From maura at eclipse.ncsc.mil Thu Aug 20 11:34:40 2015 Content-Type: multipart/mixed; boundary="===============6643393738957235692==" MIME-Version: 1.0 From: Maura Dailey To: scap-security-guide at lists.fedorahosted.org Subject: Re: Suggestion on the 'Ensure All Files Are Owned...' items Date: Tue, 23 Jul 2013 17:16:32 -0400 Message-ID: <51EEF2B0.6060301@eclipse.ncsc.mil> In-Reply-To: 51EEF1A4.6020102@eclipse.ncsc.mil --===============6643393738957235692== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Just to add on to what I said, I'm positive the current checks weren't = actually doing recursion at all. You can tell by how quickly they = return. In which case, yes, the results "make sense," because it = successfully finds the only files in / that belong to root, negates the = result, and prints false. - Maura Dailey On 07/23/2013 05:12 PM, Maura Dailey wrote: > The current check that's checked into git is broken. The = > permissions_ungroupowned.xml check is searching the local file system = > for things with group_id set to 0 and negating the result of the = > check. That's all it's doing. The permissions_unowned.xml check was = > doing the same thing, but with user_ids set to 0. I feel like it was = > guaranteed to fail. > > On 07/23/2013 04:31 PM, Andrew Gilmore wrote: >> >> I, along with Robert, assumed that the test was using some sort of = >> find(1) invocation. It appears not to be, although this OVAL is = >> pretty opaque to me. >> >> When I see the current check failing against my system, I then run a = >> find command, and the only output is complaints about /proc entries. = >> I then assumed that this output was why the check was failing. >> >> I can confirm that this check does fail against my system, or at = >> least that testcheck returns false. The results file points at = >> /.autofsck and /.readahead_collect, which doesn't make sense at all. >> >> This is one of the more frustrating false positives that I have. >> >> Andrew >> >> >> >> On Tue, Jul 23, 2013 at 1:47 PM, Maura Dailey > > wrote: >> >> Just an aside, I did some poking around, and it is possible to >> eliminate directories from the search. I looked at the USGCB >> stuffs and here's what I put together for >> file_permissions_unowned.xml in OVAL to eliminate /proc. I can do >> the same for the group id version. To add more exclusions, add an >> '|' after proc, and type in another directory path. It doesn't >> seem to care if you escape the forward slashes, but I left that >> in just in case the behavior changes later. >> >> If anyone does figure out how to query PAM or nslcd/nscd for >> network user ids, I think you can add it as an extra filter >> option to the file_permissions_unowned_object. >> >> Please note, I have not gotten a single failure with this check >> against /proc. I get thousands of failures on my workstation, >> since I have large git repositories checked out to directories >> owned by my network account on the root hard drive. >> >> ||| >> || > version=3D"1">|| >> || || >> || Find files unowned by a user|| >> || || >> || Red Hat Enterprise Linux 6|| >> || || >> || All files should be owned by a >> user|| >> || || >> || || >> || > are owned by a user" test_ref=3D"file_permissions_unowned_test" />|| >> || || >> || || >> || >> || > id=3D"file_permissions_unowned_userid_list_match" version=3D"1">|| >> || > var_ref=3D"file_permissions_unowned_userid_list" datatype=3D"int" />= || >> || || >> || >> || > comment=3D"List of valid user ids" datatype=3D"int" version=3D"1">|| >> || > object_ref=3D"file_permissions_unowned_userid_list_object" />|| >> || || >> || >> || > id=3D"file_permissions_unowned_userid_list_object" version=3D"1">|| >> ||/etc/passwd|| >> || > match">^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$|| >> || > datatype=3D"int">1|| >> || || >> || >> || > id=3D"file_permissions_unowned_object" version=3D"1">|| >> || > recurse_direction=3D"down" recurse_file_system=3D"local" />|| >> || > match">^(?!\/proc)/|| >> || > action=3D"exclude">file_permissions_unowned_userid_list_match|| >> || || >> || >> || > comment=3D"Check user ids on all files on the system" >> id=3D"file_permissions_unowned_test" version=3D"1">|| >> || = || >> || || >> ||| >> >> - Maura Dailey >> >> _______________________________________________ >> scap-security-guide mailing list >> scap-security-guide(a)lists.fedorahosted.org >> >> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide >> >> >> >> >> _______________________________________________ >> scap-security-guide mailing list >> scap-security-guide(a)lists.fedorahosted.org >> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > > > > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide --===============6643393738957235692== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5KdXN0IHRvIGFkZCBvbiB0byB3aGF0IEkgc2FpZCwgSSdtCiAgICAgIHBvc2l0aXZlIHRoZSBj dXJyZW50IGNoZWNrcyB3ZXJlbid0IGFjdHVhbGx5IGRvaW5nIHJlY3Vyc2lvbiBhdAogICAgICBh bGwuIFlvdSBjYW4gdGVsbCBieSBob3cgcXVpY2tseSB0aGV5IHJldHVybi4gSW4gd2hpY2ggY2Fz ZSwgeWVzLAogICAgICB0aGUgcmVzdWx0cyAibWFrZSBzZW5zZSwiIGJlY2F1c2UgaXQgc3VjY2Vz c2Z1bGx5IGZpbmRzIHRoZSBvbmx5CiAgICAgIGZpbGVzIGluIC8gdGhhdCBiZWxvbmcgdG8gcm9v dCwgbmVnYXRlcyB0aGUgcmVzdWx0LCBhbmQgcHJpbnRzCiAgICAgIGZhbHNlLjxicj4KICAgICAg PGJyPgogICAgICAtIE1hdXJhIERhaWxleTxicj4KICAgICAgPGJyPgogICAgICBPbiAwNy8yMy8y MDEzIDA1OjEyIFBNLCBNYXVyYSBEYWlsZXkgd3JvdGU6PGJyPgogICAgPC9kaXY+CiAgICA8Ymxv Y2txdW90ZSBjaXRlPSJtaWQ6NTFFRUYxQTQuNjAyMDEwMkBlY2xpcHNlLm5jc2MubWlsIiB0eXBl PSJjaXRlIj4KICAgICAgPG1ldGEgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PVVURi04IiBo dHRwLWVxdWl2PSJDb250ZW50LVR5cGUiPgogICAgICA8ZGl2IGNsYXNzPSJtb3otY2l0ZS1wcmVm aXgiPlRoZSBjdXJyZW50IGNoZWNrIHRoYXQncyBjaGVja2VkIGludG8KICAgICAgICBnaXQgaXMg YnJva2VuLiBUaGUgcGVybWlzc2lvbnNfdW5ncm91cG93bmVkLnhtbCBjaGVjayBpcwogICAgICAg IHNlYXJjaGluZyB0aGUgbG9jYWwgZmlsZSBzeXN0ZW0gZm9yIHRoaW5ncyB3aXRoIGdyb3VwX2lk IHNldCB0bwogICAgICAgIDAgYW5kIG5lZ2F0aW5nIHRoZSByZXN1bHQgb2YgdGhlIGNoZWNrLiBU aGF0J3MgYWxsIGl0J3MgZG9pbmcuCiAgICAgICAgVGhlIHBlcm1pc3Npb25zX3Vub3duZWQueG1s IGNoZWNrIHdhcyBkb2luZyB0aGUgc2FtZSB0aGluZywgYnV0CiAgICAgICAgd2l0aCB1c2VyX2lk cyBzZXQgdG8gMC4gSSBmZWVsIGxpa2UgaXQgd2FzIGd1YXJhbnRlZWQgdG8gZmFpbC48YnI+CiAg ICAgICAgPGJyPgogICAgICAgIE9uIDA3LzIzLzIwMTMgMDQ6MzEgUE0sIEFuZHJldyBHaWxtb3Jl IHdyb3RlOjxicj4KICAgICAgPC9kaXY+CiAgICAgIDxibG9ja3F1b3RlCmNpdGU9Im1pZDpDQUQx czd1eU9DPXlPbksyS0hCaVJvSjAxSEUrQ3NvaXFydzExaXJVcVZUZFJBS3ZkZFFAbWFpbC5nbWFp bC5jb20iCiAgICAgICAgdHlwZT0iY2l0ZSI+CiAgICAgICAgPGRpdiBkaXI9Imx0ciI+CiAgICAg ICAgICA8ZGl2Pjxicj4KICAgICAgICAgIDwvZGl2PgogICAgICAgICAgSSwgYWxvbmcgd2l0aCBS b2JlcnQsIGFzc3VtZWQgdGhhdCB0aGUgdGVzdCB3YXMgdXNpbmcgc29tZQogICAgICAgICAgc29y dCBvZiBmaW5kKDEpIGludm9jYXRpb24uIEl0IGFwcGVhcnMgbm90IHRvIGJlLCBhbHRob3VnaAog ICAgICAgICAgdGhpcyBPVkFMIGlzIHByZXR0eSBvcGFxdWUgdG8gbWUuCiAgICAgICAgICA8ZGl2 Pjxicj4KICAgICAgICAgIDwvZGl2PgogICAgICAgICAgPGRpdiBzdHlsZT0iIj5XaGVuIEkgc2Vl IHRoZSBjdXJyZW50IGNoZWNrIGZhaWxpbmcgYWdhaW5zdCBteQogICAgICAgICAgICBzeXN0ZW0s IEkgdGhlbiBydW4gYSBmaW5kIGNvbW1hbmQsIGFuZCB0aGUgb25seSBvdXRwdXQgaXMKICAgICAg ICAgICAgY29tcGxhaW50cyBhYm91dCAvcHJvYyBlbnRyaWVzLiBJIHRoZW4gYXNzdW1lZCB0aGF0 IHRoaXMKICAgICAgICAgICAgb3V0cHV0IHdhcyB3aHkgdGhlIGNoZWNrIHdhcyBmYWlsaW5nLjwv ZGl2PgogICAgICAgICAgPGRpdiBzdHlsZT0iIj48YnI+CiAgICAgICAgICA8L2Rpdj4KICAgICAg ICAgIDxkaXYgc3R5bGU9IiI+SSBjYW4gY29uZmlybSB0aGF0IHRoaXMgY2hlY2sgZG9lcyBmYWls IGFnYWluc3QKICAgICAgICAgICAgbXkgc3lzdGVtLCBvciBhdCBsZWFzdCB0aGF0IHRlc3RjaGVj ayByZXR1cm5zIGZhbHNlLiBUaGUKICAgICAgICAgICAgcmVzdWx0cyBmaWxlIHBvaW50cyBhdCAv LmF1dG9mc2NrIGFuZCAvLnJlYWRhaGVhZF9jb2xsZWN0LAogICAgICAgICAgICB3aGljaCBkb2Vz bid0IG1ha2Ugc2Vuc2UgYXQgYWxsLjwvZGl2PgogICAgICAgICAgPGRpdiBzdHlsZT0iIj48YnI+ CiAgICAgICAgICA8L2Rpdj4KICAgICAgICAgIDxkaXYgc3R5bGU9IiI+VGhpcyBpcyBvbmUgb2Yg dGhlIG1vcmUgZnJ1c3RyYXRpbmcgZmFsc2UKICAgICAgICAgICAgcG9zaXRpdmVzIHRoYXQgSSBo YXZlLjwvZGl2PgogICAgICAgICAgPGRpdiBzdHlsZT0iIj48YnI+CiAgICAgICAgICA8L2Rpdj4K ICAgICAgICAgIDxkaXYgc3R5bGU9IiI+QW5kcmV3PC9kaXY+CiAgICAgICAgICA8ZGl2IHN0eWxl PSIiPjxicj4KICAgICAgICAgIDwvZGl2PgogICAgICAgICAgPGRpdiBjbGFzcz0iZ21haWxfZXh0 cmEiPjxicj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICA8ZGl2IGNsYXNzPSJnbWFpbF9x dW90ZSI+IE9uIFR1ZSwgSnVsIDIzLCAyMDEzIGF0IDE6NDcgUE0sCiAgICAgICAgICAgICAgTWF1 cmEgRGFpbGV5IDxzcGFuIGRpcj0ibHRyIj4mbHQ7PGEKICAgICAgICAgICAgICAgICAgbW96LWRv LW5vdC1zZW5kPSJ0cnVlIgogICAgICAgICAgICAgICAgICBocmVmPSJtYWlsdG86bWF1cmFAZWNs aXBzZS5uY3NjLm1pbCIgdGFyZ2V0PSJfYmxhbmsiPm1hdXJhQGVjbGlwc2UubmNzYy5taWw8L2E+ Jmd0Ozwvc3Bhbj4KICAgICAgICAgICAgICB3cm90ZTo8YnI+CiAgICAgICAgICAgICAgPGJsb2Nr cXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjAgMCAwCiAgICAgICAgICAg ICAgICAuOGV4O2JvcmRlci1sZWZ0OjFweCAjY2NjIHNvbGlkO3BhZGRpbmctbGVmdDoxZXgiPgog ICAgICAgICAgICAgICAgPGRpdiBiZ2NvbG9yPSIjRkZGRkZGIiB0ZXh0PSIjMDAwMDAwIj4gSnVz dCBhbiBhc2lkZSwgSQogICAgICAgICAgICAgICAgICBkaWQgc29tZSBwb2tpbmcgYXJvdW5kLCBh bmQgaXQgaXMgcG9zc2libGUgdG8KICAgICAgICAgICAgICAgICAgZWxpbWluYXRlIGRpcmVjdG9y aWVzIGZyb20gdGhlIHNlYXJjaC4gSSBsb29rZWQgYXQgdGhlCiAgICAgICAgICAgICAgICAgIFVT R0NCIHN0dWZmcyBhbmQgaGVyZSdzIHdoYXQgSSBwdXQgdG9nZXRoZXIgZm9yCiAgICAgICAgICAg ICAgICAgIGZpbGVfcGVybWlzc2lvbnNfdW5vd25lZC54bWwgaW4gT1ZBTCB0byBlbGltaW5hdGUK ICAgICAgICAgICAgICAgICAgL3Byb2MuIEkgY2FuIGRvIHRoZSBzYW1lIGZvciB0aGUgZ3JvdXAg aWQgdmVyc2lvbi4gVG8KICAgICAgICAgICAgICAgICAgYWRkIG1vcmUgZXhjbHVzaW9ucywgYWRk IGFuICd8JyBhZnRlciBwcm9jLCBhbmQgdHlwZQogICAgICAgICAgICAgICAgICBpbiBhbm90aGVy IGRpcmVjdG9yeSBwYXRoLiBJdCBkb2Vzbid0IHNlZW0gdG8gY2FyZSBpZgogICAgICAgICAgICAg ICAgICB5b3UgZXNjYXBlIHRoZSBmb3J3YXJkIHNsYXNoZXMsIGJ1dCBJIGxlZnQgdGhhdCBpbgog ICAgICAgICAgICAgICAgICBqdXN0IGluIGNhc2UgdGhlIGJlaGF2aW9yIGNoYW5nZXMgbGF0ZXIu PGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIElmIGFueW9uZSBk b2VzIGZpZ3VyZSBvdXQgaG93IHRvIHF1ZXJ5IFBBTSBvcgogICAgICAgICAgICAgICAgICBuc2xj ZC9uc2NkIGZvciBuZXR3b3JrIHVzZXIgaWRzLCBJIHRoaW5rIHlvdSBjYW4gYWRkCiAgICAgICAg ICAgICAgICAgIGl0IGFzIGFuIGV4dHJhIGZpbHRlciBvcHRpb24gdG8gdGhlCiAgICAgICAgICAg ICAgICAgIGZpbGVfcGVybWlzc2lvbnNfdW5vd25lZF9vYmplY3QuPGJyPgogICAgICAgICAgICAg ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIFBsZWFzZSBub3RlLCBJIGhhdmUgbm90IGdvdHRl biBhIHNpbmdsZSBmYWlsdXJlIHdpdGgKICAgICAgICAgICAgICAgICAgdGhpcyBjaGVjayBhZ2Fp bnN0IC9wcm9jLiBJIGdldCB0aG91c2FuZHMgb2YgZmFpbHVyZXMKICAgICAgICAgICAgICAgICAg b24gbXkgd29ya3N0YXRpb24sIHNpbmNlIEkgaGF2ZSBsYXJnZSBnaXQgcmVwb3NpdG9yaWVzCiAg ICAgICAgICAgICAgICAgIGNoZWNrZWQgb3V0IHRvIGRpcmVjdG9yaWVzIG93bmVkIGJ5IG15IG5l dHdvcmsgYWNjb3VudAogICAgICAgICAgICAgICAgICBvbiB0aGUgcm9vdCBoYXJkIGRyaXZlLjxi cj4KICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICA8Y29kZT4mbHQ7ZGVm LWdyb3VwJmd0OzwvY29kZT48Y29kZT48YnI+CiAgICAgICAgICAgICAgICAgIDwvY29kZT48Y29k ZT7CoCAmbHQ7ZGVmaW5pdGlvbiBjbGFzcz0iY29tcGxpYW5jZSIKICAgICAgICAgICAgICAgICAg ICBpZD0iZmlsZV9wZXJtaXNzaW9uc191bm93bmVkIiB2ZXJzaW9uPSIxIiZndDs8L2NvZGU+PGNv ZGU+PGJyPgogICAgICAgICAgICAgICAgICA8L2NvZGU+PGNvZGU+wqDCoMKgICZsdDttZXRhZGF0 YSZndDs8L2NvZGU+PGNvZGU+PGJyPgogICAgICAgICAgICAgICAgICA8L2NvZGU+PGNvZGU+wqDC oMKgwqDCoCAmbHQ7dGl0bGUmZ3Q7RmluZCBmaWxlcyB1bm93bmVkIGJ5CiAgICAgICAgICAgICAg ICAgICAgYSB1c2VyJmx0Oy90aXRsZSZndDs8L2NvZGU+PGNvZGU+PGJyPgogICAgICAgICAgICAg ICAgICA8L2NvZGU+PGNvZGU+wqDCoMKgwqDCoCAmbHQ7YWZmZWN0ZWQgZmFtaWx5PSJ1bml4IiZn dDs8L2NvZGU+PGNvZGU+PGJyPgogICAgICAgICAgICAgICAgICA8L2NvZGU+PGNvZGU+wqDCoMKg wqDCoMKgwqAgJmx0O3BsYXRmb3JtJmd0O1JlZCBIYXQKICAgICAgICAgICAgICAgICAgICBFbnRl cnByaXNlIExpbnV4IDYmbHQ7L3BsYXRmb3JtJmd0OzwvY29kZT48Y29kZT48YnI+CiAgICAgICAg ICAgICAgICAgIDwvY29kZT48Y29kZT7CoMKgwqDCoMKgICZsdDsvYWZmZWN0ZWQmZ3Q7PC9jb2Rl Pjxjb2RlPjxicj4KICAgICAgICAgICAgICAgICAgPC9jb2RlPjxjb2RlPsKgwqDCoMKgwqAgJmx0 O2Rlc2NyaXB0aW9uJmd0O0FsbCBmaWxlcyBzaG91bGQKICAgICAgICAgICAgICAgICAgICBiZSBv d25lZCBieSBhIHVzZXImbHQ7L2Rlc2NyaXB0aW9uJmd0OzwvY29kZT48Y29kZT48YnI+CiAgICAg ICAgICAgICAgICAgIDwvY29kZT48Y29kZT7CoMKgwqAgJmx0Oy9tZXRhZGF0YSZndDs8L2NvZGU+ PGNvZGU+PGJyPgogICAgICAgICAgICAgICAgICA8L2NvZGU+PGNvZGU+wqDCoMKgICZsdDtjcml0 ZXJpYSZndDs8L2NvZGU+PGNvZGU+PGJyPgogICAgICAgICAgICAgICAgICA8L2NvZGU+PGNvZGU+ wqDCoMKgwqDCoCAmbHQ7Y3JpdGVyaW9uIGNvbW1lbnQ9IkNoZWNrIGFsbAogICAgICAgICAgICAg ICAgICAgIGZpbGVzIGFuZCBtYWtlIHN1cmUgdGhleSBhcmUgb3duZWQgYnkgYSB1c2VyIgogICAg ICAgICAgICAgICAgICAgIHRlc3RfcmVmPSJmaWxlX3Blcm1pc3Npb25zX3Vub3duZWRfdGVzdCIg LyZndDs8L2NvZGU+PGNvZGU+PGJyPgogICAgICAgICAgICAgICAgICA8L2NvZGU+PGNvZGU+wqDC oMKgICZsdDsvY3JpdGVyaWEmZ3Q7PC9jb2RlPjxjb2RlPjxicj4KICAgICAgICAgICAgICAgICAg PC9jb2RlPjxjb2RlPsKgICZsdDsvZGVmaW5pdGlvbiZndDs8L2NvZGU+PGNvZGU+PGJyPgogICAg ICAgICAgICAgICAgICA8L2NvZGU+PGNvZGU+PGJyPgogICAgICAgICAgICAgICAgICA8L2NvZGU+ PGNvZGU+wqAgJmx0O3VuaXg6ZmlsZV9zdGF0ZQogICAgICAgICAgICAgICAgICAgIGlkPSJmaWxl X3Blcm1pc3Npb25zX3Vub3duZWRfdXNlcmlkX2xpc3RfbWF0Y2giCiAgICAgICAgICAgICAgICAg ICAgdmVyc2lvbj0iMSImZ3Q7PC9jb2RlPjxjb2RlPjxicj4KICAgICAgICAgICAgICAgICAgPC9j b2RlPjxjb2RlPsKgwqDCoCAmbHQ7dW5peDp1c2VyX2lkIHZhcl9jaGVjaz0iYXQgbGVhc3QKICAg ICAgICAgICAgICAgICAgICBvbmUiIHZhcl9yZWY9ImZpbGVfcGVybWlzc2lvbnNfdW5vd25lZF91 c2VyaWRfbGlzdCIKICAgICAgICAgICAgICAgICAgICBkYXRhdHlwZT0iaW50IiAvJmd0OzwvY29k ZT48Y29kZT48YnI+CiAgICAgICAgICAgICAgICAgIDwvY29kZT48Y29kZT7CoCAmbHQ7L3VuaXg6 ZmlsZV9zdGF0ZSZndDs8L2NvZGU+PGNvZGU+PGJyPgogICAgICAgICAgICAgICAgICA8L2NvZGU+ PGNvZGU+PGJyPgogICAgICAgICAgICAgICAgICA8L2NvZGU+PGNvZGU+wqAgJmx0O2xvY2FsX3Zh cmlhYmxlCiAgICAgICAgICAgICAgICAgICAgaWQ9ImZpbGVfcGVybWlzc2lvbnNfdW5vd25lZF91 c2VyaWRfbGlzdCIKICAgICAgICAgICAgICAgICAgICBjb21tZW50PSJMaXN0IG9mIHZhbGlkIHVz ZXIgaWRzIiBkYXRhdHlwZT0iaW50IgogICAgICAgICAgICAgICAgICAgIHZlcnNpb249IjEiJmd0 OzwvY29kZT48Y29kZT48YnI+CiAgICAgICAgICAgICAgICAgIDwvY29kZT48Y29kZT7CoMKgwqAg Jmx0O29iamVjdF9jb21wb25lbnQKICAgICAgICAgICAgICAgICAgICBpdGVtX2ZpZWxkPSJzdWJl eHByZXNzaW9uIgogICAgICAgICAgICAgICAgICAgIG9iamVjdF9yZWY9ImZpbGVfcGVybWlzc2lv bnNfdW5vd25lZF91c2VyaWRfbGlzdF9vYmplY3QiCiAgICAgICAgICAgICAgICAgICAgLyZndDs8 L2NvZGU+PGNvZGU+PGJyPgogICAgICAgICAgICAgICAgICA8L2NvZGU+PGNvZGU+wqAgJmx0Oy9s b2NhbF92YXJpYWJsZSZndDs8L2NvZGU+PGNvZGU+PGJyPgogICAgICAgICAgICAgICAgICA8L2Nv ZGU+PGNvZGU+PGJyPgogICAgICAgICAgICAgICAgICA8L2NvZGU+PGNvZGU+wqAgJmx0O2luZDp0 ZXh0ZmlsZWNvbnRlbnQ1NF9vYmplY3QKICAgICAgICAgICAgICAgICAgICBpZD0iZmlsZV9wZXJt aXNzaW9uc191bm93bmVkX3VzZXJpZF9saXN0X29iamVjdCIKICAgICAgICAgICAgICAgICAgICB2 ZXJzaW9uPSIxIiZndDs8L2NvZGU+PGNvZGU+PGJyPgogICAgICAgICAgICAgICAgICA8L2NvZGU+ PGNvZGU+wqDCoMKgCiAgICAgICAgICAgICAgICAgICAgJmx0O2luZDpmaWxlcGF0aCZndDsvZXRj L3Bhc3N3ZCZsdDsvaW5kOmZpbGVwYXRoJmd0OzwvY29kZT48Y29kZT48YnI+CiAgICAgICAgICAg ICAgICAgIDwvY29kZT48Y29kZT7CoMKgwqAgJmx0O2luZDpwYXR0ZXJuIG9wZXJhdGlvbj0icGF0 dGVybgptYXRjaCImZ3Q7XlteOl0rOlteOl0rOihbXGRdKyk6W1xkXSs6W146XSo6W146XSs6W146 XSokJmx0Oy9pbmQ6cGF0dGVybiZndDs8L2NvZGU+PGNvZGU+PGJyPgogICAgICAgICAgICAgICAg ICA8L2NvZGU+PGNvZGU+wqDCoMKgICZsdDtpbmQ6aW5zdGFuY2Ugb3BlcmF0aW9uPSJncmVhdGVy CiAgICAgICAgICAgICAgICAgICAgdGhhbiBvciBlcXVhbCIKICAgICAgICAgICAgICAgICAgICBk YXRhdHlwZT0iaW50IiZndDsxJmx0Oy9pbmQ6aW5zdGFuY2UmZ3Q7PC9jb2RlPjxjb2RlPjxicj4K ICAgICAgICAgICAgICAgICAgPC9jb2RlPjxjb2RlPsKgICZsdDsvaW5kOnRleHRmaWxlY29udGVu dDU0X29iamVjdCZndDs8L2NvZGU+PGNvZGU+PGJyPgogICAgICAgICAgICAgICAgICA8L2NvZGU+ PGNvZGU+PGJyPgogICAgICAgICAgICAgICAgICA8L2NvZGU+PGNvZGU+wqAgJmx0O3VuaXg6Zmls ZV9vYmplY3QgY29tbWVudD0iYWxsIGxvY2FsCiAgICAgICAgICAgICAgICAgICAgZmlsZXMiIGlk PSJmaWxlX3Blcm1pc3Npb25zX3Vub3duZWRfb2JqZWN0IgogICAgICAgICAgICAgICAgICAgIHZl cnNpb249IjEiJmd0OzwvY29kZT48Y29kZT48YnI+CiAgICAgICAgICAgICAgICAgIDwvY29kZT48 Y29kZT7CoMKgwqAgJmx0O3VuaXg6YmVoYXZpb3JzIHJlY3Vyc2U9InN5bWxpbmtzCiAgICAgICAg ICAgICAgICAgICAgYW5kIGRpcmVjdG9yaWVzIiByZWN1cnNlX2RpcmVjdGlvbj0iZG93biIKICAg ICAgICAgICAgICAgICAgICByZWN1cnNlX2ZpbGVfc3lzdGVtPSJsb2NhbCIgLyZndDs8L2NvZGU+ PGNvZGU+PGJyPgogICAgICAgICAgICAgICAgICA8L2NvZGU+PGNvZGU+wqDCoMKgICZsdDt1bml4 OmZpbGVwYXRoIG9wZXJhdGlvbj0icGF0dGVybgogICAgICAgICAgICAgICAgICAgIG1hdGNoIiZn dDteKD8hXC9wcm9jKS8mbHQ7L3VuaXg6ZmlsZXBhdGgmZ3Q7PC9jb2RlPjxjb2RlPjxicj4KICAg ICAgICAgICAgICAgICAgPC9jb2RlPjxjb2RlPsKgwqDCoCAmbHQ7ZmlsdGVyCmFjdGlvbj0iZXhj bHVkZSImZ3Q7ZmlsZV9wZXJtaXNzaW9uc191bm93bmVkX3VzZXJpZF9saXN0X21hdGNoJmx0Oy9m aWx0ZXImZ3Q7PC9jb2RlPjxjb2RlPjxicj4KICAgICAgICAgICAgICAgICAgPC9jb2RlPjxjb2Rl PsKgICZsdDsvdW5peDpmaWxlX29iamVjdCZndDs8L2NvZGU+PGNvZGU+PGJyPgogICAgICAgICAg ICAgICAgICA8L2NvZGU+PGNvZGU+PGJyPgogICAgICAgICAgICAgICAgICA8L2NvZGU+PGNvZGU+ wqAgJmx0O3VuaXg6ZmlsZV90ZXN0IGNoZWNrPSJhbGwiCiAgICAgICAgICAgICAgICAgICAgY2hl Y2tfZXhpc3RlbmNlPSJub25lX2V4aXN0IiBjb21tZW50PSJDaGVjayB1c2VyIGlkcwogICAgICAg ICAgICAgICAgICAgIG9uIGFsbCBmaWxlcyBvbiB0aGUgc3lzdGVtIgogICAgICAgICAgICAgICAg ICAgIGlkPSJmaWxlX3Blcm1pc3Npb25zX3Vub3duZWRfdGVzdCIgdmVyc2lvbj0iMSImZ3Q7PC9j b2RlPjxjb2RlPjxicj4KICAgICAgICAgICAgICAgICAgPC9jb2RlPjxjb2RlPsKgwqDCoCAmbHQ7 dW5peDpvYmplY3QKICAgICAgICAgICAgICAgICAgICBvYmplY3RfcmVmPSJmaWxlX3Blcm1pc3Np b25zX3Vub3duZWRfb2JqZWN0IiAvJmd0OzwvY29kZT48Y29kZT48YnI+CiAgICAgICAgICAgICAg ICAgIDwvY29kZT48Y29kZT7CoCAmbHQ7L3VuaXg6ZmlsZV90ZXN0Jmd0OzwvY29kZT48Y29kZT48 YnI+CiAgICAgICAgICAgICAgICAgIDwvY29kZT48Y29kZT4mbHQ7L2RlZi1ncm91cCZndDs8L2Nv ZGU+PHNwYW4KICAgICAgICAgICAgICAgICAgICBjbGFzcz0iSE9FblpiIj48Zm9udCBjb2xvcj0i Izg4ODg4OCI+PGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg ICAgICAgLSBNYXVyYSBEYWlsZXk8YnI+CiAgICAgICAgICAgICAgICAgICAgPC9mb250Pjwvc3Bh bj48L2Rpdj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIF9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPgogICAgICAgICAgICAgICAg c2NhcC1zZWN1cml0eS1ndWlkZSBtYWlsaW5nIGxpc3Q8YnI+CiAgICAgICAgICAgICAgICA8YSBt b3otZG8tbm90LXNlbmQ9InRydWUiCiAgICAgICAgICAgICAgICAgIGhyZWY9Im1haWx0bzpzY2Fw LXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciPnNjYXAtc2VjdXJpdHktZ3Vp ZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT48YnI+CiAgICAgICAgICAgICAgICA8YSBtb3ot ZG8tbm90LXNlbmQ9InRydWUiCmhyZWY9Imh0dHBzOi8vbGlzdHMuZmVkb3JhaG9zdGVkLm9yZy9t YWlsbWFuL2xpc3RpbmZvL3NjYXAtc2VjdXJpdHktZ3VpZGUiCiAgICAgICAgICAgICAgICAgIHRh cmdldD0iX2JsYW5rIj5odHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcvbWFpbG1hbi9saXN0 aW5mby9zY2FwLXNlY3VyaXR5LWd1aWRlPC9hPjxicj4KICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICA8 YnI+CiAgICAgICAgICA8L2Rpdj4KICAgICAgICA8L2Rpdj4KICAgICAgICA8YnI+CiAgICAgICAg PGZpZWxkc2V0IGNsYXNzPSJtaW1lQXR0YWNobWVudEhlYWRlciI+PC9maWVsZHNldD4KICAgICAg ICA8YnI+CiAgICAgICAgPHByZSB3cmFwPSIiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fCnNjYXAtc2VjdXJpdHktZ3VpZGUgbWFpbGluZyBsaXN0CjxhIG1v ei1kby1ub3Qtc2VuZD0idHJ1ZSIgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJl Zj0ibWFpbHRvOnNjYXAtc2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyI+c2Nh cC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPgo8YSBtb3otZG8tbm90 LXNlbmQ9InRydWUiIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9Imh0dHBzOi8v bGlzdHMuZmVkb3JhaG9zdGVkLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NjYXAtc2VjdXJpdHktZ3Vp ZGUiPmh0dHBzOi8vbGlzdHMuZmVkb3JhaG9zdGVkLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NjYXAt c2VjdXJpdHktZ3VpZGU8L2E+CjwvcHJlPgogICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgIDxicj4K ICAgICAgPGJyPgogICAgICA8ZmllbGRzZXQgY2xhc3M9Im1pbWVBdHRhY2htZW50SGVhZGVyIj48 L2ZpZWxkc2V0PgogICAgICA8YnI+CiAgICAgIDxwcmUgd3JhcD0iIj5fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpzY2FwLXNlY3VyaXR5LWd1aWRlIG1haWxp bmcgbGlzdAo8YSBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVkIiBocmVmPSJtYWlsdG86 c2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnIj5zY2FwLXNlY3VyaXR5 LWd1aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+CjxhIGNsYXNzPSJtb3otdHh0LWxpbmst ZnJlZXRleHQiIGhyZWY9Imh0dHBzOi8vbGlzdHMuZmVkb3JhaG9zdGVkLm9yZy9tYWlsbWFuL2xp c3RpbmZvL3NjYXAtc2VjdXJpdHktZ3VpZGUiPmh0dHBzOi8vbGlzdHMuZmVkb3JhaG9zdGVkLm9y Zy9tYWlsbWFuL2xpc3RpbmZvL3NjYXAtc2VjdXJpdHktZ3VpZGU8L2E+CjwvcHJlPgogICAgPC9i bG9ja3F1b3RlPgogICAgPGJyPgogIDwvYm9keT4KPC9odG1sPgo= --===============6643393738957235692==--