JFIF     "" $(4,$&1'-=-157:::#+?D?8C49:7 7%%77777777777777777777777777777777777777777777777777"H !1AQ"2aqB#R3b$Cr4Ss%Tt&c$!1AQ"a#2B ? }XuAo)8^ IƟ`vUp9jY0Ǧ w)E허2jU`SEKw5]kSno!]:?jc\غV7/9N+{t#8zd/޲3F/=ź3GNquV"/4:{z%ۣI'D@ %88^f}VV)S_2ed^Mx"͟?UC62Q%чmO͓ cq0rŖJ\Õ_Sݶ'|G.q޾D U]nP%EF>˲E"d&'f2s6H]4w IS˶4VbaQ+9]XtNx:M0JNxϙ⟟"{nr;|{%vo\z-wc,*|k}-m55o4W9ؓw߱Yzk .=/oϡȴ^9ҧʹamtQԬZ]4?egjrQ}+)MleE]MPEn!`IK2RUEwVIoͷcp;lśe7΄uN ;rПV8|e\׹9Y-V_G.)XԢOv<;_"ڜ]ߙEr݊'K{KuBJ}KI}24|"v)/ʻo5)6-Tjd7.C]Q&lU,Yk1P4~UKZs|$kX6+屷CUq+N(jlGrpG&UB3#k3\9qfg7O8Kim(AJOO~C#e`i0wĦij$cWh<dtQߺ"NOtG+ZǪ]b5%]v5$)u|qZ柡s-rۖu$MKڎCmN_V'/1u,21pvlc>қeNnֺ|bkl=lǷNOʣlz*]»vȎ[)j[fs[]:s#m6Qt6*Q+`};ßj[F_jcv`r#w}|k<ڞ/r53N8>Kh q_-_??@enſEܥ\D\YAEo+ ޟd}IcY7+t{=ɩ>}i\\JfxzVdSzᔢ]Q^CJի\iceitMM5hڦg')^ et#ۯ"ÿfF->4iؤ2ݷ6#p6^-R̫gETj^I.kӽUp~D9[:/>h> \gJ|ۿؘ>ml9jMK =+*2i=0RiͶۗV{"u]IH`9J_˹KƼK$X-|=ve/ bjxw.9i%NqVJcFYKcTtO,F;%67vYb8֝qq0tUt=DvawsS~~Edzr^F-v{c++ݔ\|9Iy #nOavOY=3690Tcrilwa\˓m$?箵S6U c(.~R7suMhqcMOnKoc*ȣȩEd'J ܜk*_q}%M/7c.|;trddbsdcJev85̤iW Ę 8C# .딖e$sk80^\J众2)Nm~|Idj_ O+6ǻ#(MIz4Qo:օY,:q]̌"lK}{F]ζ)h>ʶ ^ue78_G#rqv$wkk[Q c+վ+ĸZΝFB]VzoiJRke&Kgom_7Wef_7,osJɽE%lzBt>mRs)v8'P0ֲtrOg4p_2`GlhYڦDF/ӚKmtm'P2kqU765fJY:y؊.ox%8V_ִ̌ܞjpqwЮQ;iUcNoOoٸcY w*4soӵkqf$?-jy~0{>?DaL8XL/ɞo+'8 {ʸxգj#Dy)wk̘e۩+%}~;ڼ5xek|y-%ڱ-ʜe:EEScÚ5z|r'&I&яF*F7|[nRF =(4ۖ@. n7@xx:N^8Bg%u/ny6&dR{?8U_Q6Z߯-oh.NR]} qi6~H(j7*uF&l&o8ts]/P89:jW*$w׹Ӌ FxpsCJi.7N q4WU_}7*M#qWiصnk'4ݍl*t^ c<'d:~͗enFQRz9v~ddoTZ̚k7X(wUswO̙fոҁՕ[$IAI>WW~ĪEѢNoeutYߑ-Eixιpxq{FnyfRrjqU᫤]>wPU8)Y-7Wbq㛋w:7ܣ].j%K:y4] %9$I%pT(󨪙VqiYٓ4y~5S/XTDZM2lȪ; S~Kx:(Mn0';-{*qV&|W3S+\֔a{R{s=lYmN9Fn&o'}Vi( ?*qV5ѼCNsM饏zߴ$^O69@ ,$y|jE;gW/u|M?3+ZՕN86յw%|QO㏏S\E#ddsgl+Scl3~~CԕQľ?5_ z߿t11OĶ0>oB9E/SOSk+b&Yn>$툧eg) "!܉(1 uBoJ)/t/,:=7M+1ܺ#CmS^Nz 6[u&]+|Dfj:uZ5-Z^TjMtm>cȳ NdT_,M#Ex;pt۴ͮ#!N iKl!zPծ~$1SiO} HI&g Bf)b%Ko̧kumEnص;V?j>nltOMVۆl>.WueYaw2+qK,?uHiqqSM}~gu3xbcWSy/Xc{%sZ]uaUM;7:cb5G97'7þյW,;$ܛyVjl޻y7S;o6gf.Tг[7/i1Z^rE cUF'P1-?%u&q{fw~27ޡ ^w$?SwP[=R3Y73 4x(Kk&rLȫMKn:RjcI?3Al`vض[POĖSYujj6v+-[xҵ=~zNN>\ɲQ/uufo*e6l;31붏.>w6=7#7dFDc%ƶTbd;2/=?Asr! ~ZSS~I"9y]Hn,ĊJ7S}cK"amCg3yP=RQɤW}t;-{F+v+RɔڎB?º{SV묖kۏmK~%.Q;OfEf_Y/F-V-MdD)m.ZՍ8Y*h[g/6ydmCc[rdfʾ䖗gd$^֍^ʅѻL|<[݉\߯RiJUo';œN?B smS ܹkس,mRE^ѣlJ&.ċ԰YO:޼f\Z'HCѯU[ʩ1ff4S-٥YxTIGLiыr }L)edׂ*l|ٚuoxӿnWkTbbVm zT_'"x5Vިxo1ج^Fq6Sd3ws'/ڞ6m?}1OsRGݝ+,~ڬ%^p1ef5c25vq~﹉ă[r-eq] 8+/ESj}?mUE.xYK3"oƔ^Y9I]I ޑ" &*4.Jâ}ټQbXKJ񽼀ncg`+riܭ_'Bֽp%bX'7cB}WPm|zHָLJhj~E>i~Z$297|_hyΕ&s}ZϷ *j]:v.HK<SP8`Pƣ)r ,}8Wk[ArHgn=о7:J]TTP>OOj J_KyB\Ԥrm嬷ȫr{ݙ5R(FRЪ6q}KLmR'eޖz6[YތesYYL5Tr7s\^rؙV͸컬j5d?yk'b S }kra^ߚRH)[sg.fLM\u= vJQ]rVkZuoN}#G?yjO%|i2fKoӰღC P_Ϳ6Zr{e/m$i}9 G2')YG9KY>|1ӫ +v+i;h\Q@˿Lӭn˖ 7ck>Vr.D0)hC<˄4"0[eԬݭe+l2s3ss oX]1r]+VK vI;mZ')R6e5=/i@]H^Z۬՝EW.jƆf{8mXMV~_̝z^VR}T63}}k3+k3:j1Phlpi{欍BȽ}6w73GtUZv>4eUj$ xz$$D/߇ߟI"uk̜aƪ*ke/F:dһ_PE1ݡkp(5ʏ-ɮ{Yllԧg!ܝ g]i-umεŸxOê^=PR ##XeMy%2L~󜺶Hm ݙ2t_ƶz7'\Z4T<"AM-&xaC]a5.huQ۫$cMμ|h;.J.o߸sE-zU{d];|YLSMvSEneNKr1B[]NeonNߪ$4̘FPrkxޱ=0lr7Q%=$KQ;0r*XKdGۃ*]w-npᬶ\tt4>Dc[Ouo3/)-WҴ xs71eԤm*ٖ웗H''.Cnmy]݊Kra[9)Y#2U6d7tf.[R.GdE>#O_.+-K`{KonR_ÕM/)?:F,Xo1ƽRmz8C]lD %(x+d2Ah+\CCLJ!D65x\ȼv)\Nrp*[YُfL*PyVΚuWA K4hyYdwihNIy#ub?4NDϐ'4 :nFe(o%ve@@xl-k%QƭRP&kεMŪ-Ys2u ]T!}8*TQnZ}v =~mԧyDM&8K>2|Bnugܷ.wvCs̼5F^ubES7ݢM&4Ź-~mKx1((sr!M5uy\q)oy|a)ˣ,A?w"T휳2\F}PR-<2%`~4Z5\W"(USkGpT(~Qj>ɰ쏳ǓSKKx's]nEf'.iݙL>Moƹk7ݭ[.г6lk<;?)#E]xFU7'>vF%R;t:Җs}NSBWX=Y8ث}~G)S^^ƽwR[)/Fm-ڞTK~˓Z]U;RQ=M/"NԝP[-Y9t_8V+}P?Ue{M/O&WWKvc#r'KM'p[±vtpRC/W|7K2Rfm;ljm%Z]^T[6}6iTC }L[uxg7(Z}. SRI)jҞzȶ쳢oYRw$ŷ"J\ǭw{u'R taF{;3hHB\RP(*ZQ]y;;k٥nWbGKv-V?NDҞkd9@z LJ}Kc9C*?V-*[*۸-0.|󲝳ߗZK#%_OFGF$kC$[NNJ7Yn[k~Xzc+Sʲuhsw^^4+nElbƮKD,}YLV=i=|p|_=b5mȵ(~,em#Xƥ.sVoEaWXc.lY uG\m';'*\ӆ}|˯UfQBvo}/"zw + qvMrQ[[AdU2ٽCGgjؖS~Ev%9">$_2Sߚ%ѽ7jX(t#21r{̬F]b()?r[Rı)W[O/6]XL9 vuLh-Ȃ9"'7f!Փ䮿Bf}[lag֧]?Pc#D9EmfK7o*})+n!]qIo^FrNVNo!Eƃd#OP?%ۋ(mPu93ۣ{}2&$%cZ߯LҚY);U afԶd,*'6_?B:R~}^̬~mJ+vC}Ѩe"MY+mi :s쥸;iJeYvBddeK|#5/mzR]F2 JHUU )/S{Ic$=: W)>} @0#URsR=w"L{+ɞ)d|*qq2>[nƨDۋ-G[6½J|{Ѿ4MwyG-Σ Ze{ug>2|'zΤ2%xՑ*<Q̥T')uLkjn(zF-JOR}wn~FV5zq2m'^VS=7Y^RdfeO)>EpX붚w*r*w˿^kڴ{J;K۔sRŶU]p\zn@dx6[+yeH[_m_/I&mv|M5&&-G"v۴^{vg8Y(K_~h0e AxfrzڬkhS/Vy1ϯdW3'͹}{'V-:MW(V/ͷ*E7s\EmEW}bUr'k,P{9?B֫ #[uNrB,wo^{fdF(5tRf.2J-/:~ t0M"d_/c^32*q]yLl^2[ݥZc*vtm213r'tSuM-Խ#o/HF+2VEpmǦޟS?Rs+t:u G8n,Ԛf,hY8SX*rKf>+cpruɬ=DMrXgϸ:~ɲ ~]'5'kElw\=ڞAG&')G9R\_̝1K;nPg&T(ի[^Jҟ"qoӸ.W}3mF>'$<\U6-~?x?B~{^xkpv-vlߣe빹j\(ښsuu6lH(qoaYt?x8}Ie '@b%TݲygV.+O9/W4MsCMuFjYzG.{ds.k(>G~K?ni-=R r}r ?s̥%l5Ϛ9IN6~۩RĢWNʾE[|nb.HY—קWkr1ҺշMNDp)^¸R:w;u1 12]T/Uiʹd%2OC2K*r5S]g凫5 UQ.ȫ– /i91njFkQxuJ1rn%XDžy?s˗վuMGƋ/m^J*RsF))uF,'l{=|nFm9:N\%u#tnXE->e2Y0PũjUȨEŭ|'eʹ[o{Ցms%CGg/}t|snzrvm\g}cÊ94Pvg'L}ّg궮ԱߢO^f.W-sT]M˔ېе<^Н'KuNn_Vl8*Kж^ xsuW51-ￖFzƉT-kY/9wzDޯ/XlW)gypǚjDɨ~{ݤHCim.[>rqE_Uرx/>|L64%aj;fxӱF(K֓J9՞ -K> I_5Enn´&=Oc%o̟IJZF$۲5I9Wݚ n.WTuѲӏ[4U/9.2zX5\j3ĎEsMq4%9.d[7јc9eNa+sjE';%s#ɤ`ףS=WI쫢.Mv:j/[3:rTF_zt:.z%udW%]xܮVz$Vŗ49[^y.խN~M&mx+wGR~_4KC[ʻ:v>03߶v9x-Mȧ$c:lrCWjeg%ֹ_Nh՝Qɏj^ϛr^.>WhlE5yֵ6\W^确]*гc&^NI[oCDn.ߑ!,m&M_/'Mn$s\r^8|uSZZ1|LV<(zq׮xmٚZƏ%.Ԁs^2𱸒O#&,s[mײ9kޖCoSq&俙qxP.N] 2UǎsM2iN.f r[mcQZmFُE{#[TbҔ*sfaSrn^8N<\_'MarJ6 EQғ|F[S'[~q~kmn[_x?B f5Q١X=g(~[Cx}GO ĺo'e)~dq(Ot`sN=~heu ::m'Cjj>~5V柙cyQD%uqEc{[l^U O]b~eŦۑ'W3&' 2V.^D%G S6\wYNO$. O+^ŵG~haEs^=1*bICzFF4O#,Wu3허ekB\I'tWMߩOG3iFz{rgeM9g r] i3gk&u1r/1kVgR-ɿuF .^;3;?3큦bN̂r4ovMkڞ}[:,IVG<};*-2",>K%bK2Ƨ[w!)ˤ;d?4%Ul2ږec4#ōIw^R_/TFX+*FM[F|a'ߚ2SIMeVGn ~&Y Ym(?ԛ],=|сG4yjk"Q^~ԗ^c,qqrg^-:Uc[E8>>k|nS..LBIc>3i|ZEZXAqm nuOm<; X~mrK=~ ƱrSN<U!F΋WS/|t?K)zd} ,C"ovx?bբs3mX3桭X֖˦kFddhg}$ggSo5jL*NdJis$ EQ\v=0HxzyW~FT_Ƶccg,&=_V(%kq+_÷O'[_[Uڽv F $Ξ9n5EN/4Yy/%*} .jΔ`V_6\VͲohzfOgޯzpj}y}v:34WH;+x7ӻu<ݦ"mJ/=>eoD֣c4kXW-[}٬6;t[Na_• _5i5˗sٴ]+e;Joj㼶ۙyLumo5&F)F\ {(sm_M>gzcr)KU̠Ħ=VDd'h;-aŤ9KٰqQܫަazMp4bk9 UX.ͮ]KeS5Uq[¹X0ɦ6]roFjʧ2׏6/C6eQE5KӰmsFnIz&`z팡-ٯ.ixyك?c2//z6M4W[]_"?Õ[? Vfvӳq]I5(d|MʝzcC*mN>B2gD+><e:Gh %UkW%zJ8k_ˠ=KFRfw{sŖ^q\/{v[Ω}gLjT[t_ޕg6G~rkkMcSRKբ54?SAûO1o%[>5/R~CioNdNʛćh>f6H8c/<1xd[ŦCEk.9"ej?w&O6^ژR[vrQ.z㎩f6:V8}hi2z~ s-w]+|I9s_C~>-S&9ZFVLf7-d'pՠplJ#mm؎s(?Ʋ?/A%_sXuGNnR}_dq>1ʍ|У3]NXYZʷ/&ܛ彖LS? 6]"_t5qP5Kq]^m91jW暹U6-5WU澦M0˵f2ӪǮ.P~? _nEJTcTei)ٳrۣ%x %gs}7l9'tb~dXst# r?}Weaq>=+to)7،E*vn\e_,\NFxcivz]tM˼?Oԝ2Zrλs-ĺEtonIIfm/9^[^EBUjOnr6vI& l]%0")2䒶-+R*zyX<> -X9GUo^xYQ8ιvixٔa\t)hv}ьոVU~tK,=_wLLa?TYIo]$`N6cbi?#7;MRt<.~Q-mob\\g5췍 ڌ_?8nfJN/Y͢n3?_sϩ{HiְPo'yS??_jߡWi5q? MWȲ)8a]lLˏ--b[TXlΫRy;o5뜾$HW.mm?շG[Ƀ seo5Q}Le%*،«~uU{R$t\^%!weX:G('6WupTS&~8=jo?2_PϖE[nf6Tٯ;GLW)NM[o*\j%.gb|䭹noOX:1R)UTj74˓]D_bʝkzNI.9|^G`KeQ{mOjX/sR7evdgi7qm}ތW&4=~|YY)?7Oj}xXkF×4c.l?i|b[5Ή5j-[Y\z<茲Z$Ff&o;gErǩݦ̪/q[&[/9uuzi;PS^_/?]=ΕqK~ӛ5'NM[m_Ϲc'[oӯE#g߂vvGNRo϶o5Ǩ[ɉtov2~i<7iSȜN(G5+/ٛMTܣukj鷣/$1˒!Mxr\ߤs1ZuMQȌ^]c$CXrj#N/˦Ķ9]Nzê5zi;W,v!ŧD6zğ7uR5^MW}>igl2U2nXo{}_w]&vte\Z3 MEEe/ 2s㗼S_bIղTI}|[Ye/c]*̪9u/DmyNxSDgi `Z?.RFj۪'~.[KVb޺o濡to?E#[.^y=q4F8ڎ/GX\.YW!Z.ѕtt:?gYYyU%Uw~ri>ȦKhg,5/=>V?TrN4aWO,oӕ7-SRi*"dܽpuaVQÞd-#J2Nr:#``ѧWR-F?I-T -cOT2pr?þזgE\Ij~L9%EMoџUؙt8_eYΧWjU}e9y9z/#TT-2dLt3H=ڼcKb'"uIٓ'[[߱F~\2]r%C]^VCLjm[cJNryf}ջ.[DEoRՒb'>fVy_c6[K4Na5>{ɳaw/Uj.Զ_K~?IeJ7OQx3IgFc*جɊǽ-o3Ӭp / ]7V*ENܜ[r/tOJΉw*ʨ*JFN^.WZeLgUwKi/M9y8dkOᛊHxGĶM*&#h/U|6D(uFyE5hYxiSEVm^D|,ۿCj;<*ouOkYpΔ2{x-L] !k2ا#IM'a7:M}M1Y儭Mnk[/;4Uwkkɫ%aɔoXVV$m;2Z4i9:>\Yů= ?[{t6,~!c`Un+dW.gKyIB]l+3kض(\MZ\}>k\C~閹l[ů]VNtƸr몮X+U>v'nv{y7s[г̭9Ctvt% GqT8=wa(6\Rd柮YWv^Fd^\+緉,+=-^S"k:NVu o[_TIѝ椯bF/G㿏dΙ?T}K-T)W>s?3M)V*,;P\,}B u{rDexڥVFfw}47׋w}]Դ 1dmk1V%/'T:Fǒ_TEe[l/l/ٯc{Ƀ[~`zj⾥r}Vܪ{M8Qv]$mU]8J2MngcxY?鑞.9HjxSy.fS(|]MgcK2$(jRQ3XO|<f:Jq4& fw|$N )A8ת99 mFNM*Dϒ NoIa9i9y?:D⻧߇\7ɧ]mu"-˥5/w̨_ 7DK['[2"(%xzT\*GT"+<,yX.lEJrfo?.4N;l>jmZߣ5FdB3\r,t,./S]Q{tm5lӕT~A [fv7Iہc: ΪN7I]2(|o$NLW"#~Dͭ=v-Mv{-lqn{I3xn'6.=DƟܖަ~deQV;k2Ei\[bӴ1_]OhZl朠&t3xkei+c\'ZԪ'hK梿X@cTԫ#emIz6e^i?8 NBc̆f+MׇdC]YSd%lώ8-c7eι/}_con/no\핍~[WNReXMo+اn ?#Ͷ-AUFN1V4!y,{1a$S﹑;Ǚr"__[o) xk}7EI/riwؙ7mR}`|yrEVdo/B# uٳiNQKQkᑑ^d@/=ˑɒ768fsuor9=7ףܹճpMr-$1uySOZN?đrqզ9F q=.!T?ػ bf{¯q=$^:!ES߿ Fu\OS,8e^UוS^hF4BQƺȪw-kF39@X06 Fv=Q^|ƞ5}2tnmG_|Λ(|%](-5>KȁN$=6lq).12 V6m$ׇlOcҫܸ K{;ľ>+Q?Rx-Keu uMy$i B}G*h$Q -W[-&a"[i\}~Ek$<~c{MffS eS.#\^lMiytު]9S{u4 {DFޅSź}R ]R$y;r/P̙3niXMt;&!rxw\ZFmQ"w\L{^۔K&/gr:m=2%5bwE"^e[\$ɟPi!U_rdS2d?=[!(I.rC QZEim%}|YmzZ_ά<ۡLQM|` ybPȏ}?]Eu[`kҫgFb~F}Q8NP>5lӳ^-K%Q}$sx7SvnfTƸ|Kzd'_ⰽח$4L Y?qy32t j2e ȜrJ{mبhۍUU'p#8y'ѝ=i+Tĩo7WYyČkL5؝M=%"Nt}eXW)N.~sv5pɮ sSQ[+-/}kVk'FEɩ9SE&T=&\緵 --tf.9Ѳ4_##_ɱTFV؞~YTddS&s=䟚Fb1._5}~gM'p#,U hs--XG wtԹTi7M:GYK5'^W?C>_Gq/S&d| k_gO ӊiJeHU G_ Êg#),}-:5>V1emq}t}q?meKU:BqJeiPɗ#\$sI} Z生ƫoo=V=pVcUg"%wEm叡vIdhrȔ~F]p58_.,O|'Ɇ^L!c6OWӷ{x9?Fp?ceOuT+Uɵݹ&gx9i퓃sxGIm}_3Īr#:ԣ?4בc[jö#B7KʌWNo)=+c }YvP{lv^r+5Vxx_:~=̌Q}CTy+Wh鸚f$101뢊F[#--Y\i@l)W8/E>8nlj/ktOľ,q*[sE[]:?ZeQvŔɺ|j(Wx,LW=:S?κq%81c)jJvODLiW,{96vr-2}-EH,}%3k#l5gl~x__W Sڎ 8YJQvA=QIWju6-X9$kWЩCI4UWd'&O/Cf=Pi/#+>n$KYst܅y4ʷD^~%~myj,s_4Q}΍Cή;SW:h=Ff{.B/inȇo=-T͸OY2}hlK}.m7-z?,f-/^b\QWs/_͔/3In[6M;l ygؼ!WUË_)D9YL4_>f}ϵ3hV5Oѣ(l8?L4蹥[-Э=7V{&ʢPʼ*3cMz>u4@[oM gKS[jy"Lھzɵfx)GE`ֿ.=kJ>/iˢ[j-qץQC B@o V(ʯG?Bܻ\I>=K-].(vOE.5׮=/Pf^&$caY9{3މ%YOxZ~6Z;;ԗ.NJzş/YϖĜ%ѿO^tY$ν4|e}2ɶU9A؜h˺LrIm%J.|I]kG|DzU k4'(T\9߱^!z -:mW^ <= <^2*;Seq(6ªsHf5ʸO{Ilr~G uJY^k5X_y;5'59O@ƣ̶>pnCOvNwX4oUUf]Џe%MV9Xm9]x'Q=82z)c/~1\~LSow>ﺍƻUql~Sqo羘sk}VjG71kYؽ]b4qnMӡ; w@̇IL㿗[43)]=v*)EH'a񖳋ҎTkxuXGK& ZIR(M8?:ixJp-dmckpu*%N^-7E3='ceE&';_J'Mw𶥏Y9+d9+>!e_Sn|VX -TZu]Ģ/6\ckr /ޗ/z[y.N:*k$ }Yǭ}GUm^-%dm;K_#ctBsg2:8rz-VE|T w.}w9NEPGnoCe8/&3qT}MJ̙Mۗ~哳,-WI_Bsh+~͛vN{ZdYKݲkr%+lo*re-ه?:vYqFfCsqMXRķ{yqgrx.oǓ\xdڗ_ZC9WomX|KmV_%UJܷr$drȳL~MoKyYLic Jq<1$UuٯTד374s<ĕ96춉r9 pGc9=p^:)ZJb&VӝXٽ 0/X& ۳*_ԙƏ.5J 6<$$6B0d_d?hqd>XCe- wO@pg:.>$.Ϣ~L޲|,{-ɪ2.u/Ds-[ُiVIWK5M#Fܭ3?x.)ۣ,wJ)Ȳڣ-#fbdq&Tͧ8Q,YqQ)/R­?\k˔[p_+ogzP[6r^o}_kT}JiJ;<ivEH8wI@MOPʊ\#+$%PDF-1.7 GIF89;
ANDA PELER
Server IP : 182.253.108.180  /  Your IP : 18.220.227.250
Web Server : Apache
System : Linux sma1wiradesa.sch.id 4.15.0-213-generic #224-Ubuntu SMP Mon Jun 19 13:30:12 UTC 2023 x86_64
User : wijaya ( 1017)
PHP Version : 7.3.33-10+ubuntu18.04.1+deb.sury.org+1
Disable Function : pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : ON  |  Sudo : ON  |  Pkexec : ON
Directory :  /usr/sbin/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :

[ HOME ]     

Current File : /usr/sbin/pam-auth-update
#!/usr/bin/perl -w

# pam-auth-update: update /etc/pam.d/common-* from /usr/share/pam-configs
#
# Update the /etc/pam.d/common-* files based on the per-package profiles
# provided in /usr/share/pam-configs/ taking into consideration user's
# preferences (as determined via debconf prompting).
#
# Written by Steve Langasek <steve.langasek@canonical.com>
#
# Copyright (C) 2008 Canonical Ltd.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of version 3 of the GNU General Public License as
# published by the Free Software Foundation.
#
# # This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301,
# USA.

use strict;
use Debconf::Client::ConfModule ':all';
use IPC::Open2 'open2';

version('2.0');
my $capb=capb('backup escape');

my $inputdir = '/usr/share/pam-configs';
my $template = 'libpam-runtime/profiles';
my $errtemplate = 'libpam-runtime/conflicts';
my $overridetemplate = 'libpam-runtime/override';
my $blanktemplate = 'libpam-runtime/no_profiles_chosen';
my $titletemplate = 'libpam-runtime/title';
my $confdir = '/etc/pam.d';
my $savedir = '/var/lib/pam';
my (%profiles, @sorted, @enabled, @conflicts, @new, %removals, %to_enable);
my $force = 0;
my $package = 0;
my $priority = 'high';
my %md5sums = (
	'auth' => ['8d4fe17e66ba25de16a117035d1396aa'],
	'account' => ['3c0c362eaf3421848b679d63fd48c3fa'],
	'password' => [
		'50fce2113dfda83ac8bdd5a6e706caec',
		'4bd7610f2e85f8ddaef79c7db7cb49eb',
		'9ba753d0824276b44bcadfee1f87b6bc',
	],
	'session' => [
		'240fb92986c885b327cdb21dd641da8c',
		'4a25673e8b36f1805219027d3be02cd2',
		'73144a2f4e609a922a51e301cd66a57e',
	],
	'session-noninteractive' => [
		'ad2b78ce1498dd637ef36469430b6ac6',
		'a20e8df3469bfe25c13a3b39161b30f0',
	],
);

opendir(DIR, $inputdir) || die "could not open config directory: $!";
while (my $profile = readdir(DIR)) {
	next if ($profile eq '.' || $profile eq '..');
	%{$profiles{$profile}} = parse_pam_profile($inputdir . '/' . $profile);
}
closedir DIR;

# use a '--force' arg to specify that /etc/pam.d should be overwritten; 
# used only on upgrades where the postinst has already determined that the
# checksums match.  Module packages other than libpam-runtime itself must
# NEVER use this option!  Document with big skullses and crossboneses!  It
# needs to be exposed for libpam-runtime because that's the package that
# decides whether we have a pristine config to be converted, and knows
# whether the version being upgraded from is one for which the conversion
# should be done.

while ($#ARGV >= 0) {
	my $opt = shift;
	if ($opt eq '--force') {
		$force = 1;
	} elsif ($opt eq '--package') {
		$package = 1;
	} elsif ($opt eq '--remove') {
		while ($#ARGV >= 0) {
			last if ($ARGV[0] =~ /^--/);
			$removals{shift @ARGV} = 1;
		}
		# --remove implies --package
		$package = 1 if (keys(%removals));
	} elsif ($opt eq '--enable') {
		while ($#ARGV >= 0) {
			last if ($ARGV[0] =~ /^--/);
			$to_enable{shift @ARGV} = 1;
		}
		# --enable implies --package
		$package = 1 if (keys(%to_enable));
	}
}

$priority = 'medium' if ($package);

x_loadtemplatefile('/var/lib/dpkg/info/libpam-runtime.templates','libpam-runtime');

# always sort by priority, so we have consistency and don't have to
# shuffle later
@sorted = sort { $profiles{$b}->{'Priority'} <=> $profiles{$a}->{'Priority'}
                 || $b cmp $a }
               keys(%profiles);
# If we're being called for package removal, filter out those options here
@sorted = grep { !$removals{$_} } @sorted;

subst($template, 'profile_names', join(', ',@sorted));
subst($template, 'profiles',
	join(', ', map { $profiles{$_}->{'Name'} } @sorted));

my $diff = diff_profiles($confdir,$savedir);

if ($diff) {
	@enabled = grep { !$removals{$_} } @{$diff->{'mods'}};
} else {
	@enabled = split(/, /,get($template));
}

# find out what we've seen, so we can ignore those defaults
my %seen;
if (-e $savedir . '/seen') {
	open(SEEN,$savedir . '/seen');
	while (<SEEN>) {
		chomp;
		$seen{$_} = 1;
	}
	close(SEEN);
}

# filter out any options that are no longer available for any reason
@enabled = grep { $profiles{$_} } @enabled;

# an empty module set is an error, so in that case grab all the defaults
if (!@enabled) {
	%seen = ();
	$priority = 'high' unless ($force);
}

# add configs to enable
push(@enabled,
     grep { $to_enable{$_} } @sorted);

# add any previously-unseen configs
push(@enabled,
     grep { $profiles{$_}->{'Default'} eq 'yes' && !$seen{$_} } @sorted);
@enabled = sort { $profiles{$b}->{'Priority'} <=> $profiles{$a}->{'Priority'}
                  || $b cmp $a }
                @enabled;
my $prev = '';
@enabled = grep { $_ ne $prev && (($prev) = $_) } @enabled;

# Do we have any new options to show?  If not, we shouldn't reprompt the
# user, at any priority level, unless explicitly called.
@new = grep { !$seen{$_} } @sorted;

settitle($titletemplate);

# if diff_profiles() fails, and we weren't passed a 'force' argument
# (because this isn't an upgrade from an old version, or the checksum
# didn't match, or we're being called by some other module package), prompt
# the user whether to override.  If the user declines (the default), we
# never again manage this config unless manually called with '--force'.
if (!$diff && !$force) {
	input('high',$overridetemplate);
	go();
	$force = 1 if (get($overridetemplate) eq 'true');
}

if (!$diff && !$force) {
	print STDERR <<EOF;

pam-auth-update: Local modifications to /etc/pam.d/common-*, not updating.
pam-auth-update: Run pam-auth-update --force to override.

EOF
	exit;
}

umask(0022);

do {
	@conflicts = ();

	if (@new || !$package) {
		fset($template,'seen','false');
	}
	set($template,join(', ', @enabled));

	input($priority,$template);
	go();

	@enabled = split(/, /, get($template));

	# in case of conflicts, automatically unset the lower priority
	# item of each pair
	foreach my $elem (@enabled)
	{
		for (my $i=$#enabled; $i >= 0; $i--)
		{
			my $conflict = $enabled[$i];
			if ($profiles{$elem}->{'Conflicts'}->{$conflict}) {
				splice(@enabled,$i,1);
				my $desc = $profiles{$elem}->{'Name'}
					. ', ' . $profiles{$conflict}->{'Name'};
				push(@conflicts,$desc);
			}
		}
	}
	if (@conflicts) {
		subst($errtemplate, 'conflicts', join("\\n", @conflicts));
		input('high',$errtemplate);
	}
	set($template, join(', ', @enabled));
	if (!@enabled) {
		input('high',$blanktemplate);
		# we can only end up here by user error, but give them another
		# shot at selecting a correct config anyway.
		fset($template,'seen','false');
	}
} while (@conflicts || !@enabled);

# the decision has been made about what configs to use, so even if
# something fails after this, we shouldn't go munging the default
# options again.  Save the list of known configs to /var/lib/pam.
open(SEEN,"> $savedir/seen");
for my $i (@sorted) {
	print SEEN "$i\n";
}
close(SEEN);

# @enabled now contains our list of profiles to use for piecing together
# a config
# we have:
# - templates into which we insert the specialness
# - magic comments denoting the beginning and end of our managed block;
#   looking at only the functional config lines would potentially let us
#   handle more cases, at the expense of much greater complexity, so
#   pass on this at least for the first round
# - a representation of the autogenerated config stored in /var/lib/pam,
#   that we can diff against in order to account for changed options or
#   manually dropped modules
# - a hash describing the local modifications the user has made to the
#   config; these are always preserved unless manually overridden with
#   the --force option

write_profiles(\%profiles, \@enabled, $confdir, $savedir, $diff, $force);


# take a single line from a stock config, and merge it with the
# information about local admin edits
sub merge_one_line
{
	my ($line,$diff,$count) = @_;
	my (@opts,$modline);

	my ($adds,$removes);

	$line =~ /^((\[[^]]+\]|\w+)\s+\S+)\s*(.*)/;

	@opts = split(/\s+/,$3);
	$modline = $1;
	$modline =~ s/end/$count/g;
	if ($diff) {
		my $mod = $modline;
		$mod =~ s/(\[[^0-9]*)[0-9]+(.*\])/$1$2/g;
		$adds = \%{$diff->{'add'}{$mod}};
		$removes = \%{$diff->{'remove'}{$mod}};
	} else {
		$adds = $removes = undef;
	}

	for (my $i = 0; $i <= $#opts; $i++) {
		if ($adds->{$opts[$i]}) {
			delete $adds->{$opts[$i]};
		}
		if ($removes->{$opts[$i]}) {
			splice(@opts,$i,1);
			$i--;
		}
	}
	return $modline . " " . join(' ',@opts,sort keys(%{$adds})) . "\n";
}

# return the lines for a given config name, type, and position in the stack
sub lines_for_module_and_type
{
	my ($profiles, $mod, $type, $modpos) = @_;
	if ($modpos == 0 && $profiles->{$mod}{$type . '-Initial'}) {
		return $profiles->{$mod}{$type . '-Initial'};
	}
	return $profiles->{$mod}{$type};
}

# create a single PAM config from the indicated template and selections,
# writing to a new file
sub create_from_template
{
	my($template,$dest,$profiles,$enabled,$diff,$type) = @_;
	my $state = 0;
	my $uctype = ucfirst($type);
	$type =~ s/-noninteractive//;

	open(INPUT,$template) || return 0;
	open(OUTPUT,">$dest") || return 0;

	while (<INPUT>) {
		if ($state == 1) {
			if (/^# here's the fallback if no module succeeds/) {
				print OUTPUT;
				$state++;
			}
			next;
		}
		if ($state == 3) {
			if (/^# end of pam-auth-update config/) {
				print OUTPUT;
				$state++;
			}
			next;
		}

		print OUTPUT;

		my ($pattern,$val);
		if ($state == 0) {
			$pattern = '^# here are the per-package modules \(the "Primary" block\)';
			$val = 'Primary';
		} elsif ($state == 2) {
			$pattern = '^# and here are more per-package modules \(the "Additional" block\)';
			$val = 'Additional';
		} else {
			next;
		}

		if (/$pattern/) {
			my $i = 0;
			my $count = 0;
			# first we need to get a count of lines that we're
			# going to output, so we can fix up the jumps correctly
			for my $mod (@{$enabled}) {
				my $output;
				next if (!$profiles->{$mod}{$uctype . '-Type'});
				next if $profiles->{$mod}{$uctype . '-Type'} ne $val;
				$output = lines_for_module_and_type($profiles, $mod, $uctype, $i++);
				# bypasses a perl warning about @_, sigh
				my @tmparr = split("\n+",$output);
				$count += @tmparr;
			}

			# in case anything tries to jump in the 'additional'
			# block, let's try not to jump off the stack...
			$count-- if ($val eq 'Additional');

			# no primary block, so output a stock pam_permit line
			# to keep the stack intact
			if ($val eq 'Primary' && $count == 0)
			{
				print OUTPUT "$type\t[default=1]\t\t\tpam_permit.so\n";
			}

			$i = 0;
			for my $mod (@{$enabled}) {
				my $output;
				my @output;
				next if (!$profiles->{$mod}{$uctype . '-Type'});
				next if $profiles->{$mod}{$uctype . '-Type'} ne $val;
				$output = lines_for_module_and_type($profiles, $mod, $uctype, $i++);
				for my $line (split("\n",$output)) {
					$line = merge_one_line($line,$diff,
					                       $count);
					print OUTPUT "$type\t$line";
					$count--;
				}
			}
			$state++;
		}
	}
	close(INPUT);
	close(OUTPUT);

	if ($state < 4) {
		unlink($dest);
		return 0;
	}
	return 1;
}

# take a template file, strip out everything between the markers, and
# return the md5sum of the remaining contents.  Used for testing for
# local modifications of the boilerplate.
sub get_template_md5sum
{
	my($template) = @_;
	my $state = 0;

	open(INPUT,$template) || return '';
	my($md5sum_fd,$output_fd);
	my $pid = open2($md5sum_fd, $output_fd, 'md5sum');
	return '' if (!$pid);

	while (<INPUT>) {
		if ($state == 1) {
			if (/^# here's the fallback if no module succeeds/) {
				print $output_fd $_;
				$state++;
			}
			next;
		}
		if ($state == 3) {
			if (/^# end of pam-auth-update config/) {
				print $output_fd $_;
				$state++;
			}
			next;
		}

		print $output_fd $_;

		my ($pattern,$val);
		if ($state == 0) {
			$pattern = '^# here are the per-package modules \(the "Primary" block\)';
		} elsif ($state == 2) {
			$pattern = '^# and here are more per-package modules \(the "Additional" block\)';
		} else {
			next;
		}

		if (/$pattern/) {
			$state++;
		}
	}
	close(INPUT);
	close($output_fd);
	my $md5sum = <$md5sum_fd>;
	close($md5sum_fd);
	waitpid $pid, 0;

	$md5sum = (split(/\s+/,$md5sum))[0];
	return $md5sum;
}

# merge a set of module declarations into a set of new config files,
# using the information returned from diff_profiles().
sub write_profiles
{
	my($profiles,$enabled,$confdir,$savedir,$diff,$force) = @_;

	if (! -d $savedir) {
		mkdir($savedir);
	}
		
	# because we can't atomically replace both /var/lib/pam/$foo and
	# /etc/pam.d/common-$foo at the same time, take steps to make this
	# somewhat robust
	for my $type ('auth','account','password','session',
	              'session-noninteractive')
	{
		my $target = $confdir . '/common-' . $type;
		my $template = $target;
		my $dest = $template . '.pam-new';

		my $diff = $diff;
		if ($diff) {
			$diff = \%{$diff->{$type}};
		}

		# Detect if the template is unmodified, and if so, use
		# the version from /usr/share.  Depends on knowing the
		# md5sums of the originals.
		my $md5sum = get_template_md5sum($template);
		for my $i (@{$md5sums{$type}}) {
			if ($md5sum eq $i) {
				$template = '/usr/share/pam/common-' . $type;
				last;
			}
		}

		# first, write out the new config
		if (!create_from_template($template,$dest,$profiles,$enabled,
		                          $diff,$type))
		{
			if (!$force) {
				return 0;
			}
			$template = '/usr/share/pam/common-' . $type;
			if (!create_from_template($template,$dest,$profiles,
			                          $enabled,$diff,$type))
			{
				return 0;
			}
		}

		# then write out the saved config
		if (!open(OUTPUT, "> $savedir/$type.new")) {
			unlink($dest);
			return 0;
		}
		my $i = 0;
		my $uctype = ucfirst($type);
		for my $mod (@{$enabled}) {
			my $output;
			next if (!$profiles->{$mod}{$uctype . '-Type'});
			next if ($profiles->{$mod}{$uctype . '-Type'} eq 'Additional');

			$output = lines_for_module_and_type($profiles, $mod, $uctype, $i++);
			if ($output) {
				print OUTPUT "Module: $mod\n";
				print OUTPUT $output . "\n";
			}
		}

		# no primary block, so output a stock pam_permit line
		if ($i == 0)
		{
			print OUTPUT "Module: null\n";
			print OUTPUT "[default=1]\t\t\tpam_permit.so\n";
		}

		$i = 0;
		for my $mod (@{$enabled}) {
			my $output;
			next if (!$profiles->{$mod}{$uctype . '-Type'});
			next if ($profiles->{$mod}{$uctype . '-Type'} eq 'Primary');

			$output = lines_for_module_and_type($profiles, $mod, $uctype, $i++);
			if ($output) {
				print OUTPUT "Module: $mod\n";
				print OUTPUT $output . "\n";
			}
		}

		close(OUTPUT);

		# then do the renames, back-to-back
		# we have to use system because File::Copy is in
		# perl-modules, not perl-base
		if (-e "$target" && $force) {
			system('cp','-f',$target,$target . '.pam-old');
		}
		rename($dest,$target);
		rename("$savedir/$type.new","$savedir/$type");
	}

	# at the end of a successful write, reset the 'seen' flag and the
	# value of the debconf override question.
	fset($overridetemplate,'seen','false');
	set($overridetemplate,'false');
}

# reconcile the current config in /etc/pam.d with the saved ones in
# /var/lib/pam; returns a hash of profile names and the corresponding
# options that should be added/removed relative to the stock config.
# returns false if any of the markers are missing that permit a merge,
# or on any other failure.
sub diff_profiles
{
	my ($sourcedir,$savedir) = @_;
	my (%diff);

	@{$diff{'mods'}} = ();
	# Load the saved config from /var/lib/pam, then iterate through all
	# lines in the current config that are in the managed block.
	# If anything fails here, just return immediately since we then
	# have nothing to merge; instead, the caller will decide later
	# whether to force an overwrite.
	for my $type ('auth','account','password','session',
	              'session-noninteractive')
	{
		my (@saved,$modname);

		open(SAVED,$savedir . '/' . $type) || return 0;
		while (<SAVED>) {
			if (/^Module: (.*)/) {
				$modname = $1;
				next;
			}
			chomp;
			# trim out the destination of any jumps; this saves
			# us from having to re-parse everything just to fix
			# up the jump lengths, when changes to these will
			# already show up as inconsistencies elsewhere
			s/(\[[^0-9]*)[0-9]+(.*\])/$1$2/g;
			s/(\[.*)end(.*\])/$1$2/g;
			my (@temp) = ($modname,$_);
			push(@saved,\@temp);
		}
		close(SAVED);

		my $state = 0;
		my (@prev_opts,$curmod);
		my $realtype = $type;
		$realtype =~ s/-noninteractive//;

		open(CURRENT,$sourcedir . '/common-' . $type) || return 0;
		while (<CURRENT>) {
			if ($state == 0) {
				$state = 1
				   if (/^# here are the per-package modules \(the "Primary" block\)/);
				next;
			}
			if ($state == 1) {
				s/^$realtype\s+//;
				if (/^# here's the fallback if no module succeeds/) {
					$state = 2;
					next;
				}
			}
			if ($state == 2) {
				$state = 3
				   if (/^# and here are more per-package modules \(the "Additional" block\)/);
				next;
			}
			if ($state == 3) {
				last if (/^# end of pam-auth-update config/);
				s/^$realtype\s+//;
			}

			my $found = 0;
			my $curopts;
			while (!$found && $#saved >= 0) {
				my $line;
				($modname,$line) = @{$saved[0]};
				shift(@saved);
				$line =~ /^((\[[^]]+\]|\w+)\s+\S+)\s*(.*)/;
				@prev_opts = split(/\s+/,$3);
				$curmod = $1;
				# FIXME: the key isn't derived from the config
				# name, so collisions are possible if more
				# than one config references the same module

				$_ =~ s/(\[[^0-9]*)[0-9]+(.*\])/$1$2/g;
				# check if this is a match for the current line
				if ($_ =~ /^\Q$curmod\E\s*(.*)$/) {
					$found = 1;
					$curopts = $1;
					push(@{$diff{'mods'}},$modname);
				}
			}

			# there's a line in the live config that doesn't
			# correspond to anything from the saved config.
			# treat this as a failure; it's very error-prone
			# to decide what to do with an added line that
			# didn't come from a package.
			return 0 if (!$found);

			for my $opt (split(/\s+/,$curopts)) {
				my $found = 0;
				for (my $i = 0; $i <= $#prev_opts; $i++) {
					if ($prev_opts[$i] eq $opt) {
						$found = 1;
						splice(@prev_opts,$i,1);
					}
				}
				$diff{$type}{'add'}{$curmod}{$opt} = 1 if (!$found);
			}
			for my $opt (@prev_opts) {
				$diff{$type}{'remove'}{$curmod}{$opt} = 1;
			}
		}
		close(CURRENT);

		# we couldn't parse the config, so the merge fails
		return 0 if ($state < 3);
	}
	return \%diff;
}

# simple function to parse a provided config file, in pseudo-RFC822
# format,
sub parse_pam_profile
{
	my ($profile) = $_[0];
	my $fieldname;
	my %profile;
	open(PROFILE, $profile) || die "could not read profile $profile: $!";
	while (<PROFILE>) {
		if (/^(\S+):\s+(.*)\s*$/) {
			$fieldname = $1;
			# compatibility with the first implementation round;
			# "Auth-Final" is now just called "Auth"
			$fieldname =~ s/-Final$//;
			if ($fieldname eq 'Conflicts') {
				foreach my $elem (split(/, /, $2)) {
					$profile{'Conflicts'}->{$elem} = 1;
				}
			} else {
				$profile{$fieldname} = $2;
			}
		} else {
			chomp;
			s/^\s+//;
			s/\s+$//;
			$profile{$fieldname} .= "\n$_" if ($_);
			$profile{$fieldname} =~ s/^[\n\s]+//;
		}
	}
	close(PROFILE);
	if (!defined($profile{'Session-Interactive-Only'})) {
			$profile{'Session-noninteractive-Type'} = $profile{'Session-Type'};
			$profile{'Session-noninteractive'} = $profile{'Session'};
			$profile{'Session-noninteractive-Initial'} = $profile{'Session-Initial'};
	}
	return %profile;
}

Anon7 - 2022
SCDN GOK