From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from atuin.qyliss.net (localhost [IPv6:::1]) by atuin.qyliss.net (Postfix) with ESMTP id F22DE62D6; Tue, 21 Jul 2026 20:11:52 +0000 (UTC) Received: by atuin.qyliss.net (Postfix, from userid 993) id 8B37A62A7; Tue, 21 Jul 2026 20:11:49 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on atuin.qyliss.net X-Spam-Level: X-Spam-Status: No, score=-0.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DMARC_PASS,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 Received: from mail-yw1-x1136.google.com (mail-yw1-x1136.google.com [IPv6:2607:f8b0:4864:20::1136]) by atuin.qyliss.net (Postfix) with ESMTPS id 677C562A4 for ; Tue, 21 Jul 2026 20:11:48 +0000 (UTC) Received: by mail-yw1-x1136.google.com with SMTP id 00721157ae682-81eff3ddba4so44978007b3.3 for ; Tue, 21 Jul 2026 13:11:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784664705; x=1785269505; darn=spectrum-os.org; h=content-type:in-reply-to:autocrypt:from:content-language:references :cc:to:subject:user-agent:mime-version:date:message-id:from:to:cc :subject:date:message-id:reply-to:content-type; bh=dGq/9GsRWJ5B5Zl63GnrmWRuk6A7YM1MmGv8+P2nk8A=; b=H2NaPnnUa0OiVwfJDxNpvrNaIn6WrrbqBzXSVY9OByYGAfUgUiCdN2DF9B7ekmQm18 urSm3AmVFxJl37NgwDIjV5f/t55hMFFocS4HIn+0Cy7oE7A4hQ8lBSEOtsXHzj4KvXgj rkm13zP0bqILQ9pp5V0CEQxYDb9ZWqD67kvx1L4PURODi0D7aTxoGQ4seTdjQa9zIPGc D9Onr4eyoHs/cAk4qDffXg/Aw7DpIllwHiDL7C6YO+WfE2O0v01dkDHhTL6adzf7J5FQ 3Z80pSpFTZ2eXQLIw0FGDs/DAiCcTdmuKB+N/m4GTYFofF+1mnvxN9jRrAa8BpUscdEQ TRew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784664705; x=1785269505; h=content-type:in-reply-to:autocrypt:from:content-language:references :cc:to:subject:user-agent:mime-version:date:message-id:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=dGq/9GsRWJ5B5Zl63GnrmWRuk6A7YM1MmGv8+P2nk8A=; b=Y/i8OMEH54FEyqcTfS7XREQvhj3aXotVD1ERpiDlsIHHMqidFO5lDa9PC3/mF972Gb /JwpjRAQeR9cjhFPAmdqip3mI20+HGX059RrxmXlnvfdhOQV2xYgSahCmxa9NVg/vG/1 GZLAoAros1orbEcYvRynGapGvT11h2XMVpfjBMTBMbCcC63riNdey7tpwzhTTWcDgh43 tcPA489fJ/D+dvVRPCwpIMFZ7RybxnY3/sBYsWxy8F1wSiXDrEDYF+tX60iK4pgB8LXX 3XCiiyo+BLszkP6gtbRvO3MC7dHikZc07J7ecm4vK3Cx3qsRGnjEZIrpRynjNvOzd4ah 45TA== X-Gm-Message-State: AOJu0YxWHmloOr8quUD6jHM1ubUP5301zueKngM089Ej+gAaZjczGPF1 zIHk9r9C1QCoL9Civi+hXQDR/qcb0VhJJOipJSuWuXH4rwb9GhfC5YuihoustQ== X-Gm-Gg: AR+sD11XNZgEWYkrNof66+eE0J9nqRYs0vfl/13oQruaRH0jmP0928Y5/FuAFzrWCn9 vXmiFPoE2s3iH5EyDp5A1fv0yDfDY0mTPa4RGEBHnuZi2oHzkr6Vsc4j+FuD6NkVmVN9Fs0huI0 7CB6bxT71L80kAClUlU+b0hm8GD/JmwPpkHuHCO7WSi1xZWziiqYFrhcSIg2NQLB9k8wluQTMUk h9I4RvFyy1RZHl3D1nHgFQ63i52DtAJvJAvMTCVLF7l2g+QNof6u2Kg2ux6BLcSnQikvV2hYQ59 +kac908Y0q7nvLdaQnORb3J83uiCbPCCD3PKMW3llCiwnM4a44gfFODJZAPr1tWG5XBqKtAK7Td wGfZvYNUstLo+DDRrMmbfGMx+mJg9xqMJWNA6gI2TgHPJfcRtvvMEkgW+uHwoK1te1zc2UERzeh xxJcyJEYyHgTtmPmQ= X-Received: by 2002:a05:690c:4c0f:b0:81e:68f6:f842 with SMTP id 00721157ae682-81ef25a1657mr64646087b3.3.1784664705014; Tue, 21 Jul 2026 13:11:45 -0700 (PDT) Received: from [10.138.10.6] ([185.98.168.14]) by smtp.gmail.com with ESMTPSA id 00721157ae682-81f33c397c9sm3189127b3.14.2026.07.21.13.11.42 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 21 Jul 2026 13:11:42 -0700 (PDT) Message-ID: Date: Tue, 21 Jul 2026 16:11:38 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: Why is /run/vm/by-id/${VM} writable by the VMM? To: Alyssa Ross References: <87ech71crf.fsf@alyssa.is> <0d8076ca-dd4d-42c2-9806-0f78841ae397@gmail.com> <8733xkqe22.fsf@alyssa.is> <87se5cl45p.fsf@alyssa.is> Content-Language: en-US From: Demi Marie Obenour Autocrypt: addr=demiobenour@gmail.com; keydata= xsFNBFp+A0oBEADffj6anl9/BHhUSxGTICeVl2tob7hPDdhHNgPR4C8xlYt5q49yB+l2nipd aq+4Gk6FZfqC825TKl7eRpUjMriwle4r3R0ydSIGcy4M6eb0IcxmuPYfbWpr/si88QKgyGSV Z7GeNW1UnzTdhYHuFlk8dBSmB1fzhEYEk0RcJqg4AKoq6/3/UorR+FaSuVwT7rqzGrTlscnT DlPWgRzrQ3jssesI7sZLm82E3pJSgaUoCdCOlL7MMPCJwI8JpPlBedRpe9tfVyfu3euTPLPx wcV3L/cfWPGSL4PofBtB8NUU6QwYiQ9Hzx4xOyn67zW73/G0Q2vPPRst8LBDqlxLjbtx/WLR 6h3nBc3eyuZ+q62HS1pJ5EvUT1vjyJ1ySrqtUXWQ4XlZyoEFUfpJxJoN0A9HCxmHGVckzTRl 5FMWo8TCniHynNXsBtDQbabt7aNEOaAJdE7to0AH3T/Bvwzcp0ZJtBk0EM6YeMLtotUut7h2 Bkg1b//r6bTBswMBXVJ5H44Qf0+eKeUg7whSC9qpYOzzrm7+0r9F5u3qF8ZTx55TJc2g656C 9a1P1MYVysLvkLvS4H+crmxA/i08Tc1h+x9RRvqba4lSzZ6/Tmt60DPM5Sc4R0nSm9BBff0N m0bSNRS8InXdO1Aq3362QKX2NOwcL5YaStwODNyZUqF7izjK4QARAQABzTxEZW1pIE1hcmll IE9iZW5vdXIgKGxvdmVyIG9mIGNvZGluZykgPGRlbWlvYmVub3VyQGdtYWlsLmNvbT7CwXgE EwECACIFAlp+A0oCGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJELKItV//nCLBhr8Q AK/xrb4wyi71xII2hkFBpT59ObLN+32FQT7R3lbZRjVFjc6yMUjOb1H/hJVxx+yo5gsSj5LS 9AwggioUSrcUKldfA/PKKai2mzTlUDxTcF3vKx6iMXKA6AqwAw4B57ZEJoMM6egm57TV19kz PMc879NV2nc6+elaKl+/kbVeD3qvBuEwsTe2Do3HAAdrfUG/j9erwIk6gha/Hp9yZlCnPTX+ VK+xifQqt8RtMqS5R/S8z0msJMI/ajNU03kFjOpqrYziv6OZLJ5cuKb3bZU5aoaRQRDzkFIR 6aqtFLTohTo20QywXwRa39uFaOT/0YMpNyel0kdOszFOykTEGI2u+kja35g9TkH90kkBTG+a EWttIht0Hy6YFmwjcAxisSakBuHnHuMSOiyRQLu43ej2+mDWgItLZ48Mu0C3IG1seeQDjEYP tqvyZ6bGkf2Vj+L6wLoLLIhRZxQOedqArIk/Sb2SzQYuxN44IDRt+3ZcDqsPppoKcxSyd1Ny 2tpvjYJXlfKmOYLhTWs8nwlAlSHX/c/jz/ywwf7eSvGknToo1Y0VpRtoxMaKW1nvH0OeCSVJ itfRP7YbiRVc2aNqWPCSgtqHAuVraBRbAFLKh9d2rKFB3BmynTUpc1BQLJP8+D5oNyb8Ts4x Xd3iV/uD8JLGJfYZIR7oGWFLP4uZ3tkneDfYzsFNBFp+A0oBEAC9ynZI9LU+uJkMeEJeJyQ/ 8VFkCJQPQZEsIGzOTlPnwvVna0AS86n2Z+rK7R/usYs5iJCZ55/JISWd8xD57ue0eB47bcJv VqGlObI2DEG8TwaW0O0duRhDgzMEL4t1KdRAepIESBEA/iPpI4gfUbVEIEQuqdqQyO4GAe+M kD0Hy5JH/0qgFmbaSegNTdQg5iqYjRZ3ttiswalql1/iSyv1WYeC1OAs+2BLOAT2NEggSiVO txEfgewsQtCWi8H1SoirakIfo45Hz0tk/Ad9ZWh2PvOGt97Ka85o4TLJxgJJqGEnqcFUZnJJ riwoaRIS8N2C8/nEM53jb1sH0gYddMU3QxY7dYNLIUrRKQeNkF30dK7V6JRH7pleRlf+wQcN fRAIUrNlatj9TxwivQrKnC9aIFFHEy/0mAgtrQShcMRmMgVlRoOA5B8RTulRLCmkafvwuhs6 dCxN0GNAORIVVFxjx9Vn7OqYPgwiofZ6SbEl0hgPyWBQvE85klFLZLoj7p+joDY1XNQztmfA rnJ9x+YV4igjWImINAZSlmEcYtd+xy3Li/8oeYDAqrsnrOjb+WvGhCykJk4urBog2LNtcyCj kTs7F+WeXGUo0NDhbd3Z6AyFfqeF7uJ3D5hlpX2nI9no/ugPrrTVoVZAgrrnNz0iZG2DVx46 x913pVKHl5mlYQARAQABwsFfBBgBAgAJBQJafgNKAhsMAAoJELKItV//nCLBwNIP/AiIHE8b oIqReFQyaMzxq6lE4YZCZNj65B/nkDOvodSiwfwjjVVE2V3iEzxMHbgyTCGA67+Bo/d5aQGj gn0TPtsGzelyQHipaUzEyrsceUGWYoKXYyVWKEfyh0cDfnd9diAm3VeNqchtcMpoehETH8fr RHnJdBcjf112PzQSdKC6kqU0Q196c4Vp5HDOQfNiDnTf7gZSj0BraHOByy9LEDCLhQiCmr+2 E0rW4tBtDAn2HkT9uf32ZGqJCn1O+2uVfFhGu6vPE5qkqrbSE8TG+03H8ecU2q50zgHWPdHM OBvy3EhzfAh2VmOSTcRK+tSUe/u3wdLRDPwv/DTzGI36Kgky9MsDC5gpIwNbOJP2G/q1wT1o Gkw4IXfWv2ufWiXqJ+k7HEi2N1sree7Dy9KBCqb+ca1vFhYPDJfhP75I/VnzHVssZ/rYZ9+5 1yDoUABoNdJNSGUYl+Yh9Pw9pE3Kt4EFzUlFZWbE4xKL/NPno+z4J9aWemLLszcYz/u3XnbO vUSQHSrmfOzX3cV4yfmjM5lewgSstoxGyTx2M8enslgdXhPthZlDnTnOT+C+OTsh8+m5tos8 HQjaPM01MKBiAqdPgksm1wu2DrrwUi6ChRVTUBcj6+/9IJ81H2P2gJk3Ls3AVIxIffLoY34E +MYSfkEjBz0E8CLOcAw7JIwAaeBT In-Reply-To: <87se5cl45p.fsf@alyssa.is> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="------------rM9oyfjPQ5WldvVLS0AYGCGM" Message-ID-Hash: U7AP73XX45PBEDRF4LRJIW4EHXXLAQYE X-Message-ID-Hash: U7AP73XX45PBEDRF4LRJIW4EHXXLAQYE X-MailFrom: demiobenour@gmail.com X-Mailman-Rule-Hits: member-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.spectrum-os.org-0; header-match-devel.spectrum-os.org-1; header-match-devel.spectrum-os.org-2; header-match-devel.spectrum-os.org-3; header-match-devel.spectrum-os.org-4; emergency CC: Spectrum OS Development X-Mailman-Version: 3.3.10 Precedence: list List-Id: Patches and low-level development discussion Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --------------rM9oyfjPQ5WldvVLS0AYGCGM Content-Type: multipart/mixed; boundary="------------oBkONw9RXEizunLAzyUloj6x"; protected-headers="v1"; hp="clear" Message-ID: Date: Tue, 21 Jul 2026 16:11:38 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: Why is /run/vm/by-id/${VM} writable by the VMM? To: Alyssa Ross Cc: Spectrum OS Development References: <87ech71crf.fsf@alyssa.is> <0d8076ca-dd4d-42c2-9806-0f78841ae397@gmail.com> <8733xkqe22.fsf@alyssa.is> <87se5cl45p.fsf@alyssa.is> Content-Language: en-US From: Demi Marie Obenour Autocrypt: addr=demiobenour@gmail.com; keydata= xsFNBFp+A0oBEADffj6anl9/BHhUSxGTICeVl2tob7hPDdhHNgPR4C8xlYt5q49yB+l2nipd aq+4Gk6FZfqC825TKl7eRpUjMriwle4r3R0ydSIGcy4M6eb0IcxmuPYfbWpr/si88QKgyGSV Z7GeNW1UnzTdhYHuFlk8dBSmB1fzhEYEk0RcJqg4AKoq6/3/UorR+FaSuVwT7rqzGrTlscnT DlPWgRzrQ3jssesI7sZLm82E3pJSgaUoCdCOlL7MMPCJwI8JpPlBedRpe9tfVyfu3euTPLPx wcV3L/cfWPGSL4PofBtB8NUU6QwYiQ9Hzx4xOyn67zW73/G0Q2vPPRst8LBDqlxLjbtx/WLR 6h3nBc3eyuZ+q62HS1pJ5EvUT1vjyJ1ySrqtUXWQ4XlZyoEFUfpJxJoN0A9HCxmHGVckzTRl 5FMWo8TCniHynNXsBtDQbabt7aNEOaAJdE7to0AH3T/Bvwzcp0ZJtBk0EM6YeMLtotUut7h2 Bkg1b//r6bTBswMBXVJ5H44Qf0+eKeUg7whSC9qpYOzzrm7+0r9F5u3qF8ZTx55TJc2g656C 9a1P1MYVysLvkLvS4H+crmxA/i08Tc1h+x9RRvqba4lSzZ6/Tmt60DPM5Sc4R0nSm9BBff0N m0bSNRS8InXdO1Aq3362QKX2NOwcL5YaStwODNyZUqF7izjK4QARAQABzTxEZW1pIE1hcmll IE9iZW5vdXIgKGxvdmVyIG9mIGNvZGluZykgPGRlbWlvYmVub3VyQGdtYWlsLmNvbT7CwXgE EwECACIFAlp+A0oCGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJELKItV//nCLBhr8Q AK/xrb4wyi71xII2hkFBpT59ObLN+32FQT7R3lbZRjVFjc6yMUjOb1H/hJVxx+yo5gsSj5LS 9AwggioUSrcUKldfA/PKKai2mzTlUDxTcF3vKx6iMXKA6AqwAw4B57ZEJoMM6egm57TV19kz PMc879NV2nc6+elaKl+/kbVeD3qvBuEwsTe2Do3HAAdrfUG/j9erwIk6gha/Hp9yZlCnPTX+ VK+xifQqt8RtMqS5R/S8z0msJMI/ajNU03kFjOpqrYziv6OZLJ5cuKb3bZU5aoaRQRDzkFIR 6aqtFLTohTo20QywXwRa39uFaOT/0YMpNyel0kdOszFOykTEGI2u+kja35g9TkH90kkBTG+a EWttIht0Hy6YFmwjcAxisSakBuHnHuMSOiyRQLu43ej2+mDWgItLZ48Mu0C3IG1seeQDjEYP tqvyZ6bGkf2Vj+L6wLoLLIhRZxQOedqArIk/Sb2SzQYuxN44IDRt+3ZcDqsPppoKcxSyd1Ny 2tpvjYJXlfKmOYLhTWs8nwlAlSHX/c/jz/ywwf7eSvGknToo1Y0VpRtoxMaKW1nvH0OeCSVJ itfRP7YbiRVc2aNqWPCSgtqHAuVraBRbAFLKh9d2rKFB3BmynTUpc1BQLJP8+D5oNyb8Ts4x Xd3iV/uD8JLGJfYZIR7oGWFLP4uZ3tkneDfYzsFNBFp+A0oBEAC9ynZI9LU+uJkMeEJeJyQ/ 8VFkCJQPQZEsIGzOTlPnwvVna0AS86n2Z+rK7R/usYs5iJCZ55/JISWd8xD57ue0eB47bcJv VqGlObI2DEG8TwaW0O0duRhDgzMEL4t1KdRAepIESBEA/iPpI4gfUbVEIEQuqdqQyO4GAe+M kD0Hy5JH/0qgFmbaSegNTdQg5iqYjRZ3ttiswalql1/iSyv1WYeC1OAs+2BLOAT2NEggSiVO txEfgewsQtCWi8H1SoirakIfo45Hz0tk/Ad9ZWh2PvOGt97Ka85o4TLJxgJJqGEnqcFUZnJJ riwoaRIS8N2C8/nEM53jb1sH0gYddMU3QxY7dYNLIUrRKQeNkF30dK7V6JRH7pleRlf+wQcN fRAIUrNlatj9TxwivQrKnC9aIFFHEy/0mAgtrQShcMRmMgVlRoOA5B8RTulRLCmkafvwuhs6 dCxN0GNAORIVVFxjx9Vn7OqYPgwiofZ6SbEl0hgPyWBQvE85klFLZLoj7p+joDY1XNQztmfA rnJ9x+YV4igjWImINAZSlmEcYtd+xy3Li/8oeYDAqrsnrOjb+WvGhCykJk4urBog2LNtcyCj kTs7F+WeXGUo0NDhbd3Z6AyFfqeF7uJ3D5hlpX2nI9no/ugPrrTVoVZAgrrnNz0iZG2DVx46 x913pVKHl5mlYQARAQABwsFfBBgBAgAJBQJafgNKAhsMAAoJELKItV//nCLBwNIP/AiIHE8b oIqReFQyaMzxq6lE4YZCZNj65B/nkDOvodSiwfwjjVVE2V3iEzxMHbgyTCGA67+Bo/d5aQGj gn0TPtsGzelyQHipaUzEyrsceUGWYoKXYyVWKEfyh0cDfnd9diAm3VeNqchtcMpoehETH8fr RHnJdBcjf112PzQSdKC6kqU0Q196c4Vp5HDOQfNiDnTf7gZSj0BraHOByy9LEDCLhQiCmr+2 E0rW4tBtDAn2HkT9uf32ZGqJCn1O+2uVfFhGu6vPE5qkqrbSE8TG+03H8ecU2q50zgHWPdHM OBvy3EhzfAh2VmOSTcRK+tSUe/u3wdLRDPwv/DTzGI36Kgky9MsDC5gpIwNbOJP2G/q1wT1o Gkw4IXfWv2ufWiXqJ+k7HEi2N1sree7Dy9KBCqb+ca1vFhYPDJfhP75I/VnzHVssZ/rYZ9+5 1yDoUABoNdJNSGUYl+Yh9Pw9pE3Kt4EFzUlFZWbE4xKL/NPno+z4J9aWemLLszcYz/u3XnbO vUSQHSrmfOzX3cV4yfmjM5lewgSstoxGyTx2M8enslgdXhPthZlDnTnOT+C+OTsh8+m5tos8 HQjaPM01MKBiAqdPgksm1wu2DrrwUi6ChRVTUBcj6+/9IJ81H2P2gJk3Ls3AVIxIffLoY34E +MYSfkEjBz0E8CLOcAw7JIwAaeBT In-Reply-To: <87se5cl45p.fsf@alyssa.is> --------------oBkONw9RXEizunLAzyUloj6x Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 7/21/26 12:05, Alyssa Ross wrote: > Demi Marie Obenour writes: >=20 >> On 7/15/26 14:54, Alyssa Ross wrote: >>> Demi Marie Obenour writes: >>> >>>> On 7/13/26 05:04, Alyssa Ross wrote: >>>>> Demi Marie Obenour writes: >>>>> >>>>>> This seems to be a fairly significant hole in the VMM's sandbox. >>>>>> Various code operates in that directory and isn't secure against >>>>>> symlink attacks. >>>>>> >>>>>> Does the VMM really need write access to that directory? Could it= >>>>>> be given access to a subdirectory that is mounted "nosymfollow"? >>>>> >>>>> I think it's just so it can create e.g. the serial file. That coul= d >>>>> indeed be moved to a subdirectory. The ideal solution is of course= for >>>>> Cloud Hypervisor to be able to accept every file it would otherwise= >>>>> create as an open file descriptor, which I expect will happen >>>>> eventually. >>>> >>>> Should it be moved to a subdirectory for now? That would make the >>>> sandbox meaningful in practice. >>> >>> I suppose it could be. Might make more sense to dedicate efforts >>> towards fixing Cloud Hypervisor to accept file descriptors for the ~2= >>> paths it currently needs to create, though. (That's obviously more >>> work, but also more useful.) If we were to work around this in >>> Spectrum, we could keep symlinks outside the directory pointing into = it, >>> to keep paths nice and avoid churn once we can put them back in the >>> parent directory. >> >> Do you happen to know which paths these are? >=20 > I think it might just be "serial"? Not sure. How difficult would it be to modify Cloud Hypervisor so this is passed as a file descriptor? --=20 Sincerely, Demi Marie Obenour (she/her/hers) --------------oBkONw9RXEizunLAzyUloj6x-- --------------rM9oyfjPQ5WldvVLS0AYGCGM Content-Type: application/pgp-signature; name="OpenPGP_signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="OpenPGP_signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEopQtqVJW1aeuo9/sszaHOrMp8lMFAmpf0noACgkQszaHOrMp 8lMZQhAAkIsQ1kxvb1v05yTEw0zmoVkaWphHJw5uezxKpoRgTG9nldQoBsU3wnJ0 La4ErgFyZHR1MGUbA2WSEk85/komKrqQdfBzKFj9m91caXTLKAHiRPwtCVGKpdhk +fUvSMC1Ot5l/dMnVIKr4kRQcVNnw2somVjNIP6kTxGobOZuNrBg9qSlG5h8ERY9 7wXUXbWcA75Jt7q1WVrzS5qChl1Q3WLz0ARCggq1Hc0HHivKjawry8lYE6qv7PjO XBVUgWhveOlTfw42nBpYjWcwhJPWujw8bG7Mhpal0G3eYsw9OyniCe9VGSvHhlPw Vt+xo+Bpt3bOTKoA1PCw4HtSWETI2H9urC/Vn/DTiwEdBQ2nbaYOHfOJInNp1zNU rpMMzXF6k+OVnO1TMMAPEisMmkV2gBt083V0rlddsxUF6rJkQjQ4ZIGVllSgwZZp 4fsusAu3EhBpDEI/7AaYkwCLBfCoe72WZzLZkpUfd8ydWYybVtn0Mi7yv1n1hLc2 fGeHIhbYzOApH76OP2R3ixQeXBPjapj8jt3DRg8yah4mYCRCz3gyoVad0ygCWNgt dRkLE7SqRn78PTaHSI82ptrcDn7Bq7SKgXUoHwbsKZGK8NM2ilPN6PN1a9KyaqO4 47f7+u3zGrM1QSMGqtxkjZ22EqZmTMlIzaWU1oxFzFLgZ9oDcBY= =5LHX -----END PGP SIGNATURE----- --------------rM9oyfjPQ5WldvVLS0AYGCGM--