From 93fd164fa24e1f70e4c69fc2edfb0d4961a6683b Mon Sep 17 00:00:00 2001 From: Fabricio Voznika Date: Fri, 18 Sep 2020 10:25:52 -0700 Subject: [PATCH] Add "Containing a Real Vulnerability" blog post PiperOrigin-RevId: 332477119 --- images/jekyll/build.sh | 3 +- website/_config.yml | 3 + ...ontaining-a-real-vulnerability-figure1.png | Bin 0 -> 48602 bytes website/blog/2019-11-18-security-basics.md | 4 +- ...0-09-18-containing-a-real-vulnerability.md | 224 ++++++++++++++++++ website/blog/BUILD | 10 + 6 files changed, 242 insertions(+), 2 deletions(-) create mode 100644 website/assets/images/2020-09-18-containing-a-real-vulnerability-figure1.png create mode 100644 website/blog/2020-09-18-containing-a-real-vulnerability.md diff --git a/images/jekyll/build.sh b/images/jekyll/build.sh index bfceb2781..010972ea6 100755 --- a/images/jekyll/build.sh +++ b/images/jekyll/build.sh @@ -18,4 +18,5 @@ set -euxo pipefail # Generate the syntax highlighting css file. /usr/gem/bin/rougify style github >/input/_sass/syntax.css -/usr/gem/bin/jekyll build -t -s /input -d /output +# Build website including pages irrespective of date. +/usr/gem/bin/jekyll build --future -t -s /input -d /output diff --git a/website/_config.yml b/website/_config.yml index b08602970..20fbb3d2d 100644 --- a/website/_config.yml +++ b/website/_config.yml @@ -34,3 +34,6 @@ authors: igudger: name: Ian Gudger email: igudger@google.com + fvoznika: + name: Fabricio Voznika + email: fvoznika@google.com diff --git a/website/assets/images/2020-09-18-containing-a-real-vulnerability-figure1.png b/website/assets/images/2020-09-18-containing-a-real-vulnerability-figure1.png new file mode 100644 index 0000000000000000000000000000000000000000..c750f08518f3ffc7ad994de1eb17d903ea22a2b9 GIT binary patch literal 48602 zcmeAS@N?(olHy`uVBq!ia0y~yV9aG;VC>;wV_;wql>E%fz@Wh3>Eakt5%(sRy+YJg z+;;u+FL54D9xwKK3kn=*^4k1Qt7)(H3J-m*E-o#OE{&w4ZM;hsH;A}8Oo(%?djIz8 zrvK&7r|xM{;C!O0f08GD--ML=@7~N8bc75|#*Qr0z+xqtE;#1!b2tMH0A>Fv@$(tWP zgYK`i_ief$ZJoJ$QsLGAm(O3VwPc(8`hE<1MDpfYv z_ar!1Srv)h=A5-Jyry#dw9~tI`X{Yqj&e}q7xjFaDByiaVVWC9Qsxp5l@=$JF!LuI zPmVw1C}3H~!00HzFfmMEO{)^48soI2h*qWuUd|@Za>o=6FOj7(K9^PGuP|*0`?*Wx zV7#OItN+Tqty@+LZPm8)W~g7e=KWjUrHUWTyHj616zEK5DC9V@sNq-p6#0qD2LwNG zu&^9tI53yT{B3DR6q5s! zy!_5hx0PdE{v~ejNL?i;;B8&4b81hr3}at|x`S~s?M`)_JRJ&x$KFP|0t%$+v$p&s_X9) zSiSdn$B|F36{r0$x5(PVEW_C65bWg8pz!42n)^9=r~hBu@OkZD1|L0^cT%L-9k70u~!#Mn{1XrS6yc*_Gdl?l$t5FIsaZ zVY+{ea(?*FCHMT7EcCn`%C*t;+J{h$HoGhCujGxHla4;9a&M8JpbSbR4hDyk?6`9O zvCm4LZKn7;ey;bI*wF9m!uLpZZCS0DT|aZp^&4fI#AKIuq^!FAT9mcUppU`5K{-H| zsVQ*7EdE6%uXEpiYqfqGXs)XF^7Pfxp!^?K%`#9E=ND((bw?zq|R}=XcoL!p>c?PkgIaitpWR=lMJ7u2o$@!>Yf& z=R2nE^Ji4LFO_)Q{1Hb1iv<&Ja|6S{S!yr5!@1nA*RMN$Bff-l@9njFSLt{UZgBAqUKTJ~Jz3Aq>8$KZZ|m65SY^i^`k2+XZRC%eV`7pG|zEcd1OE z%ypAtUcrnlr&m0kpw({vkNfC(ki#BuSO^IC7|i~+MI?5{>id5W3hs_^3f%sBk6J0) zbZd{>Q#YhCh-}I$-#YO)-yf!+%->e8E$<70{q#YGg(c#Qd&?s3;;p-fBF%dYA0q`%RRg z)|B(qYOB^=N^iS4qHFJd*{Rfe-#GlL^}j@L;<&&eD8S;qYJq0Ns@qoYH}6t=w@cw| zmeLzf{;t|X;$}{3DyLh5iZzG13I~+(d=Dnw-S%_!>q$G-PusFuMYcBNQzJj$#MbT6 zhgBz9?R;0G4$30QZU>U=vNg|E1n*D2Xtn#;+Zms}c1@mK>Ub;Xp8$hb=JShhMRVKM zKK49*%;r?ZeM=^pMk^PGhNBfO8a_3yyMO<^Tl!FIr_`lo=O^*czWM8k?r+x~4&SsiMfu=d=0FVEYG-5WThS2@Uk{gAoZ zrRZz#Rx7LfGr%d?gqwwBa>Av2y4I zSqqnY^d>%+E@H7@I?Km+Fe>Nj)Y{dzzy7Mp*qX|a5&9#ldPlbRt*LXBK7_4qv#ss7 zP)Lj1yqn=q3nZ{~1qIeTbMel6x4Z2v_dfOor85;b9P2!JYm(X7YwqzX-77@@%D>j{ zeDTY6{@V4^!q-XW>xp#>ynEj&U3El3DWLaHknKN|?-oRiQ z^!e0=rv+S1dqh8c4tf;e#P=kK^O5o&h3Q=r!&e=@QTOqJl<$oy4c3{hQXZ;FTX?=6 z{E%n(;d_|EZjbKR zbBL0YTVvbTy`d}gH+7lZ_?EA=iOcltkFHO_>s6VW5)9?Gq|BX_dgK2|`!ekXs~11n zw0kvg=I&EUS}vtrVc+X=c6%uG?tByYgH48!A&yJ(o#Yj^_5Jc3Gw0^~y;_vPn|9`3 zmHfV+k9m|IH_9r1Jo)*s;ETm6DX$k#S?H4OkW|JQ#ZtNW`H_49xdq1#wX-cOKArGH zB->y`F!z(`uQnu{Wn6Q!SkC|MB~ksm_qfx#MUOsZ+qT|ltzdVZU5n`K{*A9M8mbB0 zes;gF-%S4apZ6JzdC}RT&$_3czkgtx{O?~?F09p$&vIU06nt9Y8^cRU`BNVIa=Gi> z9_g>S(`w&0+2^FR`vNu&j;26^O!LTZ^`9OU|4%M_^Lxe5{fDwdKb$^u zJHa6G!;4Gz3v8A$1UlY}Fi2E5_AS4+Skl$+Qr-89iaJvE6?W|FYq!gbF`m%8v>^U> zflhUjhS|T#Ez|98_AV-7?ml(DF2%sgjXmjAdiBT8`&yzVezWf9Irib5Vb7fTzY^HF zPL;e6lJ4Q3zf&$ru;BM==?Q@W=hmCJFG%Bv(0%Dt`LF%f{b%(&4bL8_)$VrN%yeza z7Flk|6O1cTHr6IRu|4*-CE`*1X1PymXIV2b-sAGwyO}>v{({tZ-CI5N=bjsQXgqp% z*NR7Y-TQ|3W%H9KetG?vJ>lD{+8^b?)%|UpEK87OjW9R@)mJ>E0(=c?T=1A zwchYJL+bW4yZ;A+og+(XF29Kn2yhFwXHc5RF?SL3$IojfTFjc!zWd&ti0n(tPW)M@ zy5I8mx=G%J-tQxHswxET{dlMlmS=nMj=r(||5?fk9BF^=AKS8j`7Hkb9?b1*T7utG z@2Z$8=7vYQFit(?Zkuu|XJYsTVbk~W_c!fScDVKB`1!d07YXuiyRL3^$X8u<@20f! z`p&~EDql~S5W287?~G5Y z`?uB6LBNZp_T=_kzMG#hF1T*eUjN%Zb<(U!W}+7ZrmUT|ZTG^ti!Ps#73h4Ke$Rr* z)JehU0(bnL3gI(ijLOgc1-(so`V&%-d}yoBy&Z+$&Y#d(;qjsM=jx3=HY#Swiw1OV zxxJ0UVZEm)e`8r7bIMAS_1d|BpdDhQy<+Fwa#u~z2Bkyz~w-aO{%6()PnnabGl>I7A{%xn(MuIW2xn( zb#rP$v}&(jKOdk7F|8v*0ySChR`IUTjOZ3D!!LNK= z^r|uhiZ}7h{usQpwycXY$?ET~znv9@qM@3fj|r~eWoq&?$TH9Ru2aW&^yZdb)~>fz zCdU}v+9#74{OO`(s&>`AtKPS=PO#ZYhUDsT-Jd3)@G|+@|6h-;*{z*1uSQ36KBIHX z-R-#+*L-%j?zA|!MEucQclO6;<^LW0)a!oJOi6GCYyRs!w=57M{qM^-W+Q-_H(J$p0kA}UTNQb|4v8o%%eHc zQ=Pgd);|95tfevL^0UK#P6=+1I3LM1N&Mw^ou!^jPwajhRT8|~Y6DJy9f{&*6g7THsoYkTUe z+M0Pa#!i2)Run$Xd$u-DUbf-q<6p@c*I#(OoA^p8SAQu_dHiiLZZ)0*=DW`&T??;w z%r~(Xp2KYIl5|VF{?YNh&u4!B)&6q(p(N3Q_lJBv&gi-3tl*E6wii&YI=U&@TBqLS zR>>b;_DLW99ItmsH!%Eu;?wf>gE`way_NAi|E#L_XJx!1lNt8|wzu!f)fcNQ|4?-C zTfOV8K8LKcUXs{5sHKOSpoyzt7`VtV8ep>DD62VXKL zn@%_}VbZiIPZql^sa9Gl@Wf%E%7c2>TU%-ywhIZne?4#{@NVELQw7D{Ewb)9LJ$A) zx_`LVA99(YVs*-nd=Kkq-_0V|Xy{zsY!}4n7q_x+?}9M3w;FTKYPgk5FrW0bQ}*XHXgEHW{yjH+d#~)|wThml)>Ib!6oVwe>FTq38MA@1-2f zUB8a`=G$Lec$?QpHS)3x=^vV`rE2ZMzOiHGmKUETkN)_Zq1AmQRyx%BlJlcwa=H)K zPD}hhGe<13ypK2S(%Ey#nP==gCYI%_(04okUo@G0i`#3D`ZU=)6$YK|H_n!sT)*4N z-4v=Wak~EEU%Py(FIAg-C$dhMG)Xi}_4mVn-CI0Qhi%fRJ`k*|A~@G>?QXqKwuLNu zZVenI4(%L0^0x%#^X!h9q-HJ2+@3GkQCjS_ankqW(?iQzcSw7)XC80)vEYBoETbm# zz6NOl1L^+A&Hm>vzm5027ude-t;UW*xeq~0-p+_`*^(3gwPWV{jw_7iyB5x_nJ&Yq z&ZH7w(!qJ;S@^LBDOrrq*4#Vpb-B}I`JIc>DeJ4#j{4~_CG%!nfCkf^yvl6;BbP2b>sGV>{LAUU!xI&` zcNoIXIQ4qno?PT*@c;JTA0OAZ{Cd^(*<#L?*Rr3URXH%K-SxZtP+wj0a)0`cDci$W zOq>#v4*8foac-rB~ZGNta7^zt)8KU?fB zt!a3yep(RJww7XIT)i~pf_VM`YYI2rRyx!5j z=ydMgrMda{ZkQ}6uht^;GaqwX} zxL59Sb>-Hc{#cKhf9Chizxn@deZH5A-VE-ww+^i@jefS5w_#e;DwT;l=B;`?=Vn}k zl7sE1t@18Kq2~QN7Hxg!VtV9^$4$p`Of6pax7(Ux^xA#g;*Czc_+P}DVwAbI|C~Lj zk9tLpahLO2G43;I#=Gs$rU|bJ)An&w=3!&*anlk}xhK{k=c@lp@I`L3X!uly_d(GyALvWA{;}W!zEjNAx9OVaJ3@0H+&nU_$#^9{yIKxwcUJH{rbf$CD>-eu_{1K0!GknMFhD`jn{) z*DR4pU3&Dw%Mt+%q5LB(dJ#P0IzLZ(^HxuvxbAJi#0{0(R!=gEe$nvkPT>7dzuJ|i z-sd%STjyw2l5wu=Kwg4JU*7)w8>{!Cpiu#RjtOS#H1(b9;>?r_qJG>It2Jl( zB(}!wV8A}d-G#?QtTV0G)~{RQd&_j{y5CHn6xMId|Hrn`W>4IOwI3ZOSN%RE@%e|>$98VXj5PFe`gPL!&Mp6Ig-5pYR*SAu zlhhShBevqI){!ke&C}P{A1>>cp9>nkxWX~v|L#3oByPUU)VMswS!G()loX{Iyq?pV zj(q2>wpU>9RF;hF+#-8Uu-n7xsE zgYtzZ0tT~vG|rrMD+^tFfSSXd=dHqG?R)s4bto8Lz&Mw|^;J+&kMHfIs5Z|5OUvN|BRBAP`ba;2uOV^x-t zNmT696}uNc5n8?TLe#X+z3;x8YcwqLm~H71<9U1A3&x4xzFuDD^=Gl%y66bK?b}bC zbW_T{w2qmXNkH~KpOB}r)|owbR({%F%woYL*U7NcXOnSI;DqVyjyjDVIps4gw6$Lw zzSbl(Sb*^FDN>MI~ zO1nb;mNv_Gf&%m#M}$tA$n)ol#zUUk%E-_~hS;``@f|?cItegmi6@ zmCMyy!x?n{*DtP#m)_s{wX-VpOZIBkpotCBKIT4_IvOKRm;)qOYysTJ55FYV0Ko4jQS%M0FPStWVq-l{IQZXN2qrMvzNTfl=E z(YF=*C%E4ZIT- z(0ysMrK)-E4%yHtTP8|3o#nc;Omma$#BKYsmc;rm(Y^3VZF|f z>VwYDb>Km;hHAkLQMwwZ&bwwMF|Ap{u>8~<)zZ=*ZK}E9hn5|Z6mDv67QDPmE~d4V zRpCBAc&u%Ma)Oc6gxNFu-mEEcP}(lM{j}5J(#DX(6SrkQy2x}eC*|5cv$@qp%RORa zBKGlvhU*;#E@YmXIB`()s!G>TkO`&=&I^H=HDX;*es z>fhtyboG;FQl3b>{)}jOKy}dV@ThWp~Vs{-0i~gWm;muZHF!WAKLau zb=?V4{^zTCa9*)%&MEKCh?Z%NT3w-~4t7C5Sf(e};^1U>-$((O?(mM8` z@8Ao;*WE>XC3l|}ee}NNkyrYw#Z!_3b~BW8e`}6XJh<~sQI7Sz{y9NWHx6HW5fRAf zb?1&L%S1*m2_LaJr>{NOF8ovD;>AVRwp4BH`TIA;O|ts+?w!RPd!`7@@z6heQ?Q{B9!uuL?nJy|`lD_A~xyhTyVopp`E$7iUe`I|1L^tQQm2o(2=$E;9lugD* z>)1bT(dUj8t-nqdIv-Cs(!MHj6NkmTxGve{+yU#h@A!G@)7|T$Ok4O=eP7R-HHE=Z zr`f~lNUXb&XY<5uSF<*MkL2Ot;&IB^eXg`s{C@vzL4~HczZK;&=QW&v7wA8kB9&+o zebLJ2Y)9(BHtrks3p)f;ZWrk5?AUB85+vxCI?XwM)1ufN;(zw0+^Ah9@VVahJV#~0 zZwH@!mVC!Aow{Ipi(R~^l;g{^L-D$Y8;>My^PO#w@7Ce+%B9V_-uqBrFzcJR4!)4Y zXD6=pyf~MZEwQnz_gm||l!J?WJ9}hOg#@dP{YpId!c60`aO8An-RTRWd-N}HmCX2g zIWk35`hu2AuPA?+W6?aZi;Z3~-ulf~wH8$O=o@wOR@BxqP5QKDLYM0cp|{ODlW%SM zKmVLg`^hZV+XngpETXW(s!hl-j}((8y8$ccRRi z8xy%^y7bK3xNk;Pw#^eEL%+0Xj#@$++wZp8=!&iJPk4Sl`muw<`pXK&rkt*=tPLT7 zNV8md*sH-|uP{hFpBJevc^|OUIV_ie>6vTh#XKwG`ZaPR!_%(x>Xj z>&kjk(*Kt93BFq*9lbD^JKyK`Lms^+SvOy@R-H8XyX{(!jCy@}m!RrIvx#{{`}%6l z_6D>I$XhW@w`Z6@E7m-v+JU5>a1q;`hQ=tv99)G zgt^ER>5Vn+T6NYFpR2sETzvacM3m;Ue?@(Q?}`scE1J2qTH4Qb4%+wj&!N8}Gm5-z z4%IxJ@lV;7XOlL#T zDJUh@wqgh0yn5CO{<$0inf1Rz_+@-`k8IuCBH_uKGdM|O{X z_onaj7H8Jy_AZK^6#nj&aATzX{G+Why2@|G^Sci7vv2H6}BCx8F#@Uxf@aY(7$UD-+QhFXKIMc6y9!~0s4eD)Yl zb3L?vo%MO8w14EmC4JUNZ~J~F;ZoEV&xz^}#V zq`I>0SFQVdjypFjCDyOAJ$}#S7=Onh(~tjV{5~By=lsTr*0wH5O;cXnw_<3Y^*U9RwfbMM!5|2fjWG+jBtOlrdPscmO^N}{)%&1neN zoP0$;bGO?~HxE{BtFQ0)SN8a`JiY0>zUY0&mi={$tS>L=oFdcf@%!q=+?)L_xBA>R zxx6;ecU!0XXKIGU;N8dFR9g5pF5vEb5GFJE$a2< zQnpEdK3u!|cIGm_OC8ytLp?9p9^-$_m;U(k-j@=0^d`9e6j`(ENp_*ZN|xVxA`erl zb_Un0U5YbXC%o_W{F5A4F1|=Cc7C2A6a^ z0gH?cYr3|k?I{S>UY2bC?dHcUTkX{;Qx!}<%51T+brIUBtNBvpop!_We;&6@e|iLNV-yTD?C9v+-xT+`-$aGU zR5iD1>-#&0+C4>7LL=5N8Fhd4QCp}nLn-dM$8Rr>>Q}RjC2rYq1n2dpckbP@iEC4F zf=ku!iC2PZ_UbpgUX_imNcK5j@FnLZch|hNO$}3OWbfUc)^k`>Rp(M%QM~&%hRAA* zw1Qc_S457y0N1uN69hA7KJVjM} z{?At`#hdp0cToRRq`^M_jaTWrwqLc;-wp0uw3gvES5;bnrNQ<8Ylhx~XE^?+wCP5D z5B4tfzwhx(Nb$d8R5xrbz$Lv)Gd}*|-FRm0rzhgaXRU3-Vf92=h9fG5Jt{mBX;T2EAm8CD9d2M<7OYyCin0>dP;m2G78L_87Gd|13 zwK({C%oeH@N!8!8+_u<#&;RPKVtbLhlbjdnDdk?;qPZy6YMrq6oxOkVN-jU+xXE?@ z4~9Fp?S<~YKc6DD&(nOX)52pd+s#$2emieE?5+H0hUkZx`u++RqWePm%a86~sao;# zx3QmPvrxbOJ(+fcc-FW--$aU!1w1Nv`!HwCpTo-z2QPMc@uk1f!qkH+4xy;$4pWcdA1UgMGVvtqdyRj%-OX$rk3;9{S z?2O$vdz$9(EK!YTSaNE0_qNylTeKJDRGocup_pNPO^!|Sx*-2-r(5UO+BM!tFtw}N zU@TO$b;j4nk3wp+Dc{luj=(n zoU*qVoW6fr`O%H4y5Q?`Qs?CqWq;}XeB9kSc;i#jImUrJK-ixToXJ6)cKDu1)Xq50|&tqTvkGz=o z(1%Ou`036bqmqsf$Nt>Dt+e{c0iBK~eTtXr|Fwk$oH{b&{a8SJ)iLqv zOB-KC$UO-X%zGo#biB>Q`1Qj#^UsBTsx!Z&ctvM-tRJg6XZj7FhH%l`>)e^#BAL;O z0gAmxJHpo9R#q@s6dAW;S-~Y!#au6!phtN=>kHg0mZS$eopaYr6ny$_bF0t(*sa#0 zv-_UKie?Hg6X~_HvEWkP-M+C&uKDJnl437EJ;k+FJ6oRCB{hZ2DD$?la{XzbJ9~~^ z(#DRPKQy??er&O?+Q2PTymie5)f3+5ROA*%CbZgVmn}2sJiO4^e}@@Y+Uka&xijY$ zJN2>sSDCuu$fH$vGj9~AO#iwx-P>NQk^T3H8-=Ms6Men^pS@=P%3L+u(`zBeos0Ib z%ta;lZdRT6dyDi(-V`&*iPNWco!JsHJ>&MgDQnJF?wr3RRz^9ES;b)SYt!q6y1UK9 zPafV@8uD#w##x=rXBkg~7OKeY>^OfrRwgA|`RAh87V#JSl1HoNoYF||O=*M%J>b zjbD^xS92`gesWu4mPqE=bLTJE?U@?1?BM0{t~36r(_%wjdPG&9R#5HUv2wwrZ=Pn3 z@6LbQApMYQS8!BF!;@n51fe5l>YX=Z6b}dq$>`p8bluaprZ&ajCv8(^%$$AHKjoUT+CJST ztNC-=QM3DHzH?RHspq;gT{_^g zJA41@3PWFG$pyV%O)}*sS8m^)`pa~uRmEeDE2>PXs;wTDwL(3scrquOBpEWM z+1Bj2l5u-)eC#~?`{M4PwF(&_91(G-_w!%M#I=QpOfE`CR-=mq&J&%67P|V7kOGqvXYv-%%Q~AH90@ zrQlJo@&UmDekPyyxlz4hjDA+tGHD%eIZsCI@VMi3i|=}eC;wEZw!XdWrg2Z^9*J?h zur2;({kmuG->jc=Ui!W1bKCXdEUTVBJ7xUn=C+NKE0ooWb0aw~37=o!vv}>^?jyNN z-cE4yIB)h+Kv1&v#Ex%YtvJ@bO3+hzqmu5J5Srby;_dxhd+QrFKYm|rW%S>`eZfs- z2W_^UlQzFipZ)H&O5V5sr*4~yJ?N>@-E?`h^y(pWoVdXKSH+CU?WpGt-2dJ-gpAw>dj;$5bU1yPXv=yxloVXhp~) zwTOj5UV<;)vew7zuL$+>w_(1g-siB{p`jxt-C)6%n0BMJa#C|I`aKfrII_+qPrZPD zT7VZMrEPFr?Lq(5Oqjf{71>aJgZee}=y=1|4#svR6*+*iCbm6(_xJYW1wsQr12 z?mgi?hh71LnP)UKG+pBYElbq6U6MN8CvV@jMIuw&Z*k1()pO%-*DlG8-Z6cNp!`;; z+-klxf*}Y>L|!s&^Jy*w0`|`Yq(_ z&@Eu!!peSQk|cN}(U*;}`)JpqOGPP9#U0Z(-BQXo6tp<0&YLf7B3W|6)7z;mtm^Hg ziKYIxrY=ts^|5MkcTrm9JH1VkXX+Axu778B4)O7SaCFHKnC>X`Y}JRwMJ%s)85f`I zne#{KiP&_*v$qvz2fVaUe$VC=Hp`doN$N5MWm8V2mA9TLtUMXA_MLL>?WhS&f!!-^ zShQ^4vi4H!`m?IL)FfN3E$8_Vrl@ArqAvdWtJ8<(LKZ18#!W(5TdGo?h%Io*P6%oV z{+y@qXxq(ymnKds;8L17{jOtB^C^$*6SsBW)!*i;&T{p8$(pi5X+a%FSq^47btlws z;o#4_aq)2fIl%`UCK60j)|}DQa4K_@WGR|CA?A?Kw5>BXtn8~g?_q6y*6mgid#3fC zTmJ)hy%)Pww()nMY0B+&dmjo5M7b}ont9ivJMl!3$E~fBNe6p&h$V7-_`Y_&-G{}X zQ6#x;hRVI(UZ*F{3T9Z`$|V@vG283OYfnAJI;}Hj9WKp$Tz08U=SQ{V?fJhwX1}Rp zJFvoa`M&0bA-{M0R|-?g*?d+~iSgE!o`$HUMgKqk6anqlRUwM$}U6RTGXT;J4sThHjeA!yuoi$H-;c_*JzbGoZQsjsFE%jYvr_J}!^>QoPpT$0-AHn2{~=LPx$JQ=dW zeG3@u9tH>RoB85S&#fYrH}{z)x-{`MAFsOdGU%#oue;$?<CpPn^^iz;1-`mXYBm*$xjdNb+_$XXWrMmOoPAuT76Fob97+b4Bqt(0Y|<|^~Eig zYxgf$vbkApuUKdMw#Ofig=%AdE|E13lkADGG9`@q>{B>YfX zsI_C8twF|}5{+7$8pUio0sZcViy1Cqes-IcVR4B<5b>!dz&7&K0S8x3P zoL}JHF6moe_KT{;TAus6mvh#koG*JHTbAs4=a(|qzA4zc{y=MeopZ?XY=PUg9JlzT zxObjfJyGHO?w|1-Q>JDYD4H_6bxR~^?NO}V-Ip>+&F@y9#%+$(f&C{0>|M66=;-*d zA^Q%8LF|to^KX2)=Q8btv`w9wwPMuW$9LkTH+-Mn`l9|jcgEFX4Kv+3v8Sz;5+DBv zxomrXcANIu^9S0t&rjkuzQ4bqdGZ$j_i^2R&hL*r__+B-nMkAj|G&{ z*uM3a{fz8ez12VdroYepxoJ<6(~^{Dj!Mgqa>*1=`E&fsO4B2YUryR~d2(*|rln1s zw$|kv!nLmo$nKlzuIv!__TW}|qb51ix56y$+l#+V5Bs6v2%P(CbM9&GO&i`GUU@;}>4ST$ zuX9{-@>TZc#9MNwR=$)l{%b5|`G4~}WuB@8wp+YA)=o+(`nLY-kKgUz4L;nP9=YY5 z@I*P=J?nNAKb7L06lA>6lzEbskC$2ErEN_nKC5ps99-g_lfrSx>1PsKxUGXu6jr-&p)vQgHtNYGXH_n63>!x}JV|u~y;lllU8( z-l#6i{Vw-cMLm~a%KP1muA4b-d5(%fvKO}%*G*d8y=}G{c-+cXB*}PJ>8pT^2FtD2 z3EWTLtNcJASLtqHetw$Wn^#e}p4Lxa$lWn~F1;+&_|iGgqwBln+RGDuq`uvc3Im=WP-qD=qa@mLEi#zh6S42#D%dzs6+jcw)nphTkN$t}8ZwF6b zm@aN4d30;l#2A$+9J*)rG+Yd}cYI{O|M7=o{)Km&iv{j~Kj!u6#LimjjrnJHOB9^< z&M1GIA(v@BcVWdz;kJ}QNyS?|rd|c-n`WtWeC>5P(s+zlZS&QJum9p6d zZ~q2gth*plCNoRb==Y!fH$J>G?#Q{$y?xIIyG`fi53bL*ZJTzN?cuWLV$NsMYM4)b zGT!)ia->ey{IVnil03b)Q*Ww!LpY^rhHh&qw2mpX|w3rc7P1e#-oAvm_Y=Zw z4rG`xuWyr0i@}t22wmH&YW`$tK(Gh(x2^eD6DY(UYAQH z9=p4;k1V>rAb57zhtJQuWhy=;Jga@oVZzRmF|p-O6Vn`jzxI%qv5`tERT+GHwrIyF zD{U65t^T%Sk$R-AVafStIS<+Hf!d{6f;*Zxwl18gqp5jx=Mj~Nnd@@D=fodW3G(gO zqOI1xNn*={Zl4!7_f|W{FF!3m|DHgCdWLmi_=nQeN6U6rRX*l0QD@Pc#-CHf^f<@5 zush>v@pFA!aoJUUK0aQJ=X9D}R;IZ|g)hoBx4g7X;_C(plMmCnFD&&wdWU~riDqVD z;x(B`d=od`{ds8L?mxUPFGEkxn!H^-*6*Hpxnh9otTYxqq0QUVk57M`-cXmWT;#7> z`0To$uXE?IiqKtUlNED6T?~3@rCXA4ajN2l@Yb@oT6;FXlL|MztFN5pcBW@yE~`Tr z_iw({tXZurUORb$R&o?=lrUN;!3FLMd*9)RXV329z2B!?pvj_Hsi}TmnFYFb_*rW z=J^opeL+uc&qqI>s}1J7_9pHN778kqdzLwBUgAEbI92nG-<>&IUeDa3?Wv^3JVl6c z?qg-ejr#X)U0|LdKVSKP;0jx&a~-=UbVR=ld-QBc?EEEfCzY5;^9n@!zK{{;n>uOz zr?}s@Tk4yXA4GDz@O*qu*C}o$qfwOUTu;@~_gW8^#Ktdq>vcm-d5sve)v=aC=XcMm zc`(m(UuC`pldlkC@41F0XKJR*KCnb6owG)^YKLX!b>Ym(I!>Z}VoEuaf3^Zs}4+ZhilhMTQ#pY9jjR_y-YEhWdg#l`HwAG2_exlhWpwDnTvf8*!d z{Uq*%m2^qeg`ZWwe>rP~hy03M7H}}dWWkyh3|jj6EB4f`zANrKB_uBBz_S}4xViQo zirf7^IfY$E^Rkknvb@;DGj4Z83a=+7O`2S0J7Jsi@nwy9hOY!(=sMq?!STIcf#0qv zaQ)$Tz4sG-_s@U$^=kcwjwL%yR+af$lnJaB^EpzSU(@&EnymEQmFY|896!F^?(n+X zZ>G-HyIHUFx;DE0$hG(O$No-^bDq7f_T%+w@*i){>My*{y?$Z#{?~>7emL&2|EqYX z;QHbnxrbED{uVg;v7M8>-T%-0-obBk>mHhfovY{b+A6+GKmPf}ikZ4%Pei9FSuST0 z+Q}6pc~a%u%iz}vkDe`gn|Ep3X{9wb_fi^8Y4nTQySXpwFUy`d>v3?_)6W4>GukEP|D9TJ^0d#vW9z3ms)axJCm#2` zVn<1pa?mF3fF-7mTEUKoI&SB&?m2a@_)?j1X7~xEsu{giF056GYL|-R->)mOx%%Vr zQC7=}*E_8Zo=rTt~R_3u-9ziMLH z)!d>>LLbjoZ=Sj2k;2)NdR<}eUp+Cz25luUXIbD8~ff`e10E) zA^WtTj9~M+zwL_KVz+yJXZN&PvRCeJwspzVr5xRz&i4}+-}u(|H`}Yb;M0S=BjvAJ zlk4-{Z~dJ7qULPr3)3gpvfi6+zS$DYUjBHqdEAjV{$|PsCZ8sKUvhE5@s0cIj=wxy zZxp*B`Mu+d3&jert4n70`3PToZIUzl#ScCYZ=2@J|KB*qET8x0>Z~r=74`rBY!uW? z@8A4*%ezbLw(WO#rrtW<>H6xYFwcIyzip1|LN?wH=2Nn_<~^C-uedMSpQX)p(H4XG z4+SqT6Yk={`e{olK{1>^R)t@*2cQuOC)ON)Yn(ZG;Njh92N$nkC6-qAg})C-3tV2d`SYJmlg=+zFmH}k zmKHnyKw99;C(e&^tHWP0Th6{D?Em=2ed~$SC!Se!d&M=`i^&gq-#9v-b-Y#LJ8#~8 zq2KlK-Fw!Av>ZRO`1*rrflG(X{$>0Lcrs^Z4PT+`F6Wm|iv=^Mi#>gO=Apfy;NtMo@eQ0U3D1&w(h9@oD=(6!V5;lj-K4`w~w_F`(@qb)6y zBR*Ww5WCv9)a>C$3I*v-oE&EgLFZ{@%3+xW!+tBzN~h` zwp+zZA75Ubcc`;@#;!Ndy&na}1$BgSt3CX&PnIK7kbCNM{-R5I3cGyMm&~<4cYBeLf_-o99#gVD&YN%YLgL`s%6hqD`~QgT;@#0G`0Y|A|Dw|Cb{-c0 z_#at+Z8@5AtaWnx#bw_4Ha}mvfB4A%r@wtdpWvHaq4~+bK5hNL%d@g9I@;wIb6vzg zsU=00QAf5p7bfbR>f$y?dGdG1^P4*t>|qeRIK6wBL8t1bQ0oiMdfGo_uGsC9`29kJ zN3PP|djI|UsMh=Y;yZtw+bdCcu~a>>sjv95t^b2-AJ1>D6KKr)TgJL=Z6xRY28C}0 z%U(~IJFTN*+S-pV)-3JFy?)j6mgLFj0un+8kF~6?7cdGIidghvU+3owTmOH}`M>qz zmTG?4&h_HwkK9~bZ=7qbW7TK-r#im;wd<@hzbc`9_5VZX+}J<4*I!EhOM`;X``UM+ zCHvAeX6t^wGjadNm(uzhSTbBrn;ENFSl)Zw8v-9$G7uyK3;xnUw7)nn`hPYkGyD)OF9w|G^Iauy}#3| zpO0s3dz0ScwmoTy?f;E}A2>OV2^ZTrl+5z{nZS$~sd)TDDVN7*;awK}d|>2gc|{!Q_Fb&WgT|Ezp*rJUoG zclUyC-;Pe2F5j?hjfDT1*mFubMT&F&e)o4{_@^j1X>)rkjHEgL+_ABTHO?zH*;?D^Ha^lAaQgO5(~FG$_J zuA=6fk(-Mu>&_oPADb6^nr~ZCa7xK-#TSN!9Wxij-anA=t!zTYD+9Y3e3K_fUj_f$YMukhoA0OJ4r=jR;+`+W?_V#zcK4T~FP*DzZrz#oBjb*FpBd|BP1V|8|7g~1P7!;N`)*~pUCQOcEAx{ghm zspYb_ws1IkO!yslG|TIj`Mu99lhvl3t&lLk^Ht(qMU7T5Lx79l`Uzjc1jMd(xq5V~ z-Q%_D-?@65)m_;wu~mmObtar2vz(Y}vbJ&NpW`X}a@eXT*mu z5jM8@thc_ds0-5D#Jtb^DP!0igU^TK=N?~v+(Ny0okh9?&Ps{gU*H8`%MCJ*rPmVZZSG z*TssIV?xjEIs;y=RndJYlD6(f!O0A3ePhx2`+o}U;@!h&e(!U|)`*MF&%VotC!YV6 z|KY-y@{23a3v83!>-Z#1E&2QU`wLz-JnZP`Jifnr`=%EgbGK*D`K|Q)==Jx0?v8nC zaev>Gt7i)5@%z+Gwlur(kA=~5`TwJrR`M@8zhUB!`^D=Ov@IFM{bZ9O+O~C+zMFh5 z`{$eE7ZyI>`eyB6$6F?LaaG@~za3cS=6TKDytX~}{`w=a{^yf|+;WxP&YEO)()!B- z-h9dPauIzgdME3?9Q*S2lI4!vLoOvd( zZkvGE^l6WMyv!6r9o4pr-;HtIa@O;}c9{qeuF?0WgGPEWbW4`=1XPKI9B;F@EZ$1%B5ZqBc5#ll@qp0n$! zFWn7&GI61VRT|T~ZR+2?MDhNM_^!IGX0uHH`JW83zj@Z(Xg}J+tBC+c;?Oc&3JkG>g<-k z<)`CVU%oM(w!Zm${R!PKm4{6J9?}%sJDF`>#V3Qw;!cZ`v?qQ$_;&xJqviV?6C${u zCvFbbfAF~S{DITQ<@I&{o%4KlYm?BDjkRjZ)~by+KY2`Fwq#@T7W>!_Ox4U4?|RSA z`K>HuU;c&R@|%-~%>S%&e?4c*^4bsFe)7MBz2oGL7jdtXGB0g8c5b45z4LzQV~@Ta zU;g-ly!6MPi>BZFdwo-^`L^2UcFh+z<)+_$Q<0ZvwU_ba%u01Rf=KR#N%j~C+V5=*~l-yvxDa=WN+g3G5@ zht02cY}sD7o$36(kCNUhyWTaQcy-l1@7RWo!Ud;yJkN5yCBOHV$ua*rZd>;Lf_Ibd z`IPYvn;jEjXB%o zR_v~eJ)0swt)(Zwf5C`hu&&=)p^6$5 zck_qtwfcP${O2PM#R&DeRjJ?IBY&<=M)_T}l=E@B2;I!d)4Wd}D4oAAT2nAGc8Tw# zW7F18fBgP_ePUE;$!kCHxzdTd(|*=yg#3T&yS`&ffAX#0`$N3KfA$=&^W^i5 zCAV0TC7grStb5ej?-* zFp144-+9WJy836zFRoN~Ox~io{h_cxM`wQRQ=9NhSN#9~R=2BrDmjgNXWp3~R_bqG z%CAXXr@o7?1hZ0KBTy3%!jUasQglXooDBBssR>Hf^7^S9dGwu8#=laDL+zCZA-^heS~ z5$Th6zgqCUzu7Z)f6c)zkwuSgZGPLqqsi^>sc|ds!rJdi4?mY1zI{K{f4kGu)b2Eo z@TD4GPj6q|Wc1hhc;EVsHcquR^=}ly&Q!`6+r^xZyRU!slo!{>liBB$t$*62t%-Pl zMfPObj)$w4uCaK!-($AY&(FudJ>IMN*f8Y_v(NfclSxJ%=kIN;Go2iFtMv8pNul-s zzj4ot-O%NlaOH&7kJrz;H~!zgb*jhgxYN~q`&j+=Y`U}a{GmHKHJ@%3D?}zYNRYKxw=KOt0wVcxSzIyrSG=?Uo`*S`Xzj9?+%8w*5B7v zUy9qur}?}u`RShYnU|l>WL>>r%Va&(StlQEe*3%s;`?K_XYOvlw{1nuyhVBLi|-uL zpRbd0%Z63+iCIy4vXG~n9+#=xi79d6QztwDm0W5?iz;{aTIudt!cYi)h^yU_o znQyMRoSA3PBWQTHM5Om3L)_P6-5UCOM^?0}HQrHPQoir^qyIO0{g=45_@sP3TV4F& z{XJcsneG#nTvy%Kn|s>iZT0;5>|6Wgxr#11Myb7AJB1JedBaMj)%YZNtXKce_p+)Qpd;V)821<*8KC# z`L|g=mA`lN*9#Q;TsZ8zTJz{J{pm^Xm%WdWG;>`MDqY#}a?i=NhN&<6r!&M^PJTDMZ)9n`Vv>Qra;xZEfr}GDb=7q_@7I6OV!KANW#M^?CujP;Bugn@QPEx?6*9GXKAM-9GW^$|+l{x8<|Ht0`jpb-zTt z_;!p%AxFIa%+@(uSe|Luf4VAq&P64X@#L?{`%5Z$jJY^CjH`kde{_s{eM?R0rSHS( z{$h$BpD32;Ms0h0=##;^)Hf->x9*{Gv1`kp1kCn z5U2WEE4AF&*+-5n5u6;?J#ArKN2Xxh^glHxYcH<;yvtua@$xJF8>^=Wy*;dyacO1$ zpPjwDd0sA;%5Lxb&9Q$?)R8Sd{}%{M5fu-d(RTZof61*69!U#k&v@3mK&3A}f#dVX zNu@96El*GWu;TYzySKAWD2ue#e!Arn=JL=(;-9#|75_^)^*=tCnk^LI{jgwzm`>BJ zkDt@0tL7^0|8quUP1FY_?K1(@Kb>?Y8u(7;Dv_&r>6_7JgAL?GhtW;aYtf=|moO;@ZMw+dzb^WO$xl&udeS1E`yQ(a;!wp>ZcGaI%#dLrFU_X5Ncz>+?DbpXU ztqLE%2-?{GPiAR#HN151&)1@7Jd0YCY)e-7r%20uzr-}HMa{GS&ohxg@#oJK6ik{D z{U$jrzt?>8HmUP(ZXicHM`uZ7l!Po zo|*p0dl_>=gzJl>RhMPMs&lqZPyB+;&7WPLaNY6k+vZD)m|C`FoXn~D^3CyjtL>b7 z^P0YVUVg(=Ra&9)dUWZFV@-lp2d=nl>*yWrY$-Vra?eL;;a1i4DN34tw@Q6)h28e4 zGrOec-e0!y!^g7qanGzCcm%7cA6)5N9l2>~@qI;~=_jPF8A4-lYt1|MFzr{OA ziK$un!oKGYEa5W?`yv@PUn=-?L2ioZGbIfrwzs?a6RtM)T`!yz5OjWi%KFRyL+^T+ z+wWa;xiHJhQ%F$%t-bL}og+$u*3*UA%M!otzFhc!$#u!fi#ml*4u9q6OE=HC>UQzo z&t&!pdCf+t>l@j-Emlv`c6}HUIelhHU*wHlU-t4DEp7Vi<0@Bj`10)2n_lu8S|*-Y zQE0L6KYzzjr7%Iyl**NEo`)y1|4;ar+TQxU$i?xwpNhvd*RBOG|5$yMWBEU!OQGRj zT*nsU;B(GPza^~`)lyRWbnd*Db4H3zHHTnk@I(>U7ivYbRpzBmoh)0$m#}Sn*KLP{ z`L?A6;-5BOmV9{GtcCq;|2?f23$?{OCrq7n;G6H`S5F%6u6eX6b++D_W1jrBStfGc zT}6>wGc&rwbTVK3G8VM6b-65jeuI+iD`C@JVo%~up7%-Rzb3Z!*5()U*3DdeY4Wzk z?b5aeFBaykzR~MG`&_NwrjHlzudq{8eksH4r%|=s@IjvL?XObPr)3wIX)?QcCC>UYQwfT=dpE7>VJQ~@vVLBu`W-weP2^!WmX;g{a{IK@`@jAR}~gqem!x{ zyt85X;S<)a4Y=jGyKI-4`dcfN+;;ohZnsheqQ6SqSpA8`r^e*E3}aFLgu8jyf2~iv zl6{js^N^yK*u9T8On$KJNSB-L{dL0Rva{=D?|({S=?S?sZ*KRMJ4qT>_W4}jH;Glq zBJ;Xw=4F;ZH(j1tMJrUrzPzi;oI9ES%`8QSbKJ86`zI}2(rC6lG%u@7=>Dn8f(A2v zPMkUEo|I-cK~c8#7ATAU&ZjM*on<8lebBG++K10zzSX0j`dQqw~t*tT=1YBv<=%vmQm^Ln>|j? z6as(!xZRy|;#;^iJEYA0avJGeeNXZzjqeLC;)^Misr zv{)oEp9d|Oo7cZ(@62UqJ#RnKoVe}zWV6saACC!UcySo0x3zCuwM2LGY2`UvY#XKD4_c85x{%t_G|YW%nJ6z@EzCv&#w?^?vPHi^4& z@-|^fw-bDm(p0~>T>El2>gD$@jO>-gLhE@$KjcaaF|tcq*PP?qv~2##iH^mG1S)s` z+o$;ZwCC)}Wm_MwZ>q^X;=|%Q`P+sp-_@dAGdb>YNiIneObHSc3E~tf(iAEB?&o`R zf;qQ+*=3i8CV|B#&oJ>d-(;G5kVp6TrUN<+qRAJFlD^E{m$C7cmrMNl4F#8;EvYqR z@_Dym(@Txql-#uVtX2`mdt59(S3Fp{s?PUVmE8V61u~4=6%#~RGD_T@OwS06$ZNQ$ zw1M-uijd~)t{IC8qD|uV|1ww4^}8j0TA^vG?}u|IZe=-kte3fXuuf;vvtH#3GJ+c- z)@W#5SKb}aY}Cvubn^dAYyJ-wt5);Y-(I~c^=8rZ-MZiJ9h`B&aPEa@4K>9l`~n<` z3)LN*^c71C_BuCQaPC}bcFc8Ks^_%aldp2CXWsl||NP9GEM1mpm4}P0&nt_0m*2W+ z{eIrxcbZmg7P|kArcRyDd5`H9)2$rFUs)a>A3ljJK0aqckIia1WwvLBl7!+)<5{Ne zcrG8+utcO?y#f4Ar!t8;;u`@-kPpI8E}K4`FC@^IPhu9QVr7+&fYaA$lE%qVBDJ`=>j zSe-CW@~G?2y=FIeeXQw-ZDsuy#r=axXxsJehad7EPB73)4XRwYsr-QMg1hVs|1u}E ztMtfB=xzMF>H95q=a?BA4&2LOtPePLuB~iKRjLHfvN+c54Q2Ap-`*XVCNN2b=WYJs z4UDqBk>8)SJIBo4aNu4Rh|HH`-|TIMYkGS%78p6B4Oo8Qq|?3(zb)DuAh zV$Lj=-T1@A{En#UDCk_s<-TBi?cKMQ`qc!tJ2@b^^wFOCQdPqR^^PG(!}UkYaX%gRfXCQ-gWvq z?C!6)HD!`tewhcC10S2gnhSjoU0H1n+m9Hwu(q&TMILy~pLBa&+72c`i8CyD$^9o) zm~PcF+>+hY!J;YApr@6bcalS~o8t-x_m@emFJ@+!R&7jm7cOx#=20t#DL(ZmnIlMn zA@Wo5nFTgHS|S&f_I}yZb(o8L1M440PU}}u7vFFl%GkKcXVKNt`oJKEYWw!GGpCoe zx_{c_d&?lrUxJbMDu>u@|ELDJzGug(Lh{!?(P&US+#P69aDo5Z!YbXqZDApyQylXH zj){Je|8O|jees9iwKu}{u`=%G-}#eO!Zz;_|FM&sdSb0tU$}IIVYMyy;$uDyH#b## zGX7G?%g#O6cWQ0S?<9lR+YO6;Y|Hs*;J6@4tD3`Cgu}d77?vT-k;GhplBj5_ebwf@ZYTW_E1e%Ugb@#Pr|i zU)_7e9A@9lIq2A~dpy+qUf-KLG5_YCzS!6PZl9>W{bvdHCl}H-r$77=eE#6k@IS0# zqT5(r_y7OQ_HOsvDihNypDiv~E+5`TQg7`TM)B$48tzZZPv~#GW?>G4;QjH{5*l zhw)3hXnMkt6B{$KvK(H1U;X&G<*Sz9kGogr|2oL-89z&YU@Q80#l!?ECo0%jWNiT8np6Hh=h? z{f{eh(uc3B{6DmJpFi?s<>rE;rQ3~`*jM~Ez4Ldwee$Ut*(dSJmYoJ=v^(fOGlW)5n)*S3ljU zUhv`JX~{i?8UJ6O+rO~li^ZJ!ms2H-_p$u{{r>ll=Wopw)z`~+x%VFJx*vb`X7zdd zfBrS!&uaa7cItJ(8P9ZsE#Y&@Olc@A@<+CZduKVNt@BD{5%k9!7oA+idXI^jjo25;>|Hvihez(-0VspwLEsWUo#^BG_ zdG3$5De3>6Uw-FIL(P-c@`OzhAFi*iZ~vsbwBpOs@<5Y{j62@-&o2J{`1jTNf~UOy z5Bz$+?_l%x`#tw#Yn7+XuVL#~T=``8`tXPEug5kP>;1EB>z8TvK4&Gj-{O-+%`#UDL7{r}8`eLub=M?_VAn0a0D(-zZf*B`B$z25QZwX+oo zPhU$IWE9Mwqx|wt$?ntLU!R&@n7PIva?OQc6;G${vrGD1lUcWXPtRC=iKDV}(*5>> zKf`)-#rPvPwI6x^`Qh8}d57<>-#@AJ-r;HUJ8p9GANVn8Z-;zq^K^ z@E{}maei&q<{$4~|9|*ZJp55tcK*>Vk)I1b&ODy<)Z9J|1T9^x9cOHj&;q?yyt%&UFI)%JazhmH=_UBANyNR zU+8*pvyYoyd3#9r`X9NkrMo{|`W=7tyZ-%6g5v)^ow&Q8_Gjzz#CMC9 z{&?(Le&qN?(>;G*eXjU)aCgDa((R8P9Pal_J7@R5eEaqOO>e(`Xf@%=!pa#_Jl_xA(lg%Swp@Z;Om(#8rMX+#$nvZ5lTh`=bxZ{)aN3 z|CQRdCTGv5FN=5l&aeM@@$l0p&ytU()+a5PU-d*u$M%WFotp2;v3<*3k4OKjkzA#< z?a^2NeXomnVlSWew{HrcSIhLjqCnMa*}0y6<@}vV-kRtBKNbA(G*bM*8E*a11%Dr1 z-to3^d4N%=+nwNjU-hRi-jqGyI40{^B)p5N&vSMPxdG3?%4=#F{oM6apYyFg6 zRf_fH?d<)3h2rbJ3GVxOUtPx2DD_#)oxd--D;_VMTJfmSI`a11tqCXj`MejLKXvY* zMo)47Z`NnJmM@MkynCnP_PV`HPiK2aPFi^M%(-ZuTl%(tCGvKCRy^Zpk!~S!XqRdH z!%f_NhgUvddm!`q-(}$oe82s8u=e_g2eRgmFWJYPuiAg3?iSO+0FK>K(Sd=Nxw>to z)iy7U4pd>f_1kdE)EhbWf9&{E_OrL^&C;8(FbnweihAz4@Lk={l`vG1d9= zyqdp@SvrsQ``cGYFUgKCcsVs<`?Ksl-=As!IKF@0!6lipaV2NZX~lefUA!UVrGCU} zwf;Yc?*A2BK4-U5o!=zge}6x1uK4rscHzsb<_{X;Wp3tX{C{_6vO(e}lRtkCE-&AF z@G}4X?*99~&Ht6XU#v0HN}IL&+grse3OiO_?JRwIbwk?I13B9?yC+JDO%l3rFMi?L zZ&e`+-nOa99B?dN{_X8@^`pDXw`_m({(9_5?goCl-)e4slIN?pnVCP_bz0x;YoC|R z=lACye6FkroRG3&w_L5@VfVgg6ZZVNB^C2^cJYnFbq`)%pEy6hVJiRq?(q55Ow<4V zTyOEJ<#L70%hTpDKc%ltm#=!K`{qvE$$3UEkJRscYuC2>_}eEPz0c+Ui|g(FCgwBC zN?6-3zVFSPm^=S27_X@f_W8DLZFIp^)%4Ho%yTCn65g%dAMl04)%wrRY1IbxCygc? z_mGdc9=oq8dGGt0A3G~z%Da}m-F!GoHm_!TrM1sBof&IIe&-2YsC)k_n{f+c!DS=C z)V>S+Tltr-X^}Y)kYN37Tlqp`HO`=W_FQh7TisG7T$lK;EAd*}#*8q}`L!9Bb{0;O z^18nM==<~bt;sXQ^=w-dJvUx9wchqPe0t2mjprwc90{La+hYI!e(M`cUAq?sd6r+V zK9@iI{A-bgZ1rKS6YKxIt(0*zO261BVNf6tR{zs-PM=xa8k;{iCR3Gll zmX({IEm~E>?RCAjow=@%C2!AXMZYRV-=A&vf7(>1RCZ5qI&>#jSchv|C?_f=M?QNys7we;RF4?gcZk?!cRP2I>Dxk zefd%MRkv*lKk?|;|19x4vaokj<-WgE4 ze&hvG$B*{S-M>1x~=?~h+tc0!Q#mY+zHVwxF;5M#`y~4BFAG?$9PTjYuG;6Z=UMn#v0D+&OucQ7msK-^yRe?iOY@zq*|OP6 zOb&guJoJ#mDUoySJ=qoI(+{d|KPX?MB=Jc>Vp)|zlCao~VzCQZUkqMvPP{N#AEO20J)YGXQ_bz`ByC8PK&+2zI^Q}V3maah8LkoV%ES%6|_FgY! zOI=&kdp8zmrVF0;WegM6Z)k{1cCq(1bbE5{@P<2*22y7(ye^H|If3Ec`2yEXkJhZp0UtoVLY-t*2~KPJU>ODO1U(2sCf zZ<^dutF?^Bf-Uk|joxqK zWoZZFA*SDxShrkQIKNUQjmL)ZXXN1o6RDjot2R~4{He4Q?DXdg)ECTsk?8HnS+}2i zY47_*cYfYq@?4y`h4ot~cR)qLyh@8SUK`QBo7%o{>;T859ltGOu4;)sPvoQr{69AA z{V82@|JS4s8zx7^^W3Q>Ia!8PHO#O+;MrYJ=mSa%XVLQw&QidjK$7O z2N|Sfp8i<$PO)Wi(52#TkUN`MzeowU-AGSJyLi$dTIY^pM^!buTTAlKGa=KG>R7Kw{F&Z1y0@byWcs? z-jl=kn%j$mWzUU^pJexC*P6Yw1Zz9Xq%v7#*72mWi!)DbdVVOy=&1F%C6g^RLDBK$ z<_o?pH&0JfWodS_h&}sb)xScEC$E+~7XgKeJ9k9sPl@@}5^iE=8c!~&xNSI7PaYAy3Qt(L(4C(dL`=%emw^=h{BK{2>L%3-X`ML>LpC!k9OOyySXx{tw zh{vRmchL^f4%RPiPDD&^gWjx#U4*d9c zI^lefijY^a_`EV(E%SA4$5NQTh-H+pIV=wG`g76O2Vjt)N>{Dxn zw%F#WN8Nt?Vd>|4OP=3~XTNZGM(U}fGY)x5Ofa3X*?G3@*A*F>t*77LP~N`w>Wc~4 zC*8NH@_#)ib>gAIn`JUzHj6L18O!f~VXOPP?0Wl^d~Q4je#f3PJw0*mWb4(e=6eY~ zmKWW?o;IGOxkYoKnn(8pKlUh@(jT`<>n|0*?PvC>;-1!H$J0J_4$J0yyKd`NshZo} z{3Ukp{wFP^iyzKc{T6HH^>&l*YhBEDFggAo^VfA*XC!tBxcl45>aVMmkbbrAXXN_j z>*w?=h|QSM;`!5EQQcfVY_{#%qaKhL@>+IbS}G^we)+uV!ntp^{gA;3S?N{e9tE2k&g%eP3;7e2Mven_;#gx4Mr#|6{J@5AON@ zZ*nV-{UhdSBssy9Wq)*)a@1bm9e)?EuDf3H>0Ndu_!c;S zpS$C;P}g%x$l{7yEN`#=+sB@}TT^=ZnLQH9zj_bOmH*F~yKmXuH@RjJ2H7`+UTkHn ziTY^vzc*oC?zzKFkD3jaZD6r{R`Vl8zii92$Mv`GIZx)QlPbP(Wb%fc53Aqt?<;ts z_#$1~rFk{m{da$Oq+f>}Kkqv4Z^N5|5mw(ccuq_6hA)s^`Ze1@Uh8u=|G!3?Pv4F` zpOAdg`Q(DgI|Y@+f1_#wzbf8o#ssaoL6PQxt*?2EhG)mcj)F)+T}a%Su8gvs}MSe5w?ZVW!} z6na{$X2a9a5R-f-jXR~@rmObfv0u%hE%smX<};a`HGjo&_l5DCls#wU-Mw7!|DQi@ zTYk=}bo~6v`F)b^uKA@5+qUL7S_nNl>euvG`@VhG`&HqN%daN7?BBQ};i0_b0qNKK zp7M8gx*9iROlh3CB6GgkYx55*b8B>%taTS$x)F7}Oz!!I?FUzwC*FGS(<1ent3vF) zE$^%)O4X)_oNW-{d-QZ`|HsNrXLefDJUThUuEg%1W-a6DZF~E3e#M?VIm0MJFYf*a zk!x@M*c3CrZ?5LbDF3^RGh=m`;Dvji{kLAtIR5EmdcwyShXq_k7*DppT^k*EFQjX2 z@9V(3`*iCjrZtOtAD3xWP3}8Toc-_Qg=M{B#^QZ8677CAocU|&yY@ylecS48(@+-A zeRxWrr<^I{uSZ9(e`r5^cy*p*pC!Ng*&PhdpWPpQ)PH~A+%~QW(`{BIFlE23ySZI@ zi~syuPUc?|_5b&U`71M5{hIL8BJtPy5207xD{B9GiKOx$J?g!#(fYxW$MJU?!}67@ zuQeC9J)ToJT~TCW;r-?21{Y2q{(tq4_KxJ!!SVNd9W4(RKKc@$`1RcR50`GafBPf- z#W=pPVOzsDe?LpcxAT8?{+W1LP^JB8@1Zvj*%R(GoRpYhJH=h-&Nj201K#)To5cK? zoz3rGlmB_`--?`jGW{A0{~rIMf3WiN`UBRp;|`>YzBkzNzvRYUomiVKucrN&nR)-S z*dN9qjfQIbz0;1zZhIs4t!DnuZOTpRr>8V8R-50&$(;U%?d{`b^Loq8_qOn&^m6?az&qb?}8K>HnJnM_-a#o+yU~abN$aZTxR^4NL zx^sFqKmR-Lsp4+K_QSIBe?OW1Pb7>_ef8^#0-uiCzP|WZJ*nUw$29K~o0tBd?tCfl!oSB0%adZyhF83rz5DU> zY3>*1)k{9v(8F%GKd|v{llF&$&#r&CcLChEV&rJ&&3{+z8+Po-KZ@ zTlb^7#|0N3WtTOZxvtWY_{l9}|5he$$`bz8u4R|@{+RoEueb08Pz&z+P|HSl!QI>~-|jIM>HOT0a&qg2S#K)doW31+HE7%IlNu@? zS~8y(rJPtC|8K6c@xT0+XA6Er6+W+D-`B5N`EWz0deXg))J(_OCU0w^70<(DKkzx*YSOZdi=SU;E>HIP@2S(6ldt>u@qFX=-`BLO>$%izejMCa@G={o2ChtQ zx2bzz(l>8`#j~%w_qkOTYaX}eKO@(+viVs;#J`L+_kLQ=i~h`T+%5QvYv4D7JsaG z=8qK4=-Y8*XYV_*d9^%4t;XM^KObipKWeBrA%E36((b8G+?<-)zmsLA-I#91mlE}I5l~1cJ z(oW5k+2qdMzS3!SpJSlx=kDnbSDajaaLslF8P3HQw{oZYzK-zskLg%aTod_Kka_N- zHJZ^nvB>p7*>yj2x zM;4eCY~9OteO=ytRn>P9J!X9_6Auf$in(e(@5$ne4JPk@M5LRxtC!v5IIv}g*UKMY zd>5UJy{&%u$EC_*Q0I|#%jL?XBN2&>wmFQDpt1cU&~=%cdr2~sUoua^Ff1a0Kia_| z+9BGZn%}$&P~J)&Ya4vPtZGvd9&{0lAiZg8-I^8KE73MRL*e%k=< z*0OH-{=r$pPhV$3AC!N&GD*YNKj#pWeH!Dd+t*G*)0%&z0^_AAttWO~eI+K!@IKY% zt#tc!m8K|XSsmfJi`)X@V9VZ}V$zzhQeEkAWbM-W;|FwS?9F%Bx_!OTxm2cYZp>{v zetG?WwwC=Ns1(*+aQ7zDk<_*lkt=_!g*u(&xso$9TIP7LSWYZxKdgJ=?rontyZhH4 zvf$yBiPDWKwK9?V(vh|GLYC=;jAVs$@jdR)xNzZKaiFhdF;DhlnPW^R+jlB*hAnLW z!cp?=d9w?{maHv54ka98n=F|)S1f9-8>2<#U0ViF|1g*F?GBH%6*pMkWN0+icpfWs z)NgY;{M$JF$lk9_tSSuAC2V_=Hz{RYa9$m5`(BP=JGk5}t4TEM^602jGVoNKBljg? z2Sb^@!rFY9pe8oyt!#g8=P>i!l4FLbHH%d6x>d@OXvwu!GB#qs>Z%o#4I25(i zt$%8jbV-_R3Cp{@SGPfpT&7!ZQr!ioDR;1>@_h4-Soo3q6$kg14%Sx-k8&F6}*9qRa{dWMIsaF3&dHS@fV*j*bOid~woA9f27 z+@h;8QR7~j%||ug)tnjJ8QdAGFHB=nRA9>u);R0#$s;cI;uaIj+v_RKOu4HaBPU$R zTzD~Un-rwnmF-p1aaCYH+)<%=W(t$VMV+M0tS!~Ym{{J1r`oPM!?lI?N#<+TEy8PW zU%S@k8+~fQ_9qVc+niRLJ1)LjXxR{A?p}=23tOSN(!Q=ELq+22*1eCbq2rXy90jUO z3{?zb43-TG50t&heeaYm^Wn1i5$%+YHdO~chE3we)Ajtn%1x<~oM>>Uh~Z&__`?S2 zZZSQN+WNj#3;wEl)bTgjnYW2OODOsH!K7cXQHNdd%kKx@EdnQ`9_sN-uK#sdNvc(a zRq(^_hh>%*FGY1<{l|XUDt}e8r(ECyS*Ih)iOXa}F8E!oNQw#KHfcAl2)(2|Z=0{f zZtZ5yjN@yR7R>$9xQNj(W3r7vM3?krfd=VYUH+zO_~;)ge6e58_EMY@ulw~EJySsCs*(9?cSvYWHn zBlq>sv-++d=JV$6c-|a!r}&tLk9?Z{Yn9Zmb~5GX)8_21U|45Ulo9p&U4Jv{mdX29 zgHrLybk9Q_ds%NiNt}N5cj2Yl*%OnmKHj(4E&168z62qk`w_Rhvg7Xc%{*GR=fi8x z3#k%~AA;G6*bh|{g(`=w%Q|xSd9SDRtxU=N{5)b8{Qjwd(x3W#)oR5pvik)7eG4=F zw|O6Lz4c0o)62jAK3Kb@DkbLcr?Q&;m%H1~$u>)BUGe-~_R~3H^WomI{28jfmdbB8 zNLZH?e7YkYE3`@1s!uR(_u<1rCnnS=r}dtA#Lw{S!HVqZ61Uc`%{;hPT|D_zfHd1P zjUpclr{fbgZal^vuFxXWEvMSNR$@+iSNv+3zC|ZhH?z%8zWC9cZCBpxNcOpI&81i6 zu2`z@oH9*(#v$EP^)~Oj=k*JZrfp2y&Hm+V^S($Q*{tq*hrq(d1{ubir}M5PR(ms; z<~sVw=N(@VqddR=Uu@Ltr~l;x6P{(ishPJ$&C{HXJ44-k9wCoB z_iyFp4}Y$ot=PJvXv?OH+neHbB|EhFh9eGwuE_8dN1 zAKTvS{prJtN_$x$$=x+g&()*n?D(;g>zm2{DknoXUW3QGW%FYG|MD~0onlk-PU4Kt zxulHCA5U5@b3Me(r^B>T`+I%J@wl&&++32MVk>WzP3F_DxqQY!-C=!16w74C?ypzn zVt(K9+ftcoQ*_BgR*k`9Vlf`@5kFH3~nE$mvQvbv}tL*}h*&-9KWIDwC z3)K&MxJQ+_@S|h%j!>DGpUwC06yEHf`gmgT@g=6_RY@Bf%8InPKts~=RjW0(Oux5D zZuuGQl=Vhad!O{4o`3&X)Q{}xen$jCmnrCP-g2$|vfP~})yG929^6cpxW#^N)4Z=A z!u4iKOqVX(#!~R;?`*?$C%V%0r25yH;)GmKYcMj^~h%JW69~+4Et-Vq^nQp|4n1c zQFFbuFkk3>ZpQK6{C7v>`y`r#pMOcuSYNS;>G;_f?fd5&O*%d?=F^$!z7@YtyWJ^D zGUS^zz!Lc1=Hm7llF?-V*itCn|-rKj+Z zju?K=IkZI4%%=3*A;m*a)6-?Ngk<{_kUG z@P?)5+8@8W+jH}11(4}D4e`rEnv!5devKB>x^ z@l&h|-z7i&ll!Pcv(lo#NpHUSeYc&t)oH>P{PM~{E#D`bQ}kQDt^1}h?cS!wgH+zl2Oq4>jGp`} z`Lf~1jgSSt&zBxO=x(2z@ORHH(*v3NR6==97;ZBE6Fl$RP5%6&b0$Xa_`Ic$f3Zu( z{_>+KHIWYwt>n-9dGUMSm$Fau9 z%l+Qexig|LKycYo$$c}fx%`@Vkm=URwHlxy;hJf0S}!c?=#IDDCHhs5^Z(8qqwF1X z&6^&t&W`%%yT~pQ@L>-SPJAtUSlxhqcu|KYEeLKkeZSN!A@t#O-}f zE#&9i?AV>N`k(tk+1>S@c6rwQ+;XPT|MZ+cjRw0e^tjiXPFw7WmS6;K?Msk2Uw5^o z{!hC2xyU`c&3&eO-^-h;-0@jn_xXn1Q^ot-9jD2O+r{y%7dg0ldb!J-3pZqS8T)>! zdF=gkyHlq>cU(!+wc6%Wr0u-lt9C|TP^)ZN6zTUrT+;2E z`Q~G?-Hz&(Z7B=FubFJV;&@$Pvb&IN?x#)RQ+G>Td#)pO;677E_V>0AS5~>%{4W*$ zSM`V^?#UlZbH=w%u7SGHesO-uAT@E#iDsW~ROMGG>Aua$1+pSLq$qOHcZIW|AfZ?h`AyYX=0jVXWh7W#hwbLGF($0y>wHRnZm7r)Ve z{O)^sV(3oc?{h7GrBC-@*)rL_4^qvajN{1NrP4KL!O^{^<8QR_n#NsAb{Cyx**n)H zDoRJ?=Ywa$ZO0#P@!a*}aChjBlx}9>t{jQTjAPTP^s}N={}kmh=2_&iRIgp>G&#JqAxVWtB-tvo@i6IMHOP?Q2E`H?fsiyF=RqU|`bAPVLqwnW_nX!HG+|2#s zdP&`-=Ks5IHZtCHi#wvM5mX_6)c5yNjdU+LOWpa0dEz54HyzyR#!_sQOmD&FU>zVm_Q&>zLJ6HjV%q$c0h&isE;ZFWPM5jP_& zw)oy|$#dYjw^~ZW)M2R^&Sy{GBzU>E^Linj8c){z!{Q!6wA`c1w;5TY4TNbAGQp+(uFI4svaNIW)I{W#N%*>DZ1p<)EG0U7xA1E3bcL(=u(bf% z2?ps0v(C32OlkAW_sG0|?l@oj;f#zd*PGvB4Q>}FZn&|)e8!Kc9iahTpiXmHSFo$3 zSg)JlG^Gj6iY>N6%RC(Cqy^48)#V$pV7FL@6~rB9R~kmXrDi-%R}AzM5xt zkaK*_AtuS_hE-x=Z6-g`FK{GJW6Iqd$i3F@gmR}FcpC1tVz*=Tv_m|(J5*(uB-wAj zm?%6O+#hXgA#;{0}jE<+K6bK~0^x9_!{yK!;imea30 zm?m;8O5~it-0Q|R&pGLS^Mdoe3tKHEVr^{BCc7w{c4YZ$ z_rumtBxR;Sa*+G!RqOcN6s9gwV5+mfqo*DfmA&!S|AeULzLf?uEoB@%x*R^8=BQG+ zQEOB;Th?iz-Pfa2rkq!2`^L%Lvgp7xg%3;O+gIG>5I(7#X1j&$(-zh(t;_G4{$$w_ ze2}@`>{3#S#FJe1y+SG5Ta+S?wN^UVGrkL1qj5|nqM;#Hj%8kP_Jd6lA_$}Kh(yMFOF({<=_nC?b(+uX=$A^x`y&if{H|8U2G@J;KK?XaQC**3Y&FNv#gS?Y_KG`LyIkO7c~E3^;Z|7p)_Kbn zviIzDX8g8IG^5?)_A*z``8^BtTM86f?s!N9`vg9Dy=BAeDF%)kIk}JM2(+@jD-hXw z<#h11LyNB;Ot_}KVcV-nv4^Z4rgqj-D_+TOUME<_bMgG)6Muf5=&Zcurfd?G>t(gG zQ#iuaa3E zu>9w;?{Y6zJaRPN5vdiJAj>7RLHUn$)CQHmvv=L$%HRF{URUkQ6K_n7x0qfK+`;>0 zaYIyk$UoW38+R*rAIV8NuF$hx$KCOtLQ3lM16fOTT$HPCuB`ZQ=(58yI#+l3XnVD=0OX806tJ;^x8z8PKy572pafTbe;L&+C;YZn>6R{J@mu>)O4)@2rk9X`aon_LN#-q{^Xbf}cFz@8kY`=AtNH z_LT_wawhvn-+r>P| z{Jdz=J zjZ++dov-%qs#Pm&sJ+Q#czoubnAW>p$4?)0(>n2U`rZAWz9H>vP8jr<{bQ>9*$SFl zK0A-K`69<$zxkWQ@4qTY^vz`bqPAN@LRCy@_q-Xh7rq^Qp4T2IeCX0o<4Na|`kryL zR~TM;U3mCqhI@9kt=7|WK?4)jyZhbQj@*=4T*|(_`pJ(+3cq_wdcuS^({YPHm(0_FX zwcqFWcpSZ~mSHV0@vp_721`%*u++c_Dnh4vz7(b{S-e-YcO6%Vw7pBnWoyIR_Em{W zr}SS|tFf*4dEPdMIx}+5KZy!kw71g&E-8)BS;jd+8Yi@4gjkK)X zaAR|#31>#P$u~dYGIRgik6WG;KVGr)bI>YvpUFK9{tv$Gh+UIwEu*{Qd#=Oe(o%kV zsYeBen5yTqngr^ud8owGspq)=P9sl_b>_`5?Ve*-UT0jM+v=nka@};{mLl;tEVbX1>|JhkHWK8m9x)skfY7*5*8+scZSU2W6HQ-etJuzKGtT z^VG9nk&T1<&2F&^2V`EgD^&_|ZDQ9xaPC}~l)OZ5X6vtsyiJo@-tK-C7!PR`&a4s&=NQnEU$t1~t!?lAO)0 z4R-|%Cv{De-Tlz4OXlVVQNg)_*Vf3);J7tq#^j{cMh`RJdoPV-mb-Qao|6fhl)7^ThxLciBA}PajX%Cfga1W!X5p?{Vw#$Ip&>&Ogq&d_QOIFC75rp=gqZ(~x~Yn^@x-Le-vUFY3$!7J6%U zo-4KD*byT?TSZ8nNlsntoR(vv2>~ZU*?dG%R?G)4t zR#hoBUQ}hdG`ZXH5L5Lnrdb_)zY_Fv4kn)Hf!^BQwAl^c;x4l& zK5)J8y6LXK(KnL8m*+ixqS~Gs)$`@x`_hB&%aU9I?UwmT&HuDfOAD-gI=M`g;CwYqHIX0a}k$~df+p{(}ekeGzC z<%Tx411SMcKRC{@WOg52wkK#x$H_ao377Y7v5x(b=Pb#TD4Qel*td0Ag`m;bBXiD~ zO;q8$y8G3}%^Q6ix83TUYtM4Yr zqQDvwd;4mi$A$L8({-CJW_bLp=zPF;QgOpM*$>6nRB9D2{5Rgx%y?o`&jg*#Yn-}g z>RfiQI2xF9h^hJrli~RpOL=v#s$bmr+(&Bb#gwFs*=N%HW-UDG_N#vJMV7sB^EbBp znoDuD1_obmFrBS+l&6Z5y6^3y#ubmykFB3qc!{L`|Id7@>2fP)SWXGc>>^zHM-GN#EmW6+L z&7(5$M(TF!IX}wos{KegvQ+TXz0y@Cllsm~%HUdmzWvnOs~M&2!cPQ4^91L8oA+Aq zWOoOn{Ob#w?)Nr}op0^CrMh(IQ5B(2ZGYp;ZPt~wG{wo(en`@*ntV>IJ>TTi!-glG zmlttVUVBn|S^MCex*vNU8a$uR?Qbos-Mw*dVq?TNrK4`|`SNOI9&oK$$+&?lN3>z) zfvHKGx4&I+@Ytre8=g;^K9{@ORP5FCohDA(3U}LTtiHq7FOr%udAV=*60e=Nt`z@h zwYfC;lgE@(laJZtn(Mpi%`p`XTW$LG=NazK8l6wu_R4&9y!CCtznu{V=~cImFP2UE z(3g34POWEZNT_Gam-jPFCcQ}Qj=CW^Gy2UHUv8DETZZ|wAFMs0!gXZlOs2i7?wQUt z5{@{ow{`2;#`XK6`85|c&s`$u6}vs+%8@x|7P%!IFWYtJM$A6m#ty!;YQ7#d=`BpR zY;X70KK%1jb7_Bh!TbfXP9C3%Psr=K`ALTN96Izb)BpYq7pFLb>f3had-T{<_Di#$ zo8QU!m-~`k+VN7Yi>hyYFSGMzUSE}d_G#!&t@$1YPTn|>bX;y*!=qNM#OhbtU;D0T z2&if<*}Y-e- +v#Ftrvcj2jLe{Hji>GPpI?TERPS`2$x)ude) zM}%f9FOPYcS^jB@@4>d-=O@k4o=msVxQ_Wf>5TieF9DO_*CUESMVbE~g0ZS-m| z)Kt7U`(0nU>~1g5Nr5{TOWmKI_wn;&0fuA7@A6{nh> ziL5k;+-%VjusHbXM3Xb3?b}S*tG->E+A_aHW!m3W8}*&7A2^HD!j>Na28j4iWEEOKr#8c2MRl-<30 zZVS()ogTEZuVt%e?vMIWhN>7w${#!>l?9mok*SLB8J(or``yS zJTjxub^npo3rrUuTb8!wcFeiBGN1Em8OxfK8UqtIZ9{CPL!Mo=SxWmvASZZ2Flgt6o^p?&H)w$Loz*D`QdD?(@Ad zyII-gcW{Vxt3EF7kZooCHHkIFvPJf)X~f^ZZVu@IjlRA0xts_5_9hgT|K36&w9 zRpwf5+}v+wi*c|t-3W^7(1Wd<9u6o?JFPvdqASpIEL7Coym)px4dqYK}5Pe?UP zc(vupU&(Uonnf-`3(k0myHDhio6znltiG&BHMXy_{e|nHIXfj5ZA(&_8Xzk;E%DBu z#$cm56E%OC^ODI)!eRnqFE%ioRMgd7`=jo#+Li5F3QIa>Cgdu69${-fdB|2}>a-Lt zmffpUFI#56mfEngX0}%Egn7PKnLICf@NX$mzj9;ArYvcj#tmG#-CX~_^euI$<~321 zUJ$-0V#nc6{;EH}WF_AZV3@FHhRJ({89LvtJX_0kTjQkiB>7F}SvTu7MQ%3sbbhZg zal&@lf`<*QpA$AOt+0)aDdo9iBDi8VZ{zIj&VaSTU11+91-?`#Udc2p{lwxUV?Ql9 z`ly=Dh3UEuvy60E*6H7EnR~VLLf}Hp)v-S}-bgTtu4cWFQv7X`d4A*cO$wV=c!WH= z#36hBY008Ro0u9muvHa{m8dn9RZV60Jd~Ti#`Ws7(hCybxiU^WoZ$Dc>zQlC9{H0w zX!iQ7o+6%GOER;a>(0dQu-N)n*j?2_WmDA0{*+0KKX1-3RNkC(?8d{XH?o$Raa`q` z_*5Z9>(7(#E9Y&Weo)uD?uKrfkLJvVM}mhF&1PTP&%d#K!vVXT#sG_+YuC)Cgy%Rv z?UVYZqS@0gCbe>5W9O^f;&5r>>$)#J`DdST`&yHgRhH?(F^6k7ZB>WX!D)>PdR%h>YE_GPB<7E%A*6@NmWi1T_^ z-YT59#G}JD*K6HEj!83((+hg2k6!WNYqz>F#Ie-TeIWqS{~ESOjV%u8*E( z!PuU(bEU6j<^7-o?47H=v;LJiYqVg2yc>^vli=ZYWp(x4(a*)Lxw+r06;lW>Gcj3| zhn*g3&D<>>o`2FGOWFGrlH~NhBV6~2Qoj}s&*d9xqR<8b`nPBC zHeVFdx0&i^#3MU-pP`Ald17{@<(DZD$=kFqTw4|{tg6C#F($h8*4*1xmA9r;{t`9~ zsPdKTJQ4F$U+cF)$&&~kiD_;t=1N70Ph`%zF`wI+o%cwGiL%EJ-{9E-0gHMcxh?6$43k*`8{S+HTrK-) zXQC;iae6w#O_zM@7wsb5Dj#0H0fmW@1asu&Ig4N$D=2FJ=65~om%%MozH)N1+`pFk-E0Y_gc^19IJh&Uplz{4Eyn9#U_rK ziDoLSx>xe`owKuzP1r7Nnd&jkmgB9!Y30C^?M?sw8ZJuldlhUjEy1~aqR6-B<(piL z@((KMZJPJ)T3~mJP}v@iUokS<*LI(Z*i^vyeZ%Wc-HWfE{hP4rxo^TVshf8mI6V5l z{L;oJGcT_Wy4ZhUtw_JnSGTH1cLk3B*r{{itH+LO+k)()S2CO+^8y()R)*w)ChpkDcJf7_^5xS#J#!5Y-d?5@G^syDNWGmgEz&n)Per0z{N!D`7FOJy5bliq zR9s!9vZ%=_Y}!;l?S{LH^II(<^rIE{@~+-iTdVS{P&+lo)9j_jeW}l9s&8%XyQ`+# z6c!$ye0kbhg8&|j?~N*vE^9?*IJ)k?vC%e9T}%7a!%v=F^L%Gcc(QZ(P7crG#oMA^F&2Cux^3#`P zeNukQRc=-&{*LWnvyIqMp;`abtGc^#-yKc04uPvGA9o6V*rC9BXNEzV$gw`}y@~l& z&)-Wu=y~23mK0+heY3@8QeWxO8@9QP5j(^7@m($ME8W#Oy&zOoB-P{9-NZ|K&5P<@ zy?*`i@2;;Gq}CeTEJ|1ub!X$D07(;Tk3DVMu8HN`+QBF_S+=TsuCe0QISVGo{j!q1 zeDzkxs~*A z36_tJRd1d4=LzHGEeqT(@Oks(_C7hhg}L8r{fwaHD$-ro)jCuD>?o8l$ne({cB;n|rvZH=zYM%HCr)o-7bs??WmTz9} zt69VHw(i-|>Hp)V$JgX>iLrRx;}G65m1VZ$VYh`DA)c3F%cUm>{1WFAN|>rKNi%r4 z(td@bJg3j4hwP2MG;L+Siu&CZ50@}b!|AtFgcXbtnx;cX=j_b(?vnz~6K3)yj&OLSN)GVi7A=61KO`L9C;*;>Y4?s`pI`U7S8@9KBuU_-$8$ah75A!^W4gt5-ihHYqV9agvev z%CwH_M?Ec^+4zsFxmjGLvr6T2w`esNHwX8h8LTVTef_pdE9Yj^xv%ydH{7~}7Ur4r zGg8hqGucp3!!0mBCLi3KlXS2W5JNFCI zm_r}_>iy5NuI^Q?=&d-e9M2ZB%3CaNYc7A8%zwQ&JR@N5QOWPXGzjlp`lq?H*pCs9mAj@p#snq%L#@&loG&R?4OJiTPO?&Op z71ubXCoN??!L!KC<5Z@4X3AwL7tO4e!+$k+?bLczB3DeUiFUfW`aR#e`k%s+j;(x= zke(5o8`xAfFY%3Haqr~m_A~G7vhPu7d~)zZVep0ejHIY3rHLUp5O&f+xo{&ooZ^>hUb4Xm_U|C`F&taX845o4fW# z$S%%YzI3KFnqDn7IiZK2c?g=y+1zxjfAqd@TUd@>EW72Z=6j2lto_Wir0P$}wh9@{W6vyS7>lH+S#rW)+f z+|;rqFN%Tp*Twzua%%o_+xG1Fvt@n!8wJp@IJMjp+FzCJ+)(*B?aI~b#e4aW?%t*; zs3gU~u@QOF zO3ZVkHI-bAI@LrD{82rjm1{(nDWHE~;2z#p? zoTsYwrS$Z(r1ZqbDY^ozo{CSOK8^XKx#;4dj7?e#)XvY^n|*1$ua~bN-|N@=+I=HW z<*q&ZCbfO*F&15GMP{Ss8O83!va8JMx;xITShjxoy7b8>mFlji|Knf(n>l5tXY024 zS{IJFOr5dZ*QrD=L1T+-_3POeW^zrwZLK!3B*o3?TVlvbohPEH3tY>uZL{2Zw|Aj4 zTk@A5CeaiBP6;_wct>&RMuW<`jP~k}E`&>6+OzWL3^l1^Cng@1FwbMsxn^Se>q(oi zGU!yGD`yh+pKq7Fy*)WPRJCa#hqrvl2T%Fz83Nze_0G||e^+Co%i-U(ac^#f^|d_{ zV>3IRdc4XpZ9(egjh;=p>sB6F_x5R*iId^2m1$0&j=DZwvHh>}{p#!gBptGuwm5fQ zQ1hRC!iCceRF!^OacqjI>e9%gGbe_mH=o+_OK_^qi*N&mqrt}Ouelq9rU>b$%%7Y+ z+h>*$FDo- z-QCYt$dcG-m&15z^~`bLEONeA-gpY?kU8Bx%EXtNq{8u-@7O2Unh5eNL!Td{;+LCcEtP zNUhaUZyi707uoKs*r2$-UAQ9cY&1`G*{qY+_Kym+yLy6_`ma3X9%Wv6&ylT+=gyb> zU$%cQNUT13h(TW}qUFt;n26jkL8BSBTm%>YTEWV3X^HgiyLl!iSBm#+z5Mc_S7Q{D z(extI)%I$AyVD}1d*&D%p2`%t|C!Q8`@7MGuF{u_?_UXM-*i@*u{rYVrd+NKJ68yw z)StQZ(e5befUO^;TNb?M_}ID907U2Fk089%rN3O>p5-sQ5^LxPe^X`e0o05<1VgAwkW}>g^ z>Y&$Axn~aC+s>5UwB?iX(f?;JJe#yywse!|PStBq6c)-%Q7G@<y~;P<@Y0>pY}`vZ zrB`M)dGdbr_C5CEmF&kNr?XKNwT(SX1k1iLt;=6>ReL?R>C{lhjOASGw{YB)ytPHb z^WEy+q^+7wN2;Fme$PI0Q*+y*pNS%zDf(`{GyC^6uKeEHBi-mI9xBB?pE&kzIp0Uo{6%A?rF&~eKMyjqUx&JWgrmSy+y|6)JhvAN6Q!d!p~Qua$RhY%3L> z6&1B$dy3(PughlWILU3(>P}JU)!?2WdSmNapV)>T)hkQ%dR>$i{jc2pFzx^1==V$) z7U?+&ZE=1grM_#`TqTcygs6&-k-r*M_j~3Fl}_?Vd3E7k>&*r3Cnqg7zFd=R#96s{ zj^@kmW^17@iEn-g@o37;z4dgdu@>XKJH58gYLCZ@257%MeC2L=>+M^MDJvtJrj=%WS~FE`KTG-2wUPcWug%T%+EsP-o7bBgflGC) zgf>`qy1n(feD;>=yKQc7H2#V?TF!Zpx;(;ux3knrKGU44m|x#cnp^8Tm9?2M&QbEn zFq~BKw&w1HOx0&QpWDy=l=8?$dTYa!TW_Wx`rqb1qwSxwvCbJ0{kvWdmSqTWoej3h z%TlvRd=w(WtL^tw=(3bV^Y%*@0#|mfJtg1yU;gt3(dWB@wGAELZSm1#d(SQwuyXDV z7DvrTS1z7Zd)BDlG%Iv!+=n&EVo&o-tXFT?nnRPQO+fcUh=F06F-E6Vh&G+{gX7BiR`>fWMoxA40%5)dDed`iCJM7}8 z1=q!+`2W97mRg(}k`=7EP>ge{!sL~o=CiZO8vJZXHuiV*zp_2F;P}!>3;31YdXB8% z46gQj{O(m+Jwrj*JgZ&jkL=A3xokHTL9^+i~Zmq@xTOr<0 z!EIlv@2=3g-_zD+mEn8k^Tl;y%|Y5f3RAqES($A-a5Jb~R(fBX$kk)w3XbwDE4PSs zSKhqnq3|m2*Ma{J&u(9J$z#tmj>?-XbI)DqdwFZ4%50|3jMM+Pg&Vx;xsn#tAO~pKDW~B*k^DRr>UNzPi5`ytA%&=+w>?Q;aNs zTO-m`w#enud4sf@GLNS`{x@~kMxnjAOBeHI-o7GOd+E{Q%j^G%TNlR63$PQ2(0X_% z$Znc9#{;o$!OPEe8n615u0Ns%YCcWZb#P=_>-+V_u1r~`AdiddR@Tno%IP~AraJN6 zl?TgK7`q4SmQAT^HrOh-*udUznWz8hXYb!Ro_E{%r@8*b)Bk_%7DoFjsP%rBKFKdX zD`}5e_@Cyu`}eDktUaI2^Q>{DZ^Ml3ve|tLO#Z6oS09-0P{PXaaNFJ*cf(jqw!AK_ zkIo-=*~T~@Sh68pfjT3YhCtmjp$-CLH!EJfP4Yj6i zQ*GbOV=|km@}RKjTXMAbVy*5OSB2JO-F-8|X3Ckmiyj)Ua(^HB{_(82lE|Ve<<3hU z5ns3LZYfK8AurmmwLxe1qpaL_6BbXNyZQ0^&WS2Q*Keui&*rk9s$?XWP`(-vV15 zn6~vboISeiO3-TC2Z@)z27igD{_FSV#vZo7xsnTh-QGCmYsl-g<2-^~X0B1I<36mf zN=Q}Dbm{U`j;*})W%mphr(I_0?owWTaY-`u8b^7S?NF_{ZRBjC73eFZzb1_P*m>(I z%`c7bS!Lc)nXVycezZvYL7#`+jkjSvi*DU>l{Dix_k-zZAE+H~znyhOCu8OHtD#Rn zur_tcIB^=kiM`ykm@9|xb?|2G-AmWHFKqd-*3DtjIg>7(Ls4a2x<`d_MW)uwe%f{Z z{j}5f{(1SXSorRBOuovq)c+D&gjI#st>>NKQgql>%G)oCb;%DeAt{v=wknc$Hu3-E z>M|&L#(1~d|M7!mIxe4fOg(dQ!<*+D9H#l~IFr?oo!mdyhS{=`^{(~u8_^LC5ee%z zGo)&7H@lj6``X!p-E(9Yge9IeyfGzHvj52o&ID$=aP6#ZHSE(j$F6)N{@TZxFVjXy z_2(ny%aeq%VoKltu>belcCJvC#ua_N-ajH+gco~woYpYti8i}#@zTO7K`MGpdkP1~ zaWPfT``?l;oZyr&$vgIcd-+z%!_>idqUT~`adrKS;( z*XS0~x{67qD@5hiCHbigADJ5)w+?z?ops(tUP)A!lVyF1r-`raG&Jr>WrIoG!MTyfgG%5OjKeXq35$!=Y~NJd~< z=c}MAq2+!n@+*(Be4D$w?DD_r{=nGglPA{6RBUE#K5$HlAv-CrYSORYdKb@}5&5}x z!m?G1H(9B4a0!|&jMaRTwS;-uBW{yx^%K?F)}Ll%Uu5aNGDpX4niS7cg_0od>Bf8Y zYwa%o-=7}KYkGRk#Hk+A_UYX%?SHwp%GUlWu77oZ+vR4Lu&ij4J1ZXUU-k0Xbk7U1 z$K@AaJEvuG?8)up8yz&G&p2M1;ivrfoy$KvOUYZ8Yt6sP?CDnuoIG*wMtSScuhtMe>W!{3Jqz0vi$axdk;3EY+d$t;juL1xHVUdv*x7>MC7wf*k@^P?V5a;*~He; z?c>rND>jOGNi9C^q>veQO;PZd%B{y!x5s#T&aYduA#u6;y31$pZJyFx6wcjWl%UTM zZTe!$yQ$WGN$=iXx&8m+_HQ44#`&gpUrf3au=xGqtR-u=Z|&B6E5fnGecq2V>1(FF zi`V$OL{v&5lz(iM_0mSf#)jeWjv#$46t+ zy=qcx7t8K03w94T-@2uA#;VDe{5MoCb6lXtk&sxJmNZ4py*;BSsprzmDFNr4BAq=K z8@Xs^{fwBjHQ@Sbw~13{B0Jntb5qi`IgSx6cJB?elo)GG|g}%Zc{~UTj?2YPs>i z^o_YY8#E>{Ox(CO#N=J~nOqybm5Q7`*Mi=LdB>jq{OH1?Gc3F@Rg)ie?wIpaV^yHi zC9#K}_622cdTLheSMzP{mDl=zdS#_00#fT{1Z-Y(D(>}bhb7DzvXf#wFUeIt`d)wi zR^5xm_wJ?a+TYviIn}qR?_^HXt+KZZYmd+SuoNc7h^mht11<*d0c@e{cELSAlo3q^GK^y>emO?td%o|0zW(_PcF( zmj8T{OJsyd#-52s?(SOL{Y|cV%_gaLK~uLY6}UesU47J>r|?A68r4McJk>&Orf|=; z?QO1i+ve*Pd$2WTDR0nm@zT4|Sde;4Uf7)D_9X5Og%nc@N1L?Q&a5_~CwARBHH-hw z!lgSirC!-Of8Lm>6naZt+x5vAuk+mfPAS%9dUk)SerY^ zf*fk}x1Z_l!*=^`uN&7*u7B`$j@E1z(>sUq!+OmZEmBc@GwIi{+>!^4%QYnq>a=Oa zmpnadxG86T$4cutlXcxYM5mM`9&l7_3tje;Q^;JrxxsNk3d^U1K9!+st{ARPHGR3v zK)_MHZ^5SRpBeqPDrIMw%zn1q?Zq?e{6M356JA-x-&)?Z?8ALW$-+&3R(2C)?Y>X_ zvUC0ZH5}35H)E#9PKmh|bSr0Jf=Hx?Z?<^kZIN}iBfo!{Z~LD6`g`4GmF9b*=a0?z)ox+L_DbE6@Ag3GF8o*^?$UR`9($?RdcE z$$<%FD;s7%mt^7M5V`c_3Dd%PTjy@~`m`$gmRylX(;Q*Vd{NV>aZ4Y*6iL|f;LM3? zlai-0sk!XVDks&Ayub9huMX*V-+m=^_x32Q z%-6A#vScK;vVONKQ7QTF{;zAzg5wdk=7ozz0#c_ql%@+mDbKl8{v@JJEEtssI6SLu(7JoF3x)X?caT~_Zx6Xu;ekbyz!Zpc0BLGiQV?1sU4>| zrGs-#yjA|MZxny!vbrkk*u0AGN1yor`}w+S!^RIMf-}Q(KNdT``8d_}u9=u>C+4=B!NT%>gx8!fUp^3&=t zlKJ^MPx#~wppsmmJUijNv%9mp-7j&w{jA(aAG=0>5nfuhN=2ZIb2&@b8=;*Ek{^C& zKEL}t@c6%E>Br^OHddcYnj0Jw9t$+&&yAV2_+$C~WiKCoKcN<%*cd3VZPi|}f2FFT zN;N$h!Si=d+4E&>{VCpgdlw0swMl)1dDLBul#(V@YcQJirQ5^X76g# z<8CS>2z=;iaDMqi$@k6CBdcgHfvil}86Uz|qPp zFTJ!@;mxGloWC+*Ubk+D>H8eIpY|wEZBvx9d)>>A2mXEkpI8~jY4&!T_l21qu3j;z zab{Pxg*@0X)vW9M#+Cba&Ye|W672olt}E}e#KfZI`%a%NlxEpx!4we_)8%{N&56=k z((;R3YT{OzDoBS0CjY;=Yu_ z>vzS&jX8(b9g!>4E?touGR2^9@fPQhsVuwXZDg#zJv{%*sr2^gdV3MYeAhdbpTtf@ zPu#vK*rj_sZDcjYEAFb5qyb5tQg;Kmsaixy6^mq(bE3U^O&dG_szfbJQe0I~mt zpO;A0OpA1UJndxEUmqL)?`ySHvn^+s`)yn(zw})F+bOcrZdvk^O{0}!y5CklyjbgY z>f-;S=d{xEH$QszOj^La=A9bX)$OkGzn{GS8NJK)%nY4xL2GtRtzFb=(|Ob@asG)Z zb`R^Hubpz}eT%)`Jay(p35Qvj6uH`7YcwomzsSbrwrJ5DftJ2EImLz?5-eH$40hX3 z{5!GaQIZ1F3Cqbn!D=%X@I2ewG$)XGVQRi|^X!0G$Cvb4_IB-fTEJBIMlJi@!u1o_ zE?O90`@Z){wEiFQn`Y&fPO*#E_-}X7QhSqiL-|*vj@z9TT8*#R3iFjuXK~K`ah9KT zxBQQYpWIV^{&#&Md+_0{2G$9Nr&y0NFngXk9cr$2QzJe`a37Dmm#*(at&##sy>MfaZ{Y2#5MN%%( zJ7zzB*~M|Y@Y2VLXCBO~KOghs*lO1+rmI|5E!(gA|2;+j(hI}> z>ZQ%sL^iD3_nBqgnh7?Z;%fvwFYP*%_UL%_Nts;VYvFynZZ_wF@`HsX+AF=3g;YjQz-MK+7hjiae^4K{v$|B1W%s%rL+ zH9J$@%&L9do4@?`zWTPDX!UH3oEwThH$JRi?RVqq?^l}t&OO#=c{k@tiNm*@j(0AZ zt<2Bvl&SnC`G4K-x|`4WuOwXc4}W;{owm11y-dtfrDF;bQ*&n=RoIZn;c@H3Mw_zL zDdj3z_q;BaZ@3k8W#il{j|$R$94a@S9{)#hsqhLOMo;I+-ERdna@2AZ*;n(%ZtY)p z<6q%vYx9Q-bSAtNicnL?D}0^*DvMwC_tyB0xA<*TXaCPG)NER~(LRfD%gtqu3r=yo z_|{o{*>r)C#x|dtJM&)Ds(wCKUYDWog(st%N8);SkrZ&>Z0hZGr=40 zl>A@4^4|3LlfLoJcTG=7s+@J{jgC-Mcs=Xqb?uc8zE&+ZcocAF*Q;wMXLIi9JF$xY zP4$n27wPkUZCIc9`{LJIo}aD2H9~hoa{9EQ&&ta$@74cXp7-UEZ||C!TLMLyHa(kS zw`Ixeuh&h(>t6r3x^#`!&$@>5XXCcdJInj@>@`k~J$*W>^)7sVanRxVNB2KxV~^J! zY>O>_7kx@*Cn$~OvdA3wv+iu2eeTRxx2!X#Mo;_lBS=SGj)Q{R!3hg|hFQ@y@>&-qMZB6R~+#3aSQHDKxmc zTANOfmU(}+@B7@1?Ed>F&z5#QZ5d*`F5torBhS~Tq~@9azGk|XNAqcfxmV`v-^YG0 zm~5UtqhRI&w`)yXEN67(H-}umC2{BflfPlN_Z|Kh;LOgdbi1bUgBe##KvV{#DsEyZ z(t2}cQS$OV4w?`N~a-#%e_9=ZGEEYI0*`D+^|p8m08bz$t(t-rVA zvRx`$U1whTnuSk@J@E5X&OHwIHgQj0U$;r;^!~r|-ZmcVD~sP!Ia~kE4WEZ?YVkYv zwKjd#-IuUp^mL$YFxu<7dTJD=W11a4lHc0NizY{SBqy%Xns%X;6CbZWM^ z?pHqVZwKzWoNGB7s3tN*_9@jNkIJ7(_NV|H@+;WurL373@)bcv_zx+U5Y+p}fn ziqhN7opU?y%{{UGVanb}o3}wHXM2XJ$A8;jn##*`{HpH_tHRG_Kgu@ORp#FE@40E% ze1J`PgIMO~_dHC`T%FZY|B8K&^xb{?oO!PHm$1MYyMA4hE_K-BbHe9}LgC-%d6S+U z-*xJqmPO8o^rL(BI3`?HI56#KR91BOxm};G{Xh3MG+!z-mgntSkFcX0G2xH$Lf1tr zYAN|lvD&qE;@Xa*%YL%Vlr`j7Bh0jm>Do!L?{{6!*(W!Z*}JPh_w~JEwJmz?iZ6fT zJ3H>$U-yjP?zYWJ?DdzKhWg0@Hv(Ahxa^kdOm@F}WS?s1uQH|F@4Jut?#T-(|9!n} zh547y>2Y@y0tA_ka#WZG-80JCHRb5Ot_io5>T@`%y60$Yp3Tx?!j +
-## Notes +-------------------------------------------------------------------------------- [^1]: [https://en.wikipedia.org/wiki/Secure_by_design](https://en.wikipedia.org/wiki/Secure_by_design) [^2]: [https://gvisor.dev/docs/architecture_guide](https://gvisor.dev/docs/architecture_guide/) diff --git a/website/blog/2020-09-18-containing-a-real-vulnerability.md b/website/blog/2020-09-18-containing-a-real-vulnerability.md new file mode 100644 index 000000000..b71ef63d9 --- /dev/null +++ b/website/blog/2020-09-18-containing-a-real-vulnerability.md @@ -0,0 +1,224 @@ +# Containing a Real Vulnerability + +In the previous two posts we talked about gVisor's +[security design principles](https://gvisor.dev/blog/2019/11/18/gvisor-security-basics-part-1/) +as well as how those are applied in the +[context of networking](https://gvisor.dev/blog/2020/04/02/gvisor-networking-security/). +Recently, a new container escape vulnerability +([CVE-2020-14386](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14386)) +was announced that ties these topics well together. gVisor is +[not vulnerable](https://seclists.org/oss-sec/2020/q3/168) to this specific +issue, but it provides an interesting case study to continue our exploration of +gVisor's security. While gVisor is not immune to vulnerabilities, +[we take several steps](https://gvisor.dev/security/) to minimize the impact and +remediate if a vulnerability is found. + +## Escaping the Container + +First, let’s describe how the discovered vulnerability works. There are numerous +ways one can send and receive bytes over the network with Linux. One of the most +performant ways is to use a ring buffer, which is a memory region shared by the +application and the kernel. These rings are created by calling +[setsockopt(2)](https://man7.org/linux/man-pages/man2/setsockopt.2.html) with +[`PACKET_RX_RING`](https://man7.org/linux/man-pages/man7/packet.7.html) for +receiving and +[`PACKET_TX_RING`](https://man7.org/linux/man-pages/man7/packet.7.html) for +sending packets. + +The vulnerability is in the code that reads packets when `PACKET_RX_RING` is +enabled. There is another option +([`PACKET_RESERVE`](https://man7.org/linux/man-pages/man7/packet.7.html)) that +asks the kernel to leave some space in the ring buffer before each packet for +anything the application needs, e.g. control structures. When a packet is +received, the kernel calculates where to copy the packet to, taking the amount +reserved before each packet into consideration. If the amount reserved is large, +the kernel performed an incorrect calculation which could cause an overflow +leading to an out-of-bounds write of up to 10 bytes, controlled by the attacker. +The data in the write is easily controlled using the loopback to send a crafted +packet and receiving it using a `PACKET_RX_RING` with a carefully selected +`PACKET_RESERVE` size. + +```c +static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, + struct packet_type *pt, struct net_device *orig_dev) +{ +// ... + if (sk->sk_type == SOCK_DGRAM) { + macoff = netoff = TPACKET_ALIGN(po->tp_hdrlen) + 16 + + po->tp_reserve; + } else { + unsigned int maclen = skb_network_offset(skb); + // tp_reserve is unsigned int, netoff is unsigned short. Addition can overflow netoff + netoff = TPACKET_ALIGN(po->tp_hdrlen + + (maclen < 16 ? 16 : maclen)) + + po->tp_reserve; + if (po->has_vnet_hdr) { + netoff += sizeof(struct virtio_net_hdr); + do_vnet = true; + } + // Attacker controls netoff and can make macoff be smaller than sizeof(struct virtio_net_hdr) + macoff = netoff - maclen; + } +// ... + // "macoff - sizeof(struct virtio_net_hdr)" can be negative, resulting in a pointer before h.raw + if (do_vnet && + virtio_net_hdr_from_skb(skb, h.raw + macoff - + sizeof(struct virtio_net_hdr), + vio_le(), true, 0)) { +// ... +``` + +The [`CAP_NET_RAW`](https://man7.org/linux/man-pages/man7/capabilities.7.html) +capability is required to create the socket above. However, in order to support +common debugging tools like `ping` and `tcpdump`, Docker containers, including +those created for Kubernetes, are given `CAP_NET_RAW` by default and thus may be +able to trigger this vulnerability to elevate privileges and escape the +container. + +Next, we are going to explore why this vulnerability doesn’t work in gVisor, and +how gVisor could prevent the escape even if a similar vulnerability existed +inside gVisor’s kernel. + +## Default Protections + +gVisor does not implement `PACKET_RX_RING`, but **does** support raw sockets +which are required for `PACKET_RX_RING`. Raw sockets are a controversial feature +to support in a sandbox environment. While it allows great customizations for +essential tools like `ping`, it may allow packets to be written to the network +without any validation. In general, allowing an untrusted application to write +crafted packets to the network is a questionable idea and a historical source of +vulnerabilities. With that in mind, if `CAP_NET_RAW` is enabled by default, it +would not be _secure by default_ to run untrusted applications. + +After multiple discussions when raw sockets were first implemented, we decided +to disable raw sockets by default, **even if `CAP_NET_RAW` is given to the +application**. Instead, enabling raw sockets in gVisor requires the admin to set +`--net-raw` flag to runsc when configuring the runtime, in addition to requiring +the `CAP_NET_RAW` capability in the application. It comes at the expense that +some tools may not work out of the box, but as part of our +[secure-by-default](https://gvisor.dev/blog/2019/11/18/gvisor-security-basics-part-1/#secure-by-default) +principle, we felt that it was important for the “less secure” configuration to +be explicit. + +Since this bug was due to an overflow in the specific Linux implementation of +the packet ring, gVisor's raw socket implementation is not affected. However, if +there were a vulnerability in gVisor, containers would not be allowed to exploit +it by default. + +As an alternative way to implement this same constraint, Kubernetes allows +[admission controllers](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/) +to be configured to customize requests. Cloud providers can use this to +implement more stringent policies. For example, GKE implements an admission +controller for gVisor that +[removes `CAP_NET_RAW` from gVisor pods](https://cloud.google.com/kubernetes-engine/docs/concepts/sandbox-pods#capabilities) +unless it has been explicitly set in the pod spec. + +## Isolated Kernel + +gVisor has its own application kernel, called the Sentry, that is distinct from +the host kernel. Just like what you would expect from a kernel, gVisor has a +memory management subsystem, virtual file system, and a full network stack. The +host network is only used as a transport to carry packets in and out the +sandbox[^1]. The loopback interface which is used in the exploit stays +completely inside the sandbox, never reaching the host. + +Therefore, even if the Sentry was vulnerable to the attack, there would be two +factors that would prevent a container escape from happening. First, the +vulnerability would be limited to the Sentry, and the attacker would compromise +only the application kernel, bound by a restricted set of +[seccomp](https://en.wikipedia.org/wiki/Seccomp) filters, discussed more in +depth below. Second, the Sentry is a distinct implementation of the API, written +in Go, which provides bounds checking that would have likely prevented access +past the bounds of the shared region (e.g. see +[aio](https://cs.opensource.google/gvisor/gvisor/+/master:pkg/sentry/syscalls/linux/vfs2/aio.go;l=210;drc=a11061d78a58ed75b10606d1a770b035ed944b66?q=file:aio&ss=gvisor%2Fgvisor) +or +[kcov](https://cs.opensource.google/gvisor/gvisor/+/master:pkg/sentry/kernel/kcov.go;l=272?q=file:kcov&ss=gvisor%2Fgvisor), +which have similar shared regions). + +Here, Kubernetes warrants slightly more explanation. gVisor makes pods the unit +of isolation and a pod can run multiple containers. In other words, each pod is +a gVisor instance, and each container is a set of processes running inside +gVisor, isolated via Sentry-internal namespaces like regular containers inside a +pod. If there were a vulnerability in gVisor, the privilege escalation would +allow a container inside the pod to break out to other **containers inside the +same pod**, but the container still **cannot break out of the pod**. + +## Defense in Depth + +gVisor follows a +[common security principle used at Google](https://cloud.google.com/security/infrastructure/design/resources/google_infrastructure_whitepaper_fa.pdf) +that the system should have two layers of protection, and those layers should +require different compromises to be broken. We apply this principle by assuming +that the Sentry (first layer of defense) +[will be compromised and should not be trusted](https://gvisor.dev/blog/2019/11/18/gvisor-security-basics-part-1/#defense-in-depth). +In order to protect the host kernel from a compromised Sentry, we wrap it around +many security and isolations features to ensure only the minimal set of +functionality from the host kernel is exposed. + +![Figure 1](/assets/images/2020-09-18-containing-a-real-vulnerability-figure1.png "Protection layers.") + +First, the sandbox runs inside a cgroup that can limit and throttle host +resources being used. Second, the sandbox joins empty namespaces, including user +and mount, to further isolate from the host. Next, it changes the process root +to a read-only directory that contains only `/proc` and nothing else. Then, it +executes with the unprivileged user/group +[`nobody`](https://en.wikipedia.org/wiki/Nobody_\(username\)) with all +capabilities stripped. Last and most importantly, a seccomp filter is added to +tightly restrict what parts of the Linux syscall surface that gVisor is allowed +to access. The allowed host surface is a far smaller set of syscalls than the +Sentry implements for applications to use. Not only restricting the syscall +being called, but also checking that arguments to these syscalls are within the +expected set. Dangerous syscalls like execve(2), +open(2), and socket(2) are prohibited, thus an +attacker isn’t able to execute binaries or acquire new resources on the host. + +if there were a vulnerability in gVisor that allowed an attacker to execute code +inside the Sentry, the attacker still has extremely limited privileges on the +host. In fact, a compromised Sentry is much more restricted than a +non-compromised regular container. For CVE-2020-14386 in particular, the attack +would be blocked by more than one security layer: non-privileged user, no +capability, and seccomp filters. + +Although the surface is drastically reduced, there is still a chance that there +is a vulnerability in one of the allowed syscalls. That’s why it’s important to +keep the surface small and carefully consider what syscalls are allowed. You can +find the full set of allowed syscalls +[here](https://cs.opensource.google/gvisor/gvisor/+/master:runsc/boot/filter/). + +Another possible attack vector is resources that are present in the Sentry, like +open file descriptors. The Sentry has file descriptors that an attacker could +potentially use, such as log files, platform files (e.g. `/dev/kvm`), an RPC +endpoint that allows external communication with the Sentry, and a Netstack +endpoint that connects the sandbox to the network. The Netstack endpoint in +particular is a concern because it gives direct access to the network. It’s an +`AF_PACKET` socket that allows arbitrary L2 packets to be written to the +network. In the normal case, Netstack assembles packets that go out the network, +giving the container control over only the payload. But if the Sentry is +compromised, an attacker can craft packets to the network. In many ways this is +similar to anyone sending random packets over the internet, but still this is a +place where the host kernel surface exposed is larger than we would like it to +be. + +## Conclusion + +Security comes with many tradeoffs that are often hard to make, such as the +decision to disable raw sockets by default. However, these tradeoffs have served +us well, and we've found them to have paid off over time. CVE-2020-14386 offers +great insight into how multiple layers of protection can be effective against +such an attack. + +We cannot guarantee that a container escape will never happen in gVisor, but we +do our best to make it as hard as we possibly can. + +If you have not tried gVisor yet, it’s easier than you think. Just follow the +steps in the +[Quick Start](https://gvisor.dev/docs/user_guide/quick_start/docker/) guide. +
+
+ +-------------------------------------------------------------------------------- + +[^1]: Those packets are eventually handled by the host, as it needs to route + them to local containers or send them out the NIC. The packet will be + handled by many switches, routers, proxies, servers, etc. along the way, + which may be subject to their own vulnerabilities. diff --git a/website/blog/BUILD b/website/blog/BUILD index 01c1f5a6e..865e403da 100644 --- a/website/blog/BUILD +++ b/website/blog/BUILD @@ -28,6 +28,16 @@ doc( permalink = "/blog/2020/04/02/gvisor-networking-security/", ) +doc( + name = "containing_a_real_vulnerability", + src = "2020-09-18-containing-a-real-vulnerability.md", + authors = [ + "fvoznika", + ], + layout = "post", + permalink = "/blog/2020/09/18/containing-a-real-vulnerability/", +) + docs( name = "posts", deps = [