3phinH z+I@yL;4zz=NX3ed{D$Xt)vx7?zIT+uJ9G5iL#*6+;-GhZSs^Pw&vW6Yf&VUI&t=WR zR(`p4-EhFD)cub#?d1*mbxnhwV`p~+A1XeKym$QV6#)qWNl40H1jN z)S!F&$-RBofihu@71~{FyRpQC;lxmPna#r=Pl<>gKGPO`X-Gw2K_pFU5$ZupiJ~QW zDsN%J6g)vx%jTS}5$f9k?l1{>C|IJjFQ35uY^nF=VN=_6^%MDe^Q5k4u*ecwNP(odfQdABWT$9tZsb0tyEramm8(s{%vt*8E|gs;>s z4pLFnGMqd=CCI-t*x3A09j9koKeW?O^jsS9UZngm#4U)sJjAT0Vxd3S9yhL%Jbz`ggF&x2P*g&td8I-zWuUTGWkPu|&&fZRR(<&JnS=cE zXWsK$6O$e@DiFnc@9QkP*5Ic_o*cl_uGijZ$@@w%Tytz;z+Ke23qVTfFN|vW&$%mM z>LOg?p+5y3ub(#kl2V0JM7-8F=`uM|o`5*LUGDG_KJi?pF4u_x(nCUpHfEK8#rM^( ztUu2L=oa#t`7*lRlp(*e@~aQ3pS1OL_C=|97pk)?9nUmc#A!`?c@KCLiYPSCt>Oh4 zGbx65ay_tL*AD(t;J(m{iA_s$?YsEXy}hX|#1KXHl{c>I;!4kb#``l7RfQW8Oje2G^7#y?!Ld|ztQuJ&Kbh-HuJ>Z-qVdKAso?ewYjwR$i-Qh zEA>=4^K;sh9J-GjX{MZXf8r{+Hz40;-FGG{%9&%9?ZtUsQGYOeBHUI_L&tCS_Q$JY zwL%Pnv|;awj~)L}k&2}X&IkWE>0?AJJ#7T+(b?-Aq4{JhU0A}Sz-tqJ%qya}v8suC z!%4vwbX|4Z*q4igrZh@LI-XsNDUNR~=DE_uN!%}Cc7w^=x50@c#lKC?O(eEI1QC4B zy$tx6`S9OSv~KR-}ZU%FxG+344}R=)hFaOQFL@5RP) zy1iwouyYI5^H7PVRf>wB-CXVYyvH)~%qv?<;l}?=y_IkG*|d-UT_~6HEZa-5`iDG7 zHVIi_ok5?RGO^hd(&tGXx8Gm(8tJS|Ha5j4zIVIe>Epp}{7n&|9TnR9p7*_*PdM7+ z$Bz%ZqiIP9MQ5fl#jM{J4?QZ1 z<4O$1^N=OvvohEwXjgK+iGOx6ZqA9f4=#59X?fEz8PHt`4NLyVW!jr5Fr9&sT1P5% zghyObV+#V$C@MsY;#e@el2<>|U;v;qvKm+ak1YLPGg-?;9b2phio`ixK!h>_lW!kG zJ{j%vN#N<5<8=;>*i1|5&E^FbX7g7r%o(~Q-x)$ut&7TM`qCG9-ifIVUMkzj)=TEu zlMKaCzeB2*esR&T-l9k#eocwgZ&QAg?F!(Kw<(7;1pKl0s`R#uq>Fm9dcqiV_+@kN zsD0Q>DzR?S^;;UUK+f7Eq&f~ zJ>GS;?9%-sk|BM7@9__?V4)SE%KP#ab%LH1rwWt|^HT=qA5Y!Or3a{fru}%@F}HeS z0X-P_*qh`M0ua0$HCx=d^GF4XCeazj zwI23}om(0P2ZMw_Dn()P?uX%A55Ka9qlmb;gdzzk$+a_+EH6<6oL*87LqCyIscKoj?N=>}6k@x{x%_Mu?V z`JBjH`cXJmFkIKzR<)0b-sXfoDp_(S7Ql- z&uA%KUS&5_T;VUKTQJNRp|zSD%QE8NA(?cdDxtdn>1bHzl_QBrlVS>}=Z8H%y+q82 z4e_UXTXy}|#70};5k{mM+y;<7yR2Nt3RW!c(%%L1^grPh!#9Q_FJbo##dUJNx<-+> zp7A7CyqYwa?-qL~vMliBSE_UjE-ivcrpHbeRMvWVEYrzidiqezi(W3$gZ%UBc^8Py zS6ISah|NKUS{o`c#f_<+`4CiTbjacY!lEyQmNn0ggkf#&hkc`h{QUrSQX)~>KDWxZ z{d2S9>7L6=qO|Q)tZGPp5DF`F13HJo?QzpL=Jmj52|uDcAh2n|R3_4NyIvcfXTTC0HI}RI6ioW#trJ>0J;IxFJ^e>{i4H!#b3htL)U<^Q50q>i3v3> zsoBwC^=;k&wJOkoEO&{X^??2xH7FxFZO!?JAbm*)~O^fb_H?_6pmyWzNic-2*^$GQ$TbF?LV5n>B?0%PMG zsd4R>f%_`g!daK;ZmIHX%B|-`KcFdA0mj33rc`J~IaZBHJbyv$R%R0$XuW}*ytw^@bGkB8eJYhs^fy8sLkKF?tc)$VTYjP2zxg!B$J5uWJKjLb$ONwq>Jry{+?fXuhfY zaCcw7^HTaG;YQoA8KK3^(Bd-wOQ=n;uIcAUBEXNZ~+>PKNu zF^uH90w`fBVF$*)a4MnZadG%Xp!B{1*Su`vd>lab0mG9J+bdv1S#R;qb?|~@MQh9& zJ4f>8Hfo6&#`~5m>%HR`(Bnijpaq6{kfuL-gk%b)Cyd@@QVDQrgXKR6Q$+70_r4y; z!sT;0_ef6;pqav6^kmW07#fC+Uz$hc#!{w)-QxkA25vjNbo2#lke_tnR0hP{bl{Jl z(t!r13Wmb7X{yytp~LxSI(0s^G3zo^Fo51zl^2s<1YC9J+UXPU2fexZ3nOK3gtrfU zoZ_6mw4^hCWh`h5SmqH!Pd@Nb$^ys9M7}~&=M zS|Q3u%fUPsz4z7a_*~ZRNv6f0@e0mn{n6!kwi+QA0GqCtp;kN924hp;Y&*J;h=@eK zs$e4Ztgv3zAXe-b?M=zRB6Z8Gm!t2QV8B5DRj@T$A`v!T!L=(2@0+KAgsMDSas*V{ z05DkLfxJq95S%pd&Qn;|X5+Njg!Ukd%V2qx$;iNOI(d2?=>mpyoyed2-+mk^r2P~5 z;=gePfK0^dos?~ubM6`3#x3{PAv~Am`>POESC``&S)AdW-*ARPaDy2j*n=&Rvf3L8 zU*2omHAKJMTeShcHtS=2NFGc6l7m8YZtcrzlo@NgR=zdg8N+^H!3=H(ef8*Gc9kfL z(z?Zz=i@`Rl_0kh)%euK3vj{4ze zNn5<_VR>F%hkJ2Xq?*y+322`xg@*&9Oe% zlE?B~gVE>ePnZ{OD^%RM&kWRft()pf-#GE{Yn+UhKw3ml&apMSOJzB?fr|YNuqJe< znd)i@W!nyke)O|-fqWMUocW#7FyV_He)^L@dcQuBQ ze4Fz?I58>32?&>M(or@Rcy+U8;ALOxt-6mJ5DP|6BfL^!s|s?lBj!B8Fd zk+_Ya3b-uv7=#fh=+&D;o5SR-mwxFDZx}2K&1-<#5EcNnU-fZ~@IG|^-k*gbp^Z=b z7S)~mLgP?;x(#R~<_hRhmgy83x|f=S!e^Yas60FUHseu{jp;Um&&`CeAmPv#jGW^CF%u7@M=iRSef%|>}cB2nHhBc{O8yzzrmy@UTRW(49zsIERQY5tVCk}nV|wMp$rU&o1I)0EY1CNi z{&U|aeU{>ut@raP3JtC=8U6s&swEsim`(Z`iz`-HgaZI!Cuy(#a|ylyJwC3rA5js& zF`%_02HkjUOoa-~nysKG(4%i8b?{e)DqU$otk_208ViICOMi!57`MqOfOl6YG4KzL zJ_J%{)dTL$a$m6MUE$v6%KRVv{+F+h{BF zA6g5iy2~I=MgT(zJcE#{V z*%pec8=qYG!T~?w1#jiz0xeHO$9JK2t!JC!0r_c@!U3F3ilq@qwcn6K+x`lF-Vx7O zJ{S6Gje;404!a`-*5nEMc@3^%?drv}?dz_rAf8XgWQnlT_{Ar|=L3Qb<1eODVyj#2 zq1aIaH%HDQ>f!VH0SY3iciV2oM;#Q!YXY|jx0IaV#7{z6`oHZ3?>}1ionGktV_zYbc z?nINbA?cVV$ztmAFN{J8F3(Bd*ZYo71b({x&6Sg=oS00vEL(LOTIPjITUAi}$DO+i zzz#akJk`u^oThW)$%NE}1YQ9(m>Loaws^>^?EkWkIKIa=V=v_b&tr=C#<$vLH8|o6z&W zXyHy*XhB*&*%1p_^|Yizs@X>3BDbL_hP-YXnv;W@xD-BXq;nYbN_>e&8VfM`WnY8K zKl=aCVt_Pyxn!%#La_Ru+lRGQYH7e1gR-v^WP{-{kq&$k_MDGX*X)G8RMGYset0ZQ zP*rLNuwif>heqif{y5QMa^4mJ-7tyy0FPr|tb|$K-V7}R-nk7OaG=HVB0x@`>}1qF z%=pK1$7PRw8b|sk5dCH=@Bl5ni!E>iVTw!?fnUi^X`JXn$&xiXr*K@4nd9ZUgWLvp;Ac;R?f}6Jv{5q5UXMXP48md}nuN zg7MHP9>VC~qAIhHy6pB4?nw`}o z;x0U04FGL5i^k=Ht^tq|ePchgL9pYw9HOY%rUw}dO*O)PKyH=aB!HXSJEg}P{Dm@+!6?32MFhh8Fp=;aTBH-Lz%?xL zm)ppV0ex9RZQbwlkjvWty?Uf~u(XF$O$36EQ-d*P8=6ZSZ5G{B1H!PSohNWscz~|h zTaBy~S`SCKK@{H={iCefoF#ri@`gB+I^i%1_k9s6080OO|= z8;})vkmEcFm9qVszxBpMo)M^91LDl=H3Kl6yGU*FXo-MKzj(;sSJgc7%#rsaZ&#-ROrIiypMCJ9y0Vd%w78d1-Q<&`!A8o zp3taP-Zwepqy3&70xqxXvog(%H?7!BKk+hNF>QE#f+gY%rE$jm0&?)X=w&I+vs>G+ zDlr~nwe_mfx-u!nVkalVNN;-L!>BDMXt>JgG32WiyJMb~Kd2|ZA|)->n$w0DYB)aK zHEUSwDDcGHlV04Jd{X6J+OIHdOI^I!WOq{9@Sg2u9fqy1`<9Bnt7w=FhLf*O+-!)? zRw1mQ3-ww|lY=i6{2s52x4v6szf_*qRG6SwUSuZ?eR%><`3;=eCP}y4X{{(bf=QG4~F_O+Tl>NF!zT{t@LuQ!Da4r{G+KXj(Ud}>YaxAY*se#V%0Gg6(ec^uq zJxf8_59kG?TBhSzJ;M#qKXUJp%a;k4(FSN= zNtX+7S;5q6%Ugh61VTS?F-}R0$yHFx?H6r(X&Eet_aV`a?q;Fl-X`bb&95{+wi+;A z-uRNm=1UyRP#6tu)8ZOL;@whpE7v%Kjn~*Q2l&aHvSmULZHR7epfbim{W=UFCmQ+3o5^Ll!GttxIJebWtw;xiTa_wbpj)#pNReopfZk@$wdT`ABF@V5w!VFTzA)vT9X zZoRCD+jk$8u#d;@Ld%en=NiNS1>yj`_C~Y}yhIYzzpKGD_tm4#vE*Ei8}3=DStV+!0DjZRR$~b00gi~SnVTUm1T*;fGd<$2hcjCl;~V9qpVxPxz=*MCp0(N8oFS{ zZGMMQEKCV~o*IeK3j?IJQJdMd-!*n&%BA$L(MCKKIDwxa`ig4|OzJXNv7_ zUQVSi7#eHs!hLnmoR$ZZn7)1(+wg=AaS$xNHnhvi#MW6LNt4~zHAOSlsNEGO#Egc@ zxF6r|agfnd^;St%QxY?<-eMLKLCtoR=%rP*L(a8uz!z2b=VG2hH@74JrTF*3{qHo_ z!9L2ehS6+cu@iBuXoi1nc1X#71w|}iydxv@uQ*s zv0(Z>ycy=x|zdi8cu^@ZE5)CSW)w7zc`#48te&BrE`RC24hb&yb`iiWr9Il zRVTvm#$%Cb5K5yq=jMB=sH)B)*PxrSHXM3#`#;F zr`wz}+T&OC#H#;H+Dxoa1-=hSe!1tHY`+V|l?WjMnN^=%s$-Jvp;-=}fNT3Xq#l2P ze`hcrA2+)eGpE3bm9WlXVVZdtWFtP;ocQNhP3gGggTDDYJS?5SKzdRRDrcyMOX%8O z#K#7(qWOgr0unF}tmj4Ja296?%~$vwIy4xkz_s^)vgruyKQ9fxBZWRJ|Dz^ihGn@& z80{GveW5)bpx>>MbNgX0yX(0Zkqsx#hZ1RO?e>h=ZHs}~VD_&%v>fEbwq}c0hGi>7 zIHu}__?pFk94l`J*+hnRb0!W(G=878RrtrAOP@YB(uHQlKK&e^*6{noBC-b=p711} zh$I0eQNwPS@9ch0#)W78D=E=E)~TyqfeHEsf!C!GuZc;fiSkG!e{<@%^{BM!DQDg< zjHJ}^H;O{^s2meTD^c~({Bw66)B6zR*c3xYZ$bBJ9a$BzdhRyhY|CyTNTZ=E=>fv` zJ|usGCG$g4GD*av3! zkz^i4NuT&}6kco{|MXVk|9g0Wm4hFHu1*;Dm{mU+(rqNB;W9J*R~V)yz%IZallHxB zupPY$Mo;wvPs`=%OXz<3-a%5GO%^g53}aPmv%F$8Yjk61d|*g7i_DF`@F|W*HH*Nb zhVmPi#|-hg8T+y$hRxaVpJuD z7-xL%g6}wtCoB48nX`h;rZ_Ebv|DaFmCh5Il1?@(8rXZdgg=31lwR*bGaaOCX2Z<> zF1L7$gyNT>xpaO&>8LnkNE}jfQ6fG#J~yeyzegT2r|*`K18MX9OW9h`tvz%_6YImO zGL#jiTo2DqSB+S-#XFCExr5MSSpGI&b(dy1L-}2tn_r@rT$X`B$HP3!AJ*l{00y2^~bHN?|ePTvt3D_r@Jb79+iA zk+yZt1Vf#Qr{x``J~y9Yv)CBXxTP$SqktW`V_*BQ|M-}ux*l!2>J&mh@;-MFA0P8b zyU?L+GUE506N$2x`wY~VH%kS+!a+=XK*R@!_1CIw837S?{Vrueg)^7ky*T`H#9*!DVNR-w3W?SQ}z*aYS4?jq6+=Z z(?mC~ap5qNhG#uT3r}czuJotsIx=ms!Ac|(xXpvykV4(iT(PKUe_Y%0Yszd)VX3Z0 zrpHsyqsPmoCq;n~tsS_W8+4-et|sS+$Y$wSW?p&QQZ13GO}c)@6BjmlnW>96~DY@icI&&I834MUdDML1YYiuaD%X6z57ya_(55RKZ3jE?g1<+ z$5l2!oxNr;`)+MweBfLb((FH*$Q&{a{|D_yEYem-$a0wYU+l$n23%h_%Ldek+yYn1 zOfYX4Lh`_NpgANx^>6&til=K2QW$P-pmKcH=Enl6WL8-_N*#t33n~QMw4+J|>QE2Q z<jUXI1r|xx6N(0v=T*d=TOvZwuTOabu&bzG8_6S0iQT9p61njv3JI4D(m zHw9hhj~2`tES%uWbL>tZw-E;?zLyzc=@{GfmZeVr&2pJ`BAsmI;*6gw*a}jg_NfvJ zf;RAcM_QEs0`9p8RLG)4j3pZ0IJogO3ADK^ah(PP4bLb_^F8z&YVq4yp0zm6nHvjv zN169C547LBr~{nlFLPCIDdeiI7CPjXfH;V^2R2*r`@*D+)?e+Wz^|5;lx0~YV8chfVNXz_^-PL`igIP)?$_a`LjLlE zf%mZbtDqZ7vONBe;}2zD=^t?>Zc^5JvJE0Eb!SsGOhjE6RLYF7U&7~VJ&hHj*%H{g zJ)tAuN*20{H*1S_jA%v`%P+H&NQQGL3Mg@QKUOj!&>s_hVzdpQJCXDQCWj>MtZ@F^ zr60P}r>(L2ZZ$Ty!!vBfM#1M)N`0H+aQ891WeTz=sT=yyeqJUXzxZv%dJ*|l4l--c zg3S!8PRURkNY~#UEAUk>5epocp~fk0JpE+)#9~;+_s)w-(xaMBUVhF|X+0E|E|Hk* z1HkUh$*Xu)MkH3`^W*yFg%Dm0WD%$l;?A8W-^*P&9^uX8uqUT-2pgWzS})LVIG=tq zw!zcl&XM&D9=Zdhv$Bcbcg5fg{qny7lJJqFhH|B#@iH4j;=M+&AD{sq?df{OI&3|Q zERppcdR`*DD*-iU#O~4HqEZ5tIh;+6miZ7UBu9t6vz^k9kLmz4~t-?$`?2YWgEwyv)F| z-z7Z;726csn|oCG;L*Ec2qysDrX*a~yb<&_L9NaT>E0<$b&d#~)AwkgE6<4)~Cb+@~-s_u2^3AZ8fNPvE>^|-j>4YN2+uJux> zzVs0r?4qodN(}D9x~iS*K7RUb+*H+Y;~Nd}jIPtRWg)Z<_CtU8DmYG7LZ z;U7KrR}7FI7-KyQPL2uX>O``BOgsA)krnJqyZymdCYCSuOx0>jjx;VQN>YIW-9;1Y@5IcL=kFF6uh$eR<@j$D9+f=(-Iwl&K&?Ie z+NnhGWo?4OeKJ`Z$t{aBmJeG?{ zgUhjW0TlBMbnXRU8%6$4n@^vv%oLq13BtHu!%OtF0N9G4XuM4wGFrPnR{uvL-mii7 zll9t;-U}O}M(#n^4dm8I;~zupNdxFM9_z;Aae1|X+egmHI3?+Mda8dzmoK4Tn>;Ey zsj%Mo;_JqVj##iN!-<sC{Jac+(v*%Q-*y!I4 zi3=fA1xx9An)xRRE@jB#J)SdxLZjqm(L}C(=>*39dN`Y<1+-Ep|J(=YkMQH3%z=#Q zjawXOC^$+7CvLe}FN)9@gvy@E!Rh<%GXJxksdSYPJI3hI1>H)urnq@kx(e%a=$KyV zueQ5CKi<$8T9z%@FP>;nx(tm(HVPMM5~s_=!G6v|Go|znZOoOxddbdALfm!8ScQ0O zl70e1^4TDgezE_T2sEe0it*NZT!Y)F4RmhxcWK{w`ZF%aStv&{_1CQF?&zA0k%5tgKhIOm zp39FUuUXwhI;_&}k)QIiSP~8WB}}Bf@vOvK_ueE$+5zbTclttak>Ncu@MJ@^8uyKx zqi)Uo3jiX-?#4G$I+5#KW5WQ{h4*2qio=Z?ksi+5cFX^I;srX_WG2JQ!MF5Wu%CjP$LJ}UA@82mM|G5!ihr*bu%HPI)u5)6B z%(@?c_u2D5mx7yJ#j^?_EYzo|P{(kBbvbG|c;6thZ!uNZjcxW9_KeA5S1jIoSB@$- z6oO8+o|dy@?QizHOOd-pdQVFroH8Ne@hePsLFiPt8_$ex00U%Uc2o0@#kmk@6v?Oe z@;eN80~ts*R0&jT{2eVBMHgbj9F<&#au9ouN1}(=+736z_Ey7;f5Ek2vGSOtyDAZQ z>a$39M%Za;bsVzkCdLJ{DUn#+X2GcXvQ_9#_Z@auh}yBLKB=WDSQLWCEJNemn4_Ap za{@Ld8$8s)anD2Z*$k}D#-Y3A`Lie56mA8UP-|!_vy#v)H}cH{*pRfG*!KX2)w^9E z2ahUvb@rxq6(Eh|y@y3B@HarQx-?hR(|hJz=aFN|g%J$&G;4#mAcv@bMEl$9ZeuCE ze_<*b{T&bqFQAY9HeNW6+vGM8EBpX}PA)U5bsBU79x(p~Iv3zbj}vqq63GW_dkq5O zEGACGsPDwqV-xAXgm7YM^gY)q7+X&G4{rVpJEGazo5B6IzK#4c>5b#TSLgWC+4e zl?}S`ezJFi^ypD@c7Z3Z^vAPOGz|zC5C2DlO_>rW)CJlD+~&}p03fbmHqLiO$$ zOC=aex(_0g%M2{ki%!av?0b-J*G1h1%nI_haeB0PA2zlhdY++> zf}HD(r&x2CoB<7GeNElU+iUf7SwyJHCquL*6Z*Ab!=N<6j!A}^_-79y(gk!PU+>Pw zsX7FEvz>~sdJx$NpLQweL^5>BOSoSF$16AfsS5ABh^MUQUKcFRQEM-B9M>!~0>fhl zzj+MZ-{H?h(?(`DA*}lElFt4&sH0S-?pu54@o1>3VE*@Y$vAP)j-K!dP2QwwAXDP| z-!`AtvCH4>zgr;T&+ea&E9l)bi=M%X!d3U~W`jvu_cs~S+wN1I_CLHx6fZQ zd*G`hw)-Hqv0;$PkjF(ZcI5@loiE`v6M4x6jz{hXPWv^Glfd5@JI^-QIC<9PXFe=% zDUDt#2W!77e`rqrCG5S~YGSxzlj@+3tRolsT!*}2DfPg473k+i|iK?s1oEP?n8xlS5aG| zrQnbK(c(~C=O6L|?G?XoGGwQr{-86xYWOT#C{7ICkd%ciy0cMhJkynhX7YASYV9^? zk~Rkx|H)K|q!GFbMjba`{?p$${n@qJpDS3sYSdj~2JgZ{7mTh^yJP+P*;;9gLK>VU z`mfE%60ShKttw#G1kP#8NhCyqnzOhfzgfTAbX6(=M>+&!7}?6&IJm1AMnV6n9q`^mjztUh(wZ!qdeQ6E@6~gBT^@ zWHX_^$mWDfTi~4+abvfCZ}wfU{whfIC~%gm)p$db1m>iv(#7LGzP z4<}?Zq{bS$Qjn5;QVE>w^BQ+jSVaEB_8`$D%UXrT*vX72x^f0g(t?y^0)A)VkAoZy zF;)!Jtqq$!*RRyCyXE?=CV&TT2|VmO&}R6%lFijAX|?J*D6cYN0y&Wajmsu@_N6kc zvC6_VqWM8h+=H+a#TaMg`re|K>Arr|g>hR{=+0CCtKaG=3%as(*~_*|Wd-1SuBSve zjM3#TmTG1i4H`MU_zskgFuTy zhXMNLnWWXN-DO6QS|2mDmH-})Sbfb!2`ZtxLdsf%>oMBKOakG-)DWz~Z7S-LSDvL- zb5{)xnrnRlahcN#bOWCFZ;N;`pocb0qyr|RTnwXiD-$<76FD20gc1tQzS{A4oIrp2 z0hfQBqa^$9)S37)IH-sT5pr;sFp&+Wo`YmIAow{)$G(u>K+x1@4$P|F6)*?cc$oXT zwpw!nWljF*v}_`0e9#K%FpS6q9Uu64T*KQ!3O<~lTsB8WyY07UTjK?29oNd&yb7Ta zK{%x#W5zWlN5(4|A$J7;3)=&1p=7it&@uiDX-k%?vK)+{jX4vZ!4r`wRV~<-fMU7a zm9^+Z21von{ovEOF4K&)i9s{+xV{yLzKv;g8BVe*(h3koSJ7XaJXGrdcAXa5Vi+*! z`Ia2)!hA=ZNS82!C1Nn1p`+i&cNkCj%XxJIh40P@G;N@}oD+{^eeA=Qwm!7OPfWf! z*A{%Dmu#7NIaKhw_wozFv>f8jP0=beFPI?fTo+0ll~-$}5~o_g-Y#YO9^j|%YDh~^ z{{7-KN_)0-{<0pT*LmfsvA2ud7ukUm)y54RV%)gdVeGrvnj@prd+v0(P zk1x;V+$)hu8B)Ew^;%i>P14D<(U1Rp?fB``SW5Mcuc|jtg^&UAp5cx7H2;Z*ef@}K zyC}7ifc7>fa(D{7I*eA@et$8$dAUF~Y_)qa$Esy@XjV}#jbHASWMq03_*GiX*X6$t z4{6JY_8l!--Y0dt+HuZ*tKI)Qvc2y+OP ztYj;o=KaN`GvgBoeNmK=ohjmHdm5Z`<5*Pc?@~NiPhWrO2>PQEy^cn5D;A z5!w~%=LL*0!ofXky0MkL*80`))-2hcU&66R(d=&Y=m%u^q@PG*z6!kj%QF(pG|~BZ zZ|M$sd5q@sP)ta=(!JA~tV$b;t^C^<9E*3ISb2;JGyBQgMD?fSL}6vhxrx_LXy+SG zALOaNKIcS;+P_wEDGz@s%Ky?)Yp0pBpI1ua=_o)g5Q{T@BP#{2j+V&(Xrgifs}$fm z3g$??PjuA(L&IP8N@?>eJRmx9uN(hs=8!!4@$^R*aM{bf zwAlOyQwK-wB;*Lbx1#U6R9mu^7}LB1SY-!#;o{57>4r$dVy=~T_0pFhYF1PVt{J2$ z5Y&rFuPzz5Wn(tC>)G|y`^7{l&jHLHrn|_~J}fTb&JPY8h)h{jPG6tPDspFUiQ8au z;4tY6c6k)RmjB27;-qgPh*&vYN(TIv|L@G9!WRM2qGcs7+DpkR8#lMo?+OI_->Jy7 zGub*!`YH~OCJbN6y_DAy@wN02t7Rs)-IrT%L#=XySI0f8EakPQzF>MWxn;q(`{HLuG>boMb$C!yz z70G(!{0g^@6#Wa$1Fk;wM#<aP!|-T5k`5x~_ zN6+{_ll4C%ifn{L4A+zu6f=VmO95dO2W40?LH{9{mH8=hYxq3Aqiz21J32py9HP9z?)&#E(gl;psvw;_)KCvoyutWi)D zQAp8_r~^+AJ%bqdn(^TlbhJ}>3uHue3JfdB1ff_UAb{%-L=rB5?hJ-g11L-* zi2#0+i!3L0lWu%ZmAsq5tWdon>DPiqk5t^G{r{RVPsixzqF6#X{5FVH#I>cgFxe1{ zJ}?Q9ilU$*;bu053aT`a2=t2r4~0SV4*Mnu=oa-19|si|WU44UA+V5NL{X$;HV(T98TNM>9T~6SG1QYiH zODt+Pz^H?!=)yn~)%beuWZia7vmVn0IpQP4~+l7$oNi>RUu z1Dewo<0k|#Ed;QnY&$oqgrvbQqI9?omI7HA=j?f{e8*cI$2SjeX}uIoM4g0?KtYbl zBu>&~p-UTz9rA>rsP_C_PE+9?3H7z=A4e{xdPJesqC)vs91jv~qK=2hhTd+v*=;*E zFzFl!Pz9rqO=Qfr8e%k%FuBQ4#P{HG8L`zIC62L2Jt*O~eY3$g&Qj&;OU&A%CL<|JIlT4Awq%WB_{vEB8l`5ccDN*o4v0=EFni$e#gaTE zJtcdF$@EbOkBkRcI@vmYWOJc0CvYC%)HM1tY-N4wUPGda&krX}=g znc^XUfZ&w`U?=V3^?W?H@|NvvPn5v#fnG^>u?{n-zm&Zy(SlD&xs}&NrAi_+N|+P1 z!eTU!8bP3SVh+jAAlMe!69Kd)1CBafkUB_8LL?A~bc_#D_Jl}|yS#gXa&oNX8IvIG zz-U9*IgJi<9mnUrA6R-5$ppC|Ae{kImC|6KPBxH8idJ-vh*JSk6$q>tD5S{(0s;MA zeO}$E%PPpKfy9&rDE%q)4|Pz#auixn%4YmLEtbGd z(Fg0M(8K|>-Rj{OQ=cLV=Q>$x^WnYgQ(yl#@X{GAR1Tl&_69g(U!ovo|QV8_>{a^hh@}kni}3t|>q~=rB3YG^itSUYUE`eAArlv>=t;?!YxV#w#b(J7&+A zbj+aMt>+#SLzk)Q0qVxb%q&3=z;T>RoWrCy1{2XPJ#-K3l*UzCw<5PaGwe2@IKNTd*l=5`jm#8y&UR; z&|3P;8`@~khZ_C}<52p!G1WJVq&?{qcp(-}W8`SNUW|4cg@&`)o2Qdjl6Li2O0f!t z`yFxY72lV@cU+C(d8(fY1US$s4h%|SjT77&~N=Ma~a9=X)FeRQiqELvYBy+jD!vX*TwKPS>-%+*!TPtjNckl0n8?JnXI| zI2Z^h$@T}TSF&PMxcMb1N7_025wMrlgG0C=fyu^hI2|m6-Mrut?~VbecZUK-`A8r# zQh^51K>8nq?doFrrbGq`lmp`&gUKAF-rP3mkn9Ha1w{9$tgxHkryPGT?D@Vf)U zx&>9x%uPv!j{zGA=LLJ6V>{zT4P?llKQEgEMnj7B&-kzQU*jZ6(^Puh>&~h1nijsnI}n^l0uyT!Zt_P z=;=Q0?UDJ~_toi-FA)ePz7j0}XAu~Z4k&|gBuWxT6$%~R!2)A**D|j`J*5r+I5Z{_ z5y=b0f=@nEnbW)usL&|_2pJ+jjyA}G2+dNZPRFtz80ZczeNcVgDKPE0lLQ%%vnD~5 z!?qBL(1TxCE*>=~_YJnFV;S-a3*puz0-1OG&-6)X!Re4l>5@W3K?D2g5Kb69(4QS6 z4R!b|9C7&VPRr;mT0TKBKu$p8A%Ni+08k-3@u5UmViq#{wCrC7 z@V8v`C~>UAjBPr9cj^D{vE1NscKSvqcomcAI5au>s%)7iNtrsMU@mi~Qj?t*%JGxygY%N^oXtP{isb&KW z2L!g9j3uBT2v@9(!RrHICW2T-At;fO$axA81yB?f5KykvK}n?oM2?t|4LP4AMHNI< z0%?;N(X3NilLfaTE3~xlKkARsNq%#&3SDJ?D`q(%x<1GIA#f*}Y7vI2)@O{Pda z6Lol##qgS(i!<#kdY+-HtB_I8$_(L=8{2pwG!R47|J&W~!-n{fc zssfM;3jiqyqKWtFh>Z5WeyL6Wv41<^PV4&Fzm@c!_b8u;sFQ>zJOxCSWMv?ls4Asz zakGB30Q+2Q4|`=p493tmSoI1jjSUxws9Z~y-vB*9I+Zs0Ki=SV3K_)>ikpb0F`2KfG$=wF zh(pKua^vsEPZM_dP$dH6+q!C)l6-`vm$4iyRDj-u4kajjdFEVb5EzHUjp5xfeZwmA z2S9NYGkaoKc|q>(D40N9=$YThu_6R0z_1WI;uw&}WVlQbBpLE(OoA!iBn*m@2O6M( z($}R_p~i*Dp+h)ULCcf^e&^=<-$#cRl@f!fVhO%?U;FC!`B#kN=Hr8{$Y&h$NKTQ0 zwaJ6MF%^TuDDoC4OffNTixmpAB>|9^612`K`F@XF%Gg5?#pWUN@Fs0&HXl6W?0J`i ziFAVSnbt8ZO!KABcwy|6m`AVtzNUcj9J%%AA_uBK8z9*%8F3vjwAVZ;GKRuZNr=Fa zA!V>=QQaOH=r#~Q8w;W#gJF;X2q7Rsf=+E<7Nq?UxLl!8gf4)UgNxrBzXE1)1=jnvY}I!Kx)&+Kr4WJc2i#r)X!SFe3k4!`r64!$Au$T0BQ&Q8 zMe*S29E#nttkqC}h>d;r1H!z4z`S}R=|%&{RGZfGP@hVlC&HM%yAPTX+%X5}n~%y0 zk8iUeANA1D%plM)JL)|!g+&DsOidH4ag9Y|5~YWZ(hC$2K84Z~byP$Iv2HU}VN^95 z&Ej_!8C({~U2XNiko+%N5|RQcWQtM=Ej>jNP(OZ%RtLy~8)?L#g-3S@S#(_qmghqF z9{-1{==`7hJd!SVXGi}w4UVjTiFZbz+cjuJaF9rJ zl+e(y5VHqO$M=nvGhWT^Umm399$Y+U_`o#-zd5Q|HS%9Bde3{W@sl>gnmNe0# zvAUk;JCCnEcoZ&hn6m77>rOh*=#3G*McSMAItCaL!W;YgG!rrDKeVZ-OAb8baQTTiPtE`ZP+` zFvTSMMrix3=r9FLD7e+Dt$rbiCMlKBZ}r}oQDZ_iG(?hbC@iPZ5kgG>3tFwb# znFRiH@jZ++TQ&P$_T74Dq@qQ#8LC7)xH4#CVdK`@q#v4lssw5oLI8jjW*2!c@mIAB bSZ&qPCeKHYoo;;Gf5qI9P81|DeQXmzzFGYF literal 0 HcmV?d00001