From rsanders at TrustedCS.com Thu Aug 20 11:34:40 2015 Content-Type: multipart/mixed; boundary="===============1152204990531891827==" MIME-Version: 1.0 From: Robert Sanders To: scap-security-guide at lists.fedorahosted.org Subject: RE: Suggestion on the 'Ensure All Files Are Owned...' items Date: Tue, 23 Jul 2013 20:44:42 +0000 Message-ID: <848FB1215E2AD643A5E10D906091D3FB63CD51@TCSEXCH1.tcs-sec.com> In-Reply-To: CAD1s7uyOC=yOnK2KHBiRoJ01HE+Csoiqrw11irUqVTdRAKvddQ@mail.gmail.com --===============1152204990531891827== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable I was absolutely doing the 'find' check to see why this item failed, as tha= t was the guidance I saw listed in the tags for both the n= o_files_unowned_by_user and no_files_unowned_by_group Rules , which I assum= ed (perhaps naively) was actually being done. I started triaging this beca= use the scans run by oscap with the SSG content were indicating a problem, = but Security Blanket (which isn't using find) were saying all was well. St= arted digging around to find out why. -Rob ________________________________ From: scap-security-guide-bounces(a)lists.fedorahosted.org [scap-security-g= uide-bounces(a)lists.fedorahosted.org] on behalf of Andrew Gilmore [agilmor= e2(a)gmail.com] Sent: Tuesday, July 23, 2013 4:31 PM To: scap-security-guide(a)lists.fedorahosted.org Subject: Re: Suggestion on the 'Ensure All Files Are Owned...' items I, along with Robert, assumed that the test was using some sort of find(1) = invocation. It appears not to be, although this OVAL is pretty opaque to me. When I see the current check failing against my system, I then run a find c= ommand, and the only output is complaints about /proc entries. I then assum= ed that this output was why the check was failing. I can confirm that this check does fail against my system, or at least that= testcheck returns false. The results file points at /.autofsck and /.reada= head_collect, which doesn't make sense at all. This is one of the more frustrating false positives that I have. Andrew On Tue, Jul 23, 2013 at 1:47 PM, Maura Dailey > wrote: Just an aside, I did some poking around, and it is possible to eliminate di= rectories from the search. I looked at the USGCB stuffs and here's what I p= ut together for file_permissions_unowned.xml in OVAL to eliminate /proc. I = can do the same for the group id version. To add more exclusions, add an '|= ' after proc, and type in another directory path. It doesn't seem to care i= f you escape the forward slashes, but I left that in just in case the behav= ior changes later. If anyone does figure out how to query PAM or nslcd/nscd for network user i= ds, I think you can add it as an extra filter option to the file_permission= s_unowned_object. Please note, I have not gotten a single failure with this check against /pr= oc. I get thousands of failures on my workstation, since I have large git r= epositories checked out to directories owned by my network account on the r= oot hard drive. Find files unowned by a user Red Hat Enterprise Linux 6 All files should be owned by a user /etc/passwd ^[^:]+:[^:]+:([\d]+):[\d]+:[^:= ]*:[^:]+:[^:]*$ 1 ^(?!\/proc)/ file_permissions_unowned_userid_list_match - Maura Dailey _______________________________________________ scap-security-guide mailing list scap-security-guide(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide --===============1152204990531891827== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWwgZGlyPSJsdHIiPgo8aGVhZD4KPG1ldGEgaHR0cC1lcXVpdj0iQ29udGVudC1UeXBlIiBj b250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9aXNvLTg4NTktMSI+CjxzdHlsZSBpZD0ib3dhUGFy YVN0eWxlIiB0eXBlPSJ0ZXh0L2NzcyI+UCB7bWFyZ2luLXRvcDowO21hcmdpbi1ib3R0b206MDt9 PC9zdHlsZT4KPC9oZWFkPgo8Ym9keSBvY3NpPSIwIiBmcHN0eWxlPSIxIj4KPGRpdiBzdHlsZT0i ZGlyZWN0aW9uOiBsdHI7Zm9udC1mYW1pbHk6IFRhaG9tYTtjb2xvcjogIzAwMDAwMDtmb250LXNp emU6IDEwcHQ7Ij5JIHdhcyBhYnNvbHV0ZWx5IGRvaW5nIHRoZSAnZmluZCcgY2hlY2sgdG8gc2Vl IHdoeSB0aGlzIGl0ZW0gZmFpbGVkLCBhcyB0aGF0IHdhcyB0aGUgZ3VpZGFuY2UgSSBzYXcgbGlz dGVkIGluIHRoZSAmbHQ7Y2hlY2stY29udGVudCZndDsmbmJzcDsgdGFncyBmb3IgYm90aCB0aGUg bm9fZmlsZXNfdW5vd25lZF9ieV91c2VyIGFuZAogbm9fZmlsZXNfdW5vd25lZF9ieV9ncm91cCBS dWxlcyAsIHdoaWNoIEkgYXNzdW1lZCAocGVyaGFwcyBuYWl2ZWx5KSB3YXMgYWN0dWFsbHkgYmVp bmcgZG9uZS4mbmJzcDsgSSBzdGFydGVkIHRyaWFnaW5nIHRoaXMgYmVjYXVzZSB0aGUgc2NhbnMg cnVuIGJ5IG9zY2FwIHdpdGggdGhlIFNTRyBjb250ZW50IHdlcmUgaW5kaWNhdGluZyBhIHByb2Js ZW0sIGJ1dCBTZWN1cml0eSBCbGFua2V0ICh3aGljaCBpc24ndCB1c2luZyBmaW5kKSB3ZXJlIHNh eWluZyBhbGwKIHdhcyB3ZWxsLiZuYnNwOyBTdGFydGVkIGRpZ2dpbmcgYXJvdW5kIHRvIGZpbmQg b3V0IHdoeS48YnI+Cjxicj4KLVJvYjxicj4KPGJyPgo8ZGl2IHN0eWxlPSJmb250LWZhbWlseTog VGltZXMgTmV3IFJvbWFuOyBjb2xvcjogcmdiKDAsIDAsIDApOyBmb250LXNpemU6IDE2cHg7Ij4K PGhyIHRhYmluZGV4PSItMSI+CjxkaXYgc3R5bGU9ImRpcmVjdGlvbjogbHRyOyIgaWQ9ImRpdlJw RjI4ODAyMyI+PGZvbnQgY29sb3I9IiMwMDAwMDAiIGZhY2U9IlRhaG9tYSIgc2l6ZT0iMiI+PGI+ RnJvbTo8L2I+IHNjYXAtc2VjdXJpdHktZ3VpZGUtYm91bmNlc0BsaXN0cy5mZWRvcmFob3N0ZWQu b3JnIFtzY2FwLXNlY3VyaXR5LWd1aWRlLWJvdW5jZXNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZ10g b24gYmVoYWxmIG9mIEFuZHJldyBHaWxtb3JlIFthZ2lsbW9yZTJAZ21haWwuY29tXTxicj4KPGI+ U2VudDo8L2I+IFR1ZXNkYXksIEp1bHkgMjMsIDIwMTMgNDozMSBQTTxicj4KPGI+VG86PC9iPiBz Y2FwLXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8YnI+CjxiPlN1YmplY3Q6 PC9iPiBSZTogU3VnZ2VzdGlvbiBvbiB0aGUgJ0Vuc3VyZSBBbGwgRmlsZXMgQXJlIE93bmVkLi4u JyBpdGVtczxicj4KPC9mb250Pjxicj4KPC9kaXY+CjxkaXY+PC9kaXY+CjxkaXY+CjxkaXYgZGly PSJsdHIiPgo8ZGl2Pjxicj4KPC9kaXY+CkksIGFsb25nIHdpdGggUm9iZXJ0LCBhc3N1bWVkIHRo YXQgdGhlIHRlc3Qgd2FzIHVzaW5nIHNvbWUgc29ydCBvZiBmaW5kKDEpIGludm9jYXRpb24uIEl0 IGFwcGVhcnMgbm90IHRvIGJlLCBhbHRob3VnaCB0aGlzIE9WQUwgaXMgcHJldHR5IG9wYXF1ZSB0 byBtZS4KPGRpdj48YnI+CjwvZGl2Pgo8ZGl2IHN0eWxlPSIiPldoZW4gSSBzZWUgdGhlIGN1cnJl bnQgY2hlY2sgZmFpbGluZyBhZ2FpbnN0IG15IHN5c3RlbSwgSSB0aGVuIHJ1biBhIGZpbmQgY29t bWFuZCwgYW5kIHRoZSBvbmx5IG91dHB1dCBpcyBjb21wbGFpbnRzIGFib3V0IC9wcm9jIGVudHJp ZXMuIEkgdGhlbiBhc3N1bWVkIHRoYXQgdGhpcyBvdXRwdXQgd2FzIHdoeSB0aGUgY2hlY2sgd2Fz IGZhaWxpbmcuPC9kaXY+CjxkaXYgc3R5bGU9IiI+PGJyPgo8L2Rpdj4KPGRpdiBzdHlsZT0iIj5J IGNhbiBjb25maXJtIHRoYXQgdGhpcyBjaGVjayBkb2VzIGZhaWwgYWdhaW5zdCBteSBzeXN0ZW0s IG9yIGF0IGxlYXN0IHRoYXQgdGVzdGNoZWNrIHJldHVybnMgZmFsc2UuIFRoZSByZXN1bHRzIGZp bGUgcG9pbnRzIGF0IC8uYXV0b2ZzY2sgYW5kIC8ucmVhZGFoZWFkX2NvbGxlY3QsIHdoaWNoIGRv ZXNuJ3QgbWFrZSBzZW5zZSBhdCBhbGwuPC9kaXY+CjxkaXYgc3R5bGU9IiI+PGJyPgo8L2Rpdj4K PGRpdiBzdHlsZT0iIj5UaGlzIGlzIG9uZSBvZiB0aGUgbW9yZSBmcnVzdHJhdGluZyBmYWxzZSBw b3NpdGl2ZXMgdGhhdCBJIGhhdmUuPC9kaXY+CjxkaXYgc3R5bGU9IiI+PGJyPgo8L2Rpdj4KPGRp diBzdHlsZT0iIj5BbmRyZXc8L2Rpdj4KPGRpdiBzdHlsZT0iIj48YnI+CjwvZGl2Pgo8ZGl2IGNs YXNzPSJnbWFpbF9leHRyYSI+PGJyPgo8YnI+CjxkaXYgY2xhc3M9ImdtYWlsX3F1b3RlIj5PbiBU dWUsIEp1bCAyMywgMjAxMyBhdCAxOjQ3IFBNLCBNYXVyYSBEYWlsZXkgPHNwYW4gZGlyPSJsdHIi PgombHQ7PGEgaHJlZj0ibWFpbHRvOm1hdXJhQGVjbGlwc2UubmNzYy5taWwiIHRhcmdldD0iX2Js YW5rIj5tYXVyYUBlY2xpcHNlLm5jc2MubWlsPC9hPiZndDs8L3NwYW4+IHdyb3RlOjxicj4KPGJs b2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOiAwcHQgMHB0IDBwdCAw LjhleDsgYm9yZGVyLWxlZnQ6IDFweCBzb2xpZCByZ2IoMjA0LCAyMDQsIDIwNCk7IHBhZGRpbmct bGVmdDogMWV4OyI+CjxkaXYgYmdjb2xvcj0iI0ZGRkZGRiI+SnVzdCBhbiBhc2lkZSwgSSBkaWQg c29tZSBwb2tpbmcgYXJvdW5kLCBhbmQgaXQgaXMgcG9zc2libGUgdG8gZWxpbWluYXRlIGRpcmVj dG9yaWVzIGZyb20gdGhlIHNlYXJjaC4gSSBsb29rZWQgYXQgdGhlIFVTR0NCIHN0dWZmcyBhbmQg aGVyZSdzIHdoYXQgSSBwdXQgdG9nZXRoZXIgZm9yIGZpbGVfcGVybWlzc2lvbnNfdW5vd25lZC54 bWwgaW4gT1ZBTCB0byBlbGltaW5hdGUgL3Byb2MuIEkgY2FuIGRvIHRoZQogc2FtZSBmb3IgdGhl IGdyb3VwIGlkIHZlcnNpb24uIFRvIGFkZCBtb3JlIGV4Y2x1c2lvbnMsIGFkZCBhbiAnfCcgYWZ0 ZXIgcHJvYywgYW5kIHR5cGUgaW4gYW5vdGhlciBkaXJlY3RvcnkgcGF0aC4gSXQgZG9lc24ndCBz ZWVtIHRvIGNhcmUgaWYgeW91IGVzY2FwZSB0aGUgZm9yd2FyZCBzbGFzaGVzLCBidXQgSSBsZWZ0 IHRoYXQgaW4ganVzdCBpbiBjYXNlIHRoZSBiZWhhdmlvciBjaGFuZ2VzIGxhdGVyLjxicj4KPGJy PgpJZiBhbnlvbmUgZG9lcyBmaWd1cmUgb3V0IGhvdyB0byBxdWVyeSBQQU0gb3IgbnNsY2QvbnNj ZCBmb3IgbmV0d29yayB1c2VyIGlkcywgSSB0aGluayB5b3UgY2FuIGFkZCBpdCBhcyBhbiBleHRy YSBmaWx0ZXIgb3B0aW9uIHRvIHRoZSBmaWxlX3Blcm1pc3Npb25zX3Vub3duZWRfb2JqZWN0Ljxi cj4KPGJyPgpQbGVhc2Ugbm90ZSwgSSBoYXZlIG5vdCBnb3R0ZW4gYSBzaW5nbGUgZmFpbHVyZSB3 aXRoIHRoaXMgY2hlY2sgYWdhaW5zdCAvcHJvYy4gSSBnZXQgdGhvdXNhbmRzIG9mIGZhaWx1cmVz IG9uIG15IHdvcmtzdGF0aW9uLCBzaW5jZSBJIGhhdmUgbGFyZ2UgZ2l0IHJlcG9zaXRvcmllcyBj aGVja2VkIG91dCB0byBkaXJlY3RvcmllcyBvd25lZCBieSBteSBuZXR3b3JrIGFjY291bnQgb24g dGhlIHJvb3QgaGFyZCBkcml2ZS48YnI+Cjxicj4KPGNvZGU+Jmx0O2RlZi1ncm91cCZndDs8L2Nv ZGU+PGNvZGU+PGJyPgo8L2NvZGU+PGNvZGU+Jm5ic3A7ICZsdDtkZWZpbml0aW9uIGNsYXNzPSZx dW90O2NvbXBsaWFuY2UmcXVvdDsgaWQ9JnF1b3Q7ZmlsZV9wZXJtaXNzaW9uc191bm93bmVkJnF1 b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8L2NvZGU+PGNvZGU+PGJyPgo8L2NvZGU+PGNv ZGU+Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZsdDttZXRhZGF0YSZndDs8L2NvZGU+PGNvZGU+PGJyPgo8 L2NvZGU+PGNvZGU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZsdDt0aXRsZSZndDtG aW5kIGZpbGVzIHVub3duZWQgYnkgYSB1c2VyJmx0Oy90aXRsZSZndDs8L2NvZGU+PGNvZGU+PGJy Pgo8L2NvZGU+PGNvZGU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZsdDthZmZlY3Rl ZCBmYW1pbHk9JnF1b3Q7dW5peCZxdW90OyZndDs8L2NvZGU+PGNvZGU+PGJyPgo8L2NvZGU+PGNv ZGU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZsdDtwbGF0Zm9y bSZndDtSZWQgSGF0IEVudGVycHJpc2UgTGludXggNiZsdDsvcGxhdGZvcm0mZ3Q7PC9jb2RlPjxj b2RlPjxicj4KPC9jb2RlPjxjb2RlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmbHQ7 L2FmZmVjdGVkJmd0OzwvY29kZT48Y29kZT48YnI+CjwvY29kZT48Y29kZT4mbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsgJmx0O2Rlc2NyaXB0aW9uJmd0O0FsbCBmaWxlcyBzaG91bGQgYmUg b3duZWQgYnkgYSB1c2VyJmx0Oy9kZXNjcmlwdGlvbiZndDs8L2NvZGU+PGNvZGU+PGJyPgo8L2Nv ZGU+PGNvZGU+Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZsdDsvbWV0YWRhdGEmZ3Q7PC9jb2RlPjxjb2Rl Pjxicj4KPC9jb2RlPjxjb2RlPiZuYnNwOyZuYnNwOyZuYnNwOyAmbHQ7Y3JpdGVyaWEmZ3Q7PC9j b2RlPjxjb2RlPjxicj4KPC9jb2RlPjxjb2RlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyAmbHQ7Y3JpdGVyaW9uIGNvbW1lbnQ9JnF1b3Q7Q2hlY2sgYWxsIGZpbGVzIGFuZCBtYWtlIHN1 cmUgdGhleSBhcmUgb3duZWQgYnkgYSB1c2VyJnF1b3Q7IHRlc3RfcmVmPSZxdW90O2ZpbGVfcGVy bWlzc2lvbnNfdW5vd25lZF90ZXN0JnF1b3Q7IC8mZ3Q7PC9jb2RlPjxjb2RlPjxicj4KPC9jb2Rl Pjxjb2RlPiZuYnNwOyZuYnNwOyZuYnNwOyAmbHQ7L2NyaXRlcmlhJmd0OzwvY29kZT48Y29kZT48 YnI+CjwvY29kZT48Y29kZT4mbmJzcDsgJmx0Oy9kZWZpbml0aW9uJmd0OzwvY29kZT48Y29kZT48 YnI+CjwvY29kZT48Y29kZT48YnI+CjwvY29kZT48Y29kZT4mbmJzcDsgJmx0O3VuaXg6ZmlsZV9z dGF0ZSBpZD0mcXVvdDtmaWxlX3Blcm1pc3Npb25zX3Vub3duZWRfdXNlcmlkX2xpc3RfbWF0Y2gm cXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0OzwvY29kZT48Y29kZT48YnI+CjwvY29kZT48 Y29kZT4mbmJzcDsmbmJzcDsmbmJzcDsgJmx0O3VuaXg6dXNlcl9pZCB2YXJfY2hlY2s9JnF1b3Q7 YXQgbGVhc3Qgb25lJnF1b3Q7IHZhcl9yZWY9JnF1b3Q7ZmlsZV9wZXJtaXNzaW9uc191bm93bmVk X3VzZXJpZF9saXN0JnF1b3Q7IGRhdGF0eXBlPSZxdW90O2ludCZxdW90OyAvJmd0OzwvY29kZT48 Y29kZT48YnI+CjwvY29kZT48Y29kZT4mbmJzcDsgJmx0Oy91bml4OmZpbGVfc3RhdGUmZ3Q7PC9j b2RlPjxjb2RlPjxicj4KPC9jb2RlPjxjb2RlPjxicj4KPC9jb2RlPjxjb2RlPiZuYnNwOyAmbHQ7 bG9jYWxfdmFyaWFibGUgaWQ9JnF1b3Q7ZmlsZV9wZXJtaXNzaW9uc191bm93bmVkX3VzZXJpZF9s aXN0JnF1b3Q7IGNvbW1lbnQ9JnF1b3Q7TGlzdCBvZiB2YWxpZCB1c2VyIGlkcyZxdW90OyBkYXRh dHlwZT0mcXVvdDtpbnQmcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7Jmd0OzwvY29kZT48Y29k ZT48YnI+CjwvY29kZT48Y29kZT4mbmJzcDsmbmJzcDsmbmJzcDsgJmx0O29iamVjdF9jb21wb25l bnQgaXRlbV9maWVsZD0mcXVvdDtzdWJleHByZXNzaW9uJnF1b3Q7IG9iamVjdF9yZWY9JnF1b3Q7 ZmlsZV9wZXJtaXNzaW9uc191bm93bmVkX3VzZXJpZF9saXN0X29iamVjdCZxdW90OyAvJmd0Ozwv Y29kZT48Y29kZT48YnI+CjwvY29kZT48Y29kZT4mbmJzcDsgJmx0Oy9sb2NhbF92YXJpYWJsZSZn dDs8L2NvZGU+PGNvZGU+PGJyPgo8L2NvZGU+PGNvZGU+PGJyPgo8L2NvZGU+PGNvZGU+Jm5ic3A7 ICZsdDtpbmQ6dGV4dGZpbGVjb250ZW50NTRfb2JqZWN0IGlkPSZxdW90O2ZpbGVfcGVybWlzc2lv bnNfdW5vd25lZF91c2VyaWRfbGlzdF9vYmplY3QmcXVvdDsgdmVyc2lvbj0mcXVvdDsxJnF1b3Q7 Jmd0OzwvY29kZT48Y29kZT48YnI+CjwvY29kZT48Y29kZT4mbmJzcDsmbmJzcDsmbmJzcDsgJmx0 O2luZDpmaWxlcGF0aCZndDsvZXRjL3Bhc3N3ZCZsdDsvaW5kOmZpbGVwYXRoJmd0OzwvY29kZT48 Y29kZT48YnI+CjwvY29kZT48Y29kZT4mbmJzcDsmbmJzcDsmbmJzcDsgJmx0O2luZDpwYXR0ZXJu IG9wZXJhdGlvbj0mcXVvdDtwYXR0ZXJuIG1hdGNoJnF1b3Q7Jmd0O15bXjpdJiM0Mzs6W146XSYj NDM7OihbXGRdJiM0MzspOltcZF0mIzQzOzpbXjpdKjpbXjpdJiM0Mzs6W146XSokJmx0Oy9pbmQ6 cGF0dGVybiZndDs8L2NvZGU+PGNvZGU+PGJyPgo8L2NvZGU+PGNvZGU+Jm5ic3A7Jm5ic3A7Jm5i c3A7ICZsdDtpbmQ6aW5zdGFuY2Ugb3BlcmF0aW9uPSZxdW90O2dyZWF0ZXIgdGhhbiBvciBlcXVh bCZxdW90OyBkYXRhdHlwZT0mcXVvdDtpbnQmcXVvdDsmZ3Q7MSZsdDsvaW5kOmluc3RhbmNlJmd0 OzwvY29kZT48Y29kZT48YnI+CjwvY29kZT48Y29kZT4mbmJzcDsgJmx0Oy9pbmQ6dGV4dGZpbGVj b250ZW50NTRfb2JqZWN0Jmd0OzwvY29kZT48Y29kZT48YnI+CjwvY29kZT48Y29kZT48YnI+Cjwv Y29kZT48Y29kZT4mbmJzcDsgJmx0O3VuaXg6ZmlsZV9vYmplY3QgY29tbWVudD0mcXVvdDthbGwg bG9jYWwgZmlsZXMmcXVvdDsgaWQ9JnF1b3Q7ZmlsZV9wZXJtaXNzaW9uc191bm93bmVkX29iamVj dCZxdW90OyB2ZXJzaW9uPSZxdW90OzEmcXVvdDsmZ3Q7PC9jb2RlPjxjb2RlPjxicj4KPC9jb2Rl Pjxjb2RlPiZuYnNwOyZuYnNwOyZuYnNwOyAmbHQ7dW5peDpiZWhhdmlvcnMgcmVjdXJzZT0mcXVv dDtzeW1saW5rcyBhbmQgZGlyZWN0b3JpZXMmcXVvdDsgcmVjdXJzZV9kaXJlY3Rpb249JnF1b3Q7 ZG93biZxdW90OyByZWN1cnNlX2ZpbGVfc3lzdGVtPSZxdW90O2xvY2FsJnF1b3Q7IC8mZ3Q7PC9j b2RlPjxjb2RlPjxicj4KPC9jb2RlPjxjb2RlPiZuYnNwOyZuYnNwOyZuYnNwOyAmbHQ7dW5peDpm aWxlcGF0aCBvcGVyYXRpb249JnF1b3Q7cGF0dGVybiBtYXRjaCZxdW90OyZndDteKD8hXC9wcm9j KS8mbHQ7L3VuaXg6ZmlsZXBhdGgmZ3Q7PC9jb2RlPjxjb2RlPjxicj4KPC9jb2RlPjxjb2RlPiZu YnNwOyZuYnNwOyZuYnNwOyAmbHQ7ZmlsdGVyIGFjdGlvbj0mcXVvdDtleGNsdWRlJnF1b3Q7Jmd0 O2ZpbGVfcGVybWlzc2lvbnNfdW5vd25lZF91c2VyaWRfbGlzdF9tYXRjaCZsdDsvZmlsdGVyJmd0 OzwvY29kZT48Y29kZT48YnI+CjwvY29kZT48Y29kZT4mbmJzcDsgJmx0Oy91bml4OmZpbGVfb2Jq ZWN0Jmd0OzwvY29kZT48Y29kZT48YnI+CjwvY29kZT48Y29kZT48YnI+CjwvY29kZT48Y29kZT4m bmJzcDsgJmx0O3VuaXg6ZmlsZV90ZXN0IGNoZWNrPSZxdW90O2FsbCZxdW90OyBjaGVja19leGlz dGVuY2U9JnF1b3Q7bm9uZV9leGlzdCZxdW90OyBjb21tZW50PSZxdW90O0NoZWNrIHVzZXIgaWRz IG9uIGFsbCBmaWxlcyBvbiB0aGUgc3lzdGVtJnF1b3Q7IGlkPSZxdW90O2ZpbGVfcGVybWlzc2lv bnNfdW5vd25lZF90ZXN0JnF1b3Q7IHZlcnNpb249JnF1b3Q7MSZxdW90OyZndDs8L2NvZGU+PGNv ZGU+PGJyPgo8L2NvZGU+PGNvZGU+Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZsdDt1bml4Om9iamVjdCBv YmplY3RfcmVmPSZxdW90O2ZpbGVfcGVybWlzc2lvbnNfdW5vd25lZF9vYmplY3QmcXVvdDsgLyZn dDs8L2NvZGU+PGNvZGU+PGJyPgo8L2NvZGU+PGNvZGU+Jm5ic3A7ICZsdDsvdW5peDpmaWxlX3Rl c3QmZ3Q7PC9jb2RlPjxjb2RlPjxicj4KPC9jb2RlPjxjb2RlPiZsdDsvZGVmLWdyb3VwJmd0Ozwv Y29kZT48c3BhbiBjbGFzcz0iSE9FblpiIj48Zm9udCBjb2xvcj0iIzg4ODg4OCI+PGJyPgo8YnI+ Ci0gTWF1cmEgRGFpbGV5PGJyPgo8L2ZvbnQ+PC9zcGFuPjwvZGl2Pgo8YnI+Cl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPgpzY2FwLXNlY3VyaXR5LWd1 aWRlIG1haWxpbmcgbGlzdDxicj4KPGEgaHJlZj0ibWFpbHRvOnNjYXAtc2VjdXJpdHktZ3VpZGVA bGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPnNjYXAtc2VjdXJpdHktZ3Vp ZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT48YnI+CjxhIGhyZWY9Imh0dHBzOi8vbGlzdHMu ZmVkb3JhaG9zdGVkLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NjYXAtc2VjdXJpdHktZ3VpZGUiIHRh cmdldD0iX2JsYW5rIj5odHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcvbWFpbG1hbi9saXN0 aW5mby9zY2FwLXNlY3VyaXR5LWd1aWRlPC9hPjxicj4KPGJyPgo8L2Jsb2NrcXVvdGU+CjwvZGl2 Pgo8YnI+CjwvZGl2Pgo8L2Rpdj4KPC9kaXY+CjwvZGl2Pgo8L2Rpdj4KPC9ib2R5Pgo8L2h0bWw+ Cg== --===============1152204990531891827==--