Mailing-List: contact cygwin-developers-help AT sourceware DOT cygnus DOT com; run by ezmlm
Sender: cygwin-developers-owner AT sourceware DOT cygnus DOT com
Delivered-To: mailing list cygwin-developers AT sourceware DOT cygnus DOT com
Message-ID: <372BA0F8.6D84A26D@cityweb.de>
Date: Sun, 02 May 1999 02:48:56 +0200
From: Corinna Vinschen <corinna DOT vinschen AT cityweb DOT de>
X-Mailer: Mozilla 4.51 [en] (WinNT; I)
X-Accept-Language: de,en
MIME-Version: 1.0
To: Chris Faylor <cgf AT cygnus DOT com>
CC: cygwin-developers AT sourceware DOT cygnus DOT com
Subject: Patch, Version 4: Unix-like permissions on objects [was Re: b21 -- 
 various small issues]
References: <19990420200651 DOT B16325 AT cygnus DOT com> <Pine DOT SUN DOT 3 DOT 93 DOT 990421001548 DOT 4714F-100000 AT modi DOT xraylith DOT wisc DOT edu> <19990430084531 DOT B598 AT cygnus DOT com> <3729BD53 DOT 1C8A7FE8 AT cityweb DOT de> <19990430103351 DOT B10725 AT cygnus DOT com>
Content-Type: multipart/mixed;
 boundary="------------FAB8F90A3B16C7C580462DAD"

This is a multi-part message in MIME format.
--------------FAB8F90A3B16C7C580462DAD
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Chris Faylor wrote:
> 
> On Fri, Apr 30, 1999 at 04:25:23PM +0200, Corinna Vinschen wrote:
> >Has anybody fixed the chown/new headers problem in the meantime???
> 
> The last I remember, Anders didn't see any difference between the
> old/new headers.
> 
> I would very much like to get your changes into B21, though.  I don't
> have much time for cygwin right now, though, so debugging this problem
> is not feasible for me, unfortunately.
> 
> -chris

Hi Chris,

I have rewritten my security change. The remaining problem with chown
is solved, it was a stricter security behaviour in SP4 vs SP3, and not
Anders headers, as I suspected (sorry Anders!)

The file security.cc is now very different relative to the older version
because BackupRead()/BackupWrite() is used instead of GetFileSecurity()/
SetFileSecurity().
The function chown() in syscalls.cc is exclusively implemented by calls
to get_file_attributes()/set_file_attributes() now.

Another problem is also removed in this version. The function
GetFileSecurity() crashes on FAT and Samba file systems. The use of
BackupRead() prevents this. The current version works ok, samba
refuses (correctly!) the setting of owner/group/file modes.

I have carefully integrated the change into winsup-990430, I send the
patch file as bzip2ed attachment, because it's more than 40KB.

The NT security is coupled to the new CYGWIN option [no]ntsec.
The option [no]ntea is yet legal and does still work!
So everyone can decide self, how much UNIX-like security he/she wants.

As alread written in January: Well formed /etc/passwd and /etc/group
files are essential, to get the expected results. Especially the
attachment of users to their primary group is very helpful!

Example:

	/etc/passwd:
	============
	everyone:*:0:0::/tmp:/bin/true
	system:*:18:18::/tmp:/bin/true
	administrator::500:544::/home/root:/bin/sh
	guest:*:501:546::/tmp:/bin/true
	administrators:*:544:544::/home/root:/bin/sh
	corinna::1000:547:Corinna Vinschen:/home/corinna:/bin/tcsh
	ftp::1001:545:anonymous ftp login:/home/ftp:/bin/true

	/etc/group:
	===========
	everyone::0:
	system::18:
	none::513:
	administrators::544:
	users::545:
	guests::546:
	powerusers::547:

Best Regards,
Corinna


ChangeLog:
==========

Sun May  2  2:00:00  Corinna Vinschen  <corinna DOT vinschen AT cityweb DOT de>

	* security.cc (ReadSD): New function.
	* security.cc (WriteSD): Ditto.
	* security.cc (get_admin_sid): Moved from shared.cc.
	* security.cc (set_process_privileges): Moved from syscalls.cc,
	shortened, changed return typ to int. Sets errno now.
	* security.cc (set_file_attributes): Return type changed to int.
	* security.cc (get_file_attributes): Ditto.
	* security.cc (set_nt_attributes): Ditto. Cares for setting
	of S_ISVTX now.
	* security.cc (get_nt_attributes): Ditto.
	* syscalls.cc (rel2abssd): #if 0'ed.
	* syscalls.cc (set_process_privileges): Moved to security.cc.
	* syscalls.cc (chown): Rewritten.
	* syscalls.cc (chmod): Changed call order of the functions
	set_file_attributes() and SetFileAttributesA().
	* fhandler.cc (fhandler_base::fstat): Changed check for
	return value of get_file_attributes().
	* ntea.cc (NTReadEA): returns TRUE now, if allow_ntea is unset.
	* ntea.cc (NTWriteEA): returns TRUE now, if allow_ntea is unset.
	* shared.cc (get_admin_sid): Moved to security.cc.
	* path.cc (symlink_check_one): Changed check for return value
	of get_file_attributes().

Sat Mar  6 18:30:00  Corinna Vinschen  <corinna DOT vinschen AT cityweb DOT de>

        * security.cc (get_world_sid): Rewritten.
        * security.cc (world_full_access): Deleted.
        * grp.cc: Use gid 0 as default gid.
        * grp.cc (read_etc_group): Look for account name of world group.
        * fhandler.cc (fhandler_base::open): Call `set_file_attribute'
        only in case of disk file.

Fri Feb 26 00:44:00  Corinna Vinschen  <corinna DOT vinschen AT cityweb DOT de>

        * security.cc (get_file_attribute): Patched incorrect test
        for symlink.
        * security.cc (set_file_attribute): ditto.

Sat Jan 30 02:12:00  Corinna Vinschen  <corinna DOT vinschen AT cityweb DOT de>

        * security.cc: Special handling for user and/or administrators
        permissions to write (extended) attributes.

Fri Jan 29 02:12:00  Corinna Vinschen  <corinna DOT vinschen AT cityweb DOT de>

        * security.cc: Don't allow 513(none) as user or group.

Thu Jan 28 11:00:00  Corinna Vinschen  <corinna DOT vinschen AT cityweb DOT de>

        * security.cc: new functions `set_nt_attribute()', `get_nt_attribute()'
        and `set_file_attribute()' with additional parameters `uid' and `gid',
        to support real NT security.
        * winsup.h: Prototype for `set_file_attribute()' with four
        parameters.
        * dir.cc (mkdir): Calls `set_file_attribute()' now.
        * syscalls.cc (chown): ditto.
        * syscalls.cc (chmod): ditto, with correct uid/gid.

21 Jan 12:30:00 1999  Corinna Vinschen  <corinna DOT vinschen AT cityweb DOT de>

        * shared.cc: New function `get_admin_sid()' to get a SID
        of the administrators group or of administrator.
        New functions `sec_user()' and `sec_user_nih()' to get
        SECURITY_ATTRIBUTES with all permissions for the user and
        the administtrator group.
        * shared.h: Prototypes for the above new functions `sec_user()'
        and `sec_user_nih()'.
        * sigproc.cc (getsem): Create process semaphore with
        permissions set by `sec_user()'.
--------------FAB8F90A3B16C7C580462DAD
Content-Type: application/x-bzip2;
 name="ntsec-patch.bz2"
Content-Transfer-Encoding: x-uuencode
Content-Disposition: inline;
 filename="ntsec-patch.bz2"

begin 644 ntsec-patch.bz2
M0EIH.3%!62936?2FFF, )H!_@']]]:Q[_________O____]@,O[P'O.X'T6P
M=F  ?8WO-#WO>W>+WN;<XCJLJ2HUWOL\O/@ S[W@\6[JWW?74^?&WW-4;[X^
MOH[FV%MHZIR :U=NW7.7>9[[G=*?7T*H5MPY][5ATWO=WNE[N:&7,^O>T]GW
MC>JVL>VH4ZT!J-UN,[QN]M]QWWOJ>,T>O9E?1O AT DB30 "-)A-#332GIH2;-3
M8FBCU!D::!H:!D&@T -!A*:$!!!-)HVIII!3;0U3]-4?JGM4T;32#0- #U  
M !H8@)$4*:GI,@>D>H#)B,AM30,CTT)Z@:!A,@T/4- &F@ $FDB0C2F4WI*?
MDI^FJ?BF]4RGY4\4>H>H:/4 : #0&1H>H -  (DB(F1J;TIM-"I^3%1O2GE/
M4VU390]3U/28Q)H::#31M0 P@,F1D$21 0$ C$RGH$Q&F@:%!H:/4>IZF0 T
M T#0  9TVP@,(2*"DB2("!" BP2'K/AC!)%50F.& -L0C$DLEEDC(PF)<*RP
M$H AT C92 ,9(6,6YERC()#,(6"(3 91H)(I%"LH)"A912)4I!8JPK()%@*DC;)
M*(%:);"E96J4I&,#*7++0LH6,:T;:BR/K_#/9\A\L^8_%^[)_4B AT HLZ=C.K>
ML%%!JKF$R$@0AJ$-%[*,']LS/ZVR.C&;[*<YTTT6J**#<S(H82J1")E::<=M
MKV=B+P$+->-VI1AZG^BK$XA.HA*/>BC4Y4_Q6<UYWTW?F:')S*C,-]Y5A_PH
M@*/8S5<]R]O)?*W82R&Z#2%.M\M#[5U\F.+@U<<RBB>[G?]G-;#5!8/''EU0
M2=EH;0IQ *3$461C!K**J"(BPBO*V,% 56+%')#S(!7^1DDJR?&PVD!/]J??
MV=OB^]T\T[CGVLL\R0UDIA:B'6R32LM[-4T(BAIS!H;<2&F&W<#3K":[&CIE
M8IW)N8 L.6;F(G+6!D;C@;ZXD8.F-*AR!SCSG=NA)WUG;\TRTX&\C&A5/%24
M6YAC%BB,6!ES(>*9B9--TE5I:4H=N;PV)'@]S)NZIBW9ZLU.=EW2K$54=NIE
M#]@I AT X14673O79]JFF7=GMCY+Z6HOW?BN98/1 AT WM Q I#I;0'Z()O\/R=G-A
MG!H'GVX68)$9E6)\F:VTQ AT 1DO U#/+<%30I6#IPEPIB[G:CD+5X,.WQ<\>EV
MYSF9F->ET. Q-7B[Z3H[$*RSDQ13SV%1V646*H(HB AT I$0= <&Z5#T;#SZG8&
M$GKMG3RKOGH*)K1<9MQF)@EFD#1FL*#C<9C0EV]^L^IF^5"=L7OWS'?//:<,
MV$+Y_#]K-O1>GT/6TQPPX\^O<QRFF80YR<?'M4WE,S\RD0 $\8'-$#GY2]D2
M @":8"J)WQJ)O47EDC5"R"A[X%M!@B58, $ L+09 4D0"@S'U#*GY#=Y9O5A
M-0+$<*M8L2R5JC%**I"D%6*U$&0HUA+:VR+!BPI2L62C+J AT 5()!3(62H* B2
MAK"Y6,P% =%E2"!DC$@* C% 8"$'X.S"!,>A1I"I;LY:,,I4^C-(3!!'26FS
MA*DFWT[5+H,AI+C(H555[Q*=R!8Q#9L<,8.2BXM&@K&Q"Y2I$8*<-Z;TZ'8%
M2QJ AT P64M+0VY%BHL444DQ"8.#2B*(B-F.5"QF5&5BRN)"M&#29+2F(%I;+BU
M+ MH#D,N!D2I*U+A3#*88>'R,!?>\?C$3KH,0@/- RT0E6*";_.89T-Y6.B!
M),]*H6UC+23Y1(Y[ _/G*W;]?7;$P#2&8") D(.[$ VV"DW<B=ZP4EDQLR"=
M\1'808DW-@]C AT A. OB8T--+ U]R7&&:J+S*AW/$X8 AT 8CJB5S1B%$U;.7X$G#
M CT$]LI.1R*J)Y<1:+0>$VQX 9M&8/*X&I7/ HB%F*MU4"#ERUAN'T.P):@=
M AT MR.*"B8/R:;!QZ88UK_"0-IRNQ["HBE67)"%J6$&$N4M+7HH8$Q5%B'HPI.
MI;#N+#J:.F]'\_?AYY&?HCW])+DV>NS3RK9=G+E5KQBM*E8,.$0-$(B+J)G@
MQZQX.E2I?MBD#^0WUV>HR5+VQ;S!_?[/"#\I!0DD\DL2=6$7%<_##0-ZC^S[
M.$8]$0?0N.O)1%9UT AT 6&Y*#NENWAY/%Y>V5#WSK7?U%VP=<Z>I_B0C]]PYQ$
MKWEU6V51DU67KCUA(^.R4)#VROW?9[)Q^:#L7E2%_7PN;VXZ#73Q=EGK+6).
M_2-00LKE_U3Q*>933E/FA)(2$C^"#460338IB?-CN.XOW);D"7S>FPUT*"BR
M*P0-^'T?$,R;4P M:D-A31:8%);&/&B8%[\']SNG$8G<\ON;V1ZZ-:^R[/C!
M"Z9:G\Z<3\FP9VE[CDTHF8O(NXDUYTF AT O?"EMR "E9[;#R&Y.$B)^W65^121
MB*\.'&65C:Y/+:&:$VV=)QCFPJ$OKJMZ$2%$CT>V+&3:]G-WWL04#+L18I G
MJS:Z^KY#W?-!'SU=GAAXX[FBQKP.S>!/VBW+638H9#>.,$> =PLF@)LK+0>3
MA\&^^KH&4O$OVGL-U\$3 Q(R0(S>J%Y5WDH816S5#'(GY7Z'=.1KBHR'M&R0
MJ6.!IHS25"D%02E[ICP9-(VHG^GH&3V\CIZ?S>"54VPLN,.#"%J[N/O!$LV1
M!1(ZLOK+KEG_5L[ ^/,R)NHV,T*($*:.IF^'5XJ<B*IH$OUKF4;:BBJ=.7O0
MR>!S^;F<%0I60G9F2)R"&,,T=6R6*PBJ"'%GMFRF@,C9K('%X/]&#R8[</"&
M5/C5D&D5!KAL/8;"4[89Y'EFE&H<HYO#D?3C(F1XIS/F[$LNF+LCV:UE71 =
MOF+NV"QRX]OUK8SEK=C&<PQ5O*:XT:ZM72]2^UT R&K\.XWP^T])MD"-.1=$
MQ0R+>[:=>/,*4K;OT;@3)QTSD"T+-.SKX[QLJ)KB)L<=BU7.H%>C)"I-F-5(
M%]]]^&&ZXY3/A AT E5555%6%[3W/BO<Z+_6D<>"GV,4Y$*9#,5E+)N8GMD+":D
MJHFT?-8K#7L1GJUZMQM6F#YJ1TSG HPTTN$('(3Y['37+W8<\3X'.)(9O&W%
MJG3O#(G&A:,3L&U0;,K97TT>L@]%NW+58"1SL"-8E44"R)8K(\=_)D;\9L==
M#IVX\V:S:=9\306,#)7>.,C,&;S<WF+*\H;KE#?/#8Q3+5#@7]L AT IC3IY3U 
M8H5/BBA R1XICPKTZ6-[PDH!+>XF.)CY3SWX^2MFOGU?!W?:FZW,+594+0<5
M1'P<#<KZ;^GN,*-1ILN/-GSY\\3GJPV;"HS7,WCS,I\1D.ITXS+!O4WFU,A7
MO,!MCX._EU-4=="^EFXW9>SJ_R:%- 2(?TT0%8R2T#-?XDCN/+/[<P$-55CC
MT.:9=<3,9V'GD&*&PRWR.8YM\6GDX8GO]<I3T='1T4V(96[%DC+CN.7/HI5!
MT>O#APX1$1C.#7'UY'-6[O*8$0QUD2BBEID2CYX^.K3$=]6DY<N7+G?R]IJ=
MC8\@C(Y$ZNJ3W1G,M$Y*=!*L\AKZ37 C=NAPH'$7899;[@?FF;Q&3C;1U\KQ
MW\1'+T^:]:Z].T\/+USU+&VV=G[!YB8K8%+IG3!CMHCR8S3&'L)*YN6VWST*
M7==7)(R;-3Q;J=4V,#GJJ*/E/;]>H--1NW;MW463--M.>327S9 AT TOCH-+5L&
M!YT&\5:.H9U_,\IY/GP'/K;PN0.PN5(/%V,LZZ<4LS';SC/9KUDV/Y4<X AT 2$
MD AT 2,&2,BL5 AT A=*^;9 )-NZ_CX=O='_!$-YK:^_GG?R-KF,DB:ANQQ_]]=LG/
M/=G?!$BR"@QDBJ,]GM6RJL($$\X07Y2!KCBI>N5DD(I",B+ :U=:%"V)B6VP
M-/UFT2 AT 5YA>->! 4L7"!UBD23ZNQN<%*E2%[P^N_#?B#82![& (R*,15D8R+
ML$D^Q[;"<<EH#E$21D9%#& )V33OI ?IA88HD8L""&41,0BD(V AT A^6"?200+
M( ZL #ZF&(8R!6*<DD)6$,9[W";GB=O7!_CHSWS0'?ZX=0PW44,#':,$7K AT O
MGR&9TM4'=K[:.+"63NF$?!?'9W5+020IR*"AEBV8I*81X_<@LWNWAG^OGBU/
M'S;S.5"T4SUWDE<)M'9%NJ98<>G>F+H)3&BY\Q\5=GV>B*(2]R!9CE.WU4&\
M2G5O,^F)_ AT Y683(] CB'[W78J9-:D4VZ+BR$<?03C;IA]]&4-))$@I;,.-]]
MR-HX,0L9-OXW'L*8.QXQ+KJ??.LN4.I5TD_HH'.96_&BM0I_,H167V=^_]*/
MCG:OU+'P[U,Z/.]B1J;5C\2:B8\Z:7=H0#^ER4WH>YYR1P2#+I$I(86K^_R.
MT\)7R*Q\.*]HKT_W0Y>8;S\GT6Q:I1<EI9Z6-WU6ZOM>S+XZ!+*3P[7/V>!3
M8X1"R;M/WB"E^[?65>G$5+.A<M1]US73F^E0S'DSQA=*?$K1Q(47=G$R$0U>
MPB6.4:2\AS=ZFT1YZ\^+)_&(.D1RR(OGG'/Q79V>L_;$PB#(K$%@+T94(P2,
M2))/ST AT 3Y_J?W\.]G].OIM$;:-;AH25).J!C'\2(+(BJ!$/@G]"I/)5G=8$&
M$,!(I%*9%2 %$&11W]/?T^SR>MZ.KQ&AY?9Y8-QO&&]WDY(!1<ZCR'PGP63'
MW<"S I"DWNK&SW=#7*@Z7OOGNNI(2RWRVYWJM*<T%*9HEUZA"!99,/DE 7B9
M!+!$5Q6U43SCME0B?J1&VXC$#1(6>GOG7C1 AT 7WSLU+U9$KU*Y+%T18BW627C
M3=Q^B%47XAA/8XUML,C2:U.5L,Q;5=-F2*\2($I:=]5D3S6$X;),+%P$PV![
M),67BU#)E2&."-])\3L-0MJ(]/"YP>S5JV&:FDDD$:V^GIV?*5;)I.*'>_7S
M^[#29-3&=*UW#R%U7NLWFN.[O+V91CE$::.G>_9BJI^ S]NF,TZ+HHSM+51H
MD+7C$DL%MY/5O_3R0BTD(NWR7\))IF(_)-%KRJ)AC:V)>]\\?+Y%ZX3V (!\
M<44(GXT/ZTT6(I :#HBB\ZD.;8KW1(\G%B^K5AC#-YC S$0SLPFCY$=<>FSW
M^Z3]DNK$IDJ_86GV!?>3[TY13M=JD4)71,Z>Z'\D(%(=MKF^S=NU/&_9X]BJ
M4BU*VK*>LTM:ME:UK6M6RM:UK6CYCV^C17,9$D#/R$)($DZZHQ*KKUDVY2;Q
M>M!D\U)"N\AB&8K6=HQK,AW(A)L*+L2_"X8H0+Q*GPSRXU:':%/ *<JG6:,*
M+$2E."GWY"X?./J@],LQD#4$#JK#L\#PD&&*^_L1.J6 /"6S*7%+F.Y$60A%
M_6%![%-]861PT^G7%$QQ>N <,[,D/BA4#&NO$0#B4P4ZE,,+ :F&=B%-[Y=X
MJ;XWM>BJWVMDFHIQ4O: LB2,T")S $\<.'5RX%VT^G/9PNIOB$DT0PTQLM;+
MWPE9;1X"23;#358TB0NH&)8?%^.B):$6-9JD(:2M(O/* -CX(@A$"K3D2F?*
M5#NS.#N^1?F<0UKE^BF$Q6T,P^<R7JS<UM AT 7+8T&8TQ R8;"YF-=9 AT D+#<]M
M+WHE0C0G7@&&L ;Y.&\./%2I185-'*/=BS4Q2$]W*1 AT TT2SLL6!60S&4S"7"
MCB1BQ4S!P4;]_P^_QU7N[K;)[;5[;@4IG^'KT_0D-DSI0:N]&AEI;0PC,R>3
M%(AIFRO6M5^IH.5Y_W0[6[XBIMPQ77+K,C,L]3B4JS:F*_&IIF[JFBO NYL_
M7&/$]*M62Z,[N>;QX-"(J_D4WK2E>VL"^ZKJLP=RMU6^97LP\-V^I\V=B]7;
MR]SPB4I?P1F2 AT UT:6F$I*H#6[XT7R!(,(*<'4&*/?ET-[W0SRI%#(*#V.4'X
M:/^^;\=RR=VJCJK>_X*$G?S:ZQ?C'2WLAKVY<OBI>6SF AT A3A'*J0O8.5E>Q+
MI9Q:K=<%%E<Q-\.:V$A2V8S.$8A^^)A<$_:P).R3#>"#?IQV^8H!=7'1WI^V
M2]:0U$6.LM#3Y5F"\3#=B3>=+O>&0M.UAVVP4PLQF'>HT5=J*4.=TP+HG8OB
MCS+1MVZ':7QEI)'G/1"B+TB!3(X2VH AT 3D4B4J08XP"@U AT 48T2!DR0/I-63Z$
MD_+89 AT 2C]XP$]Q2R 9:D;AG%3NGMXJ7$_B"DSBD1.+(X4Z=QH\ $)VPYRWS&
MY^/V6BRO^4.^ER-T,QF$Q8!TAH'J'X#Y0,8$0/]40H-ZYKD/V(F)F%C95M AT X
M ;#/9HX(9D\;G%>I'PJ0=D($3X_PISIV!Z?;'AKP.HUH4RG#\PZ\$7%29%_@
M'I"!)P&1U,G97#/"_$ \X&!?*,2;Y.!4.SI0?0AO$HTAR-"N8+">@!\BFH,5
M%@!@AI)"/YI^BP54I@;#MDK*#RL<YI6)".ED2,8"4;"M!D8)W$P]6N[U\3!)
M$U>#@NLV8WM:SP,S,:0IB8L <_11F8HDX6I./'0D9(;Y73"H_OW'<NYV$-&"
M;S@,/1]:\ZCP6U&P\NQSJ87"!_L".!:%!1&X2&"7%%$P:4^*R1B8$9$?^>9J
M88S?)>*HHJ%HR2!-.V$N=1S< 78S_<- !\!OO#_E.::E@= /8O(ES0,$VAI/
MV$;99I'^PQ" >(Q,RD?:!V\YP;INR" 0AT2C8 V4YC>L!X"8M@=I2%!'(*0(
M9XEQP"A8;F"!3D>.8&P9.IXT7UPB!6!\,.U #L18,^(\=?2211L6I7(, A-]
M.!V!^<!B0%_%O"BX?,.3VD":ALT*9#SC.\[H&O1R=+;;S\ \D..Q*, ]JHO\
M>?>!Q\WPR$600HZ )>'JTI+#R!W ;@.X,Q[T/B7J%/&?2GT'P]1Y8 Z!$,V!
MM/D3B</39O9M02 U$<&F6+&80>.;CQ=6DS0^$.T%*D"IVH[MH3HH!@.J YN 
MP"$8N]P*!N ?6YB&X&J\ C=0V01"E,CD:>"9$#T=J96KTI'<<"!Z'''WCFZ#
MVA>6UL&P1V'8AWV"@@L@=07&6)13$H" IS!M/A#H#8@;0L#L3HZUL"F 1=4Q
M(G:)&"D@! .QI#Q&5&H=0%HPZLR(:(%FYJ3$WU-:/;\9PV'._=DDFV,CQ,HG
MBZE.I>LZPH.NDY0[W!*>S#JLNIL](FJ9B]21H,UM1DB^<I&P5A21 AT 6@$[7J2
M)=+)DFJ8L>@,!HL0T#%I,8/N/92G8# #('$A D G4!XX^43G<0Z#S@>@3@*=
M1W)L0)SMD[A\HIKR\M8F":@G4BP^$:#4.Q+G"/J.2V))5:#U&QT2![8'DAU'
MEC!D1S$LG6Z(=A]QZ7@>,+Y$*-X.9?T0*(P?3118I"@#L =C21T,T\!/E#Y8
M2>7@> =(X$7&!<$Y>4"6/2;5?!2"D)% 4GD28(O0 DOT 0ABO AT XV%P,!+.9B Q'!
M'$!YU#,Y2*I# #6#2,./<.M3#0HE@:,=E+23E7 ^+J\3][T9 <5(^8AG!\LN
M$Z" //R,DT!*E&_P/*B&T[6$@;_Q7;<2$( G>F!]__C"X2@(&P 3UXH]0GF/
MLE/7[#B)S*9KZ#$+%C5,"[1XD.D# D3ZX(PP-^W/ 0S)'+L'X; V#<Q 02/!
M&4_9U["8<:UX/Q)]>=J4<[?9&'$\-("?CP$K,$YRN\D]TH"R9:XDD[_BI"P[
M1XR<@<IRO,!8,R<!LH3C9L&&(@C)L]8>UF$R3D'JU3B=A"'^5>@$Q/90>9C9
M: >[ 1-3?\R&Q1L_2W'E( MM@:F8?8=X/<=O6];[N@((CZ!T>BP 6Y5GZUY4
M<;!@ +,NRRQV9QG]A$58"XA58+%[@50: 7,"XP-*TJ@)S$4P.O9WW?L1=@8L
M$Q(GN^6X<Z& ?(!Y6FY3'+?':V:"-,*IIR'"0SARM,(:SA H 517. %LL<ZV
M4 PB2X'#0$[BR"^QS4TVVV[Z&O(-0PAUS9->J->-BM5,R.."89A TP9C#=E 
M4>'SKW%JE ]K64L?.&.1E</H+@48D)+L#"@&OFUH3UM!06(AB&:1R')-0V!P
M:@0YW/75Y3*')-DY%"B'81(=QPHAIL815D#F&HE5PT+@5.C#D&SL&H9"$BK6
MY>WWL;0-*T(T:'""$\30Q ,\PP(8QMI% LDQPSYG+'$0VW52BJ@?E\P AT I+C 
MORFM(!^RAK@[],!'Z, K=H6=R0+AG1>HTT$II1;UDAH.ST0V<W$O4+D1$IQR
MD$.<X('R:AH 3$-$-U.U*VWBM]4/X 8$ ,RW)0M5)6:Z+$W6DDI#>9!=,7,Q
MY!\8 =9S5B,7YY8!VIR0$VYMZFX AT IIQ%O!@)N(,4Y0E$:RE@@6R9)$A>%$52
MU]/JM($8<0UL]@%W"=$ZCJ;1> OANSSHB2E"1!2QF"\[#T #+E2JHE'^K"! 
MHAK05!L51)3]TO-T+D7G1>]XQL6 2YD!0;&7IVH<(?4G&LF*^FPX!/C2CT/F
M9]:.&TW:2R-2)E",2[RQ\Y'C+1Q39L#OT (OR AT 0D(QA%& 17M;&)$,C2#\8I
MYH03=YKI1:%4JG8Y%BR!F;</:LAT.[=,\Q<V_>8B](FTU#W(Y!@W(><$V.K 
MB[3."XH:<[R9H'%_,.+(X?2BD<$&U)T1&@A<E,A AT 1]6F0^TZ7:<37-Y+'YIY
M$]!@;B$AI)_R-!UFX6-%_(;A=L,@^#K-XPOW7&3T\4#H\>,A@>SQ<AON8&-)
M03@"XT<P*D7)80"=0(< ,8NV-!BA5#Y)@A9-5.TQO@=)%"A8/J,A-?8C(D#<
M34+FF6 AT J;0 _41A%+K *-TH2*F1*&)EMB0C)%(A " [VS$SUGTIDD&0 V$8,
M)J<MN)$<S\G%-TR1+G"B1C!1_)DA6 6U B'&RM9D AT 8#( T]DLB,Y^KO=(I"F
M!V5 RV+#4$3?@H_&IRF[A?@?-W%I-$4Q5NDP\K#LDRD.6;?F,T;(W1NO+6XG
MW&*CCT=DX4YX7*GL3I/$[#9KEEQ DOT  AT 2SLBISLI&+%>5;HR2QP1B%!2# W.B0?
M0O/-FXWM[(2PF&D6 HJ,B03,I1Q(B4D%T+T.IA343'2%+" 8%Q2"4!N7[^XI
MZX-MB'D1[SH>9C#8=AH0>D\#1PR\(B$'NAQ-Z.?(FK9V:B800!<@$$B4 AT Y\:
M1J,O#9*''0.-ZFKR*A"=+ -#<);(?3^,_V+.V%R>A.Q*2,"AC_%!*K;4$"5-
ML$M\0W'_^B"6'8HH<%*[AIUBZ4L$\YY AT H"Y=<1..)0Q2 0&Y>Q4CE!JM!1)&
MK>V7RPSN%&+IV$&I5K>OWTIH.5*PX<%?\%=9"YI)IE2&RQH5?ZB(QJL J6LR
MFP^Q%2Z-40TZ4G-=588,<"*_360OQA#NP5+G/=TT0Y#5>2*!12["HZ5.!)5J
M--HEW2>B:S+6B*B.K=70RXW,F&!8%9!TR03G,$LLVX02F1G08(U5-&"[0,T#
MT2D?F1: :63)T5?9M-J,:E0H7@!!D9B_!N8IY6BG>!@9;'0+N#@*41PI=JE!
MHNZG$W0T*>9;JQ=\#U4BC8-L0#.A0.!FXBD$N\BA!HH%-E_YT>:40F2%OADY
MKR;7AW\9">EL:4I -5ADQ@[AP8UJRL%I['-07D"&B8#G.AQS31T?B8>!/7"<
M7'3(W[L"'9VB4/+HH!IFL&:T:%D%02:"B%B9D\&) S1_Z>H1RUDE:P[^? /)
MN$*8T4<0,#0:=#+/K#>NKFZ;T_A;AH33*(T8I088W+A0#O AT PFS5-NS$0V:@V
M3M]VSD 3J"82@+XJX !Y ";MWIX()"O1<<@-8Q:2]*')M&PQSF%X7?#KOC?"
M]@LY@(">9=@0 AT 00N9_"*M /0F1"B#(1#[D.\(P$6(JJBLF@-#(@"HQ8BC%& 
MJH"L"<P_!.O=L $V8D.8!+TJ)U9N3A*7)3!2ZC93A].!B:Q2/R*,8G7H?F(0
MAN$B!WK!&"005&6 AT 2QDC&0BGOPB=Q3,$8DW::NPE@&Q@<(#&I6#&$U\?RS<"
M\C4 AT AO&!T#O9MD[GY AT 4HL&5I9\(R'B4:H<S7%L8<@T*1AOW5Z_HE514??8L9
M/#^VNJX:H/%Q!:#4-ZE1 P.C?7OG[MJ2$15GW5MFWR9]@D8:^G9B2=3ND\6?
M .Q/Y4#6!+*Q^PR O\\VD#2[S(I"J3#45D$S!(YL9)X#1==9J0:A$"\- %9P
MK'$UHP0!N<>*B7';3G:KDH$A([K(W<\56G,JF(9+5?(1:M<R.\#7"*IW(%(&
M*#8IRS"N?;X4HI&-MBT1KMA66:ZZP6M1U%A(BJ<!P2%+,K'M+)PNI3K#4MFF
M#X%5M<4?6? >H AT HEH,0H[Z]=%C3Z4[Z:%8T2HEB>CKOE,)$YT]R_'<.B&[P-
MPX<4,D1WD AT 3HA#<I2A[6 F+B$K'&E>'!TZNVR-SR9OI AT 5(,C%5%#XT*(+$#T
M640(JB(Q%%](S<!Q$44RA;0K%*PTM(\C S+O8>,>XD2PH2-'NGN^HUJY9J&1
MB")#Y0>:0) BD" 1BQ)%& 01[06)L\ ]8:'C2;H%I+/O+X*_@(@X+[:< ,:C
MMT ,EUCIU3L<MSB4X0S"[13/N"S!=&/!C5L,GLGMZK*&?JDDAX.\4G1'IL86
MJ>> 6(=$O ZC>$38;Y?AL&U2!"$(F&LB(=KA,4?'U<":$Y(PD@$@;)93&N9U
M*F AT T^NX4!N*^(O5Y AT X6=8H6%X71LH&L%#.*EP0D]A\'*'VCO#VJB,5011((Q
M AT 1A(;T:H@+LV&X;"<[GN"UB=RWJ]<EWI /#>Q\9::DC) V=P%@=&2*%',"FD
M*B6A9J 0 C.#Z AU8A-!'YPX*D&$3PQ<I:" U V:4-- AT 7I)@8OUM:,L&=J=]
MNM(B)8"-,I@%. \/<ZH&!N7<E[.@-AI5+JZ"1AI(+")YV(P AT A$8/O]?(H>$-
MW$#9\W/!3! M]%"^\WA2<ZO ,P#>'8X<V+"\-2V"EP" UTEP/J"6(:'6E&E\
MU$.D^VA\8F0Y; >P.!4$$N&@UV3O AT YZ8$8'(P9](4T%XQ&"1B#GR->^HRZAR
M28!@P+H!>"64LJ8%[C(A<B5 N_I:W+2ZF%5D16KM7,.?Q&63DPB,@C,4B(6L
MAQE AT H;H4N9" X<!7FYT>><-WOHJ6D0\I8M+%JHYENYIR[Y0! W0(!5>4J]N9
M2C 0+\0$U:\*=&<@(4IQG$AQDA"26R0#.!IJ)2&PK@"7W& 8(TE)#%*<]H ]
MTK;&O_0U0.%_=&T^?U*SU4C[.EW5A-,2C?-4L AT V$#F"Y2&4$*(EB@<&@=H8G
M&G4/PT9F")!$S#.Q=R@&!E4XEC"8E!$U3NZX05-T.\+$]8DAF#1$5$Y/I?2W
MLWX=!D!@_K0(4JSO1,3<(\$>(8 ?+X?M_I@'%7C[C<>/<LA3!&HIDKO$;IO"
M=PUIB,A(R,(13ADF0.8"\W,KJI^L8AAL^,Z<PR1HI"$@R+"%(T(<V)U%AW0R
MO?; ](+HF&+]!X!Q =4Z%)PG:*<N_B;]R;DNI=4>@XN AT F:[4 T4MRFTWTG/W
M.RU';$^52!?WY873N(C]\$]<%R8!":Q4WD4,GCY-YL_IHJ2+YSC4L;;!>X!P
M[P3N['\4($R;GG.EOLR.$[CD=+YAM1>,!O%3YRFEAWI I7Y6]MB=Z5&&66Q(
M49W>20#1,ODI]HXJWO/,>"&AF?C3+NO.0JI,I4 AT L9#&%!"Y(T5: )9H$N48T
M+!"MH402EI+&@+,$*K"*2ZL*"0*JJJ )Z9#6:9:R66A*D23Q AT C%+&+>R:U+A
MP&!2']L0L3%A".@R($5MR[DG,1 AT H$' #GO%14@.\7M"7FL*5JSO2N_S\OK?-
MCKB:CP=%F1,T'<F,F;[=6#Z(AC[2FJV\W(<LO<@4%FBYDHY5"MI.QP-VI%5.
MX\2 /213U'KL>I1.;#S*!W=ZGS?K 08D9$/-I)!"$6$4= 7WC%@ED Q6ZB18
MLD" LC!@SL$&JP7!C&06+SITIU*9A'2>P&N0(21 AT 2#(,C(R1 TZ72(/UT8 AT 9
M(0C"$<$LYSA"29AHC0/+Y'MB]Q$[^R2U,E,HN,^ Q#)W9(PR=D"0[)N)M AT T/
M=_Y4A;F+&Y-$;.Z+*8==LTD)-:D:B"$4IO:2M'$98. (U-PR-#AEQO6HE\*E
MAS2HW(RWYP*SL)_ <RF,XAZK0&?.&ZFL3%:3!"Q%-CZT(&WN?D*^V4#A4O/I
M]I:%U AT 5D%IV/2\HAS&U0-> >J'1!2=D9V6F-'M75"C+3173%ZL7!C AT WJ5FV*
M;YKW2P:KR<>%$%-N AT V@QT*S9NY[40!^R;-X<S::4??@A" $@)2V$RP9"(&QA
MDP*_=NB ENU AT DG29@  [##Q(.2DY_+<D!'S(LEAS_<\A0^W]O>,$Z%A5C$=^
M*Y%&",7..,T\UF^DR%C2)-0R%/.AU][W)#T&W?G[%C*%J**"/;H+'8FD@,Z*
M-<;S '1TVW.*]KR^I3RJ8BJB$JF!BU F!T+8.@/6!XJBEC6QL1*6>M[\ OO&
MCX.<^RW,$C">^@J$O6S-XC8PVZO*H>4*$HW$%1:)@XJP&?6_09 F3?&"/::[
M@+W97X$F<+0PEE]/TVRXGJH,D&JOMHS+UBUB(FCGRM4([+M0TP7( @1BA0BD
M#W938?7\NT&MXHP2)H<<(G)0980I:('K!PT9AV[NM DOT  AT G")S*!D(AS$(:)-T"
M:%@&!* A:<V 2H((112$I-T-'Z,T2;)-&Z3N@!0$#+6&JC !9&F!"&(,*Y,>
M*.\HQSP;BT(&8O6"8)XX(O# V>XRD*",%*6:(.)C"CZM"8+,8^U#;L-OE AT W-
M.$SRD<.6 AT OD41R4=)#32H&WNBG$"1&,BZJ!@.B8FZY<HC14*5W@$+"J7%H"$
MT'.+1N!O0WNCLO$1/M6,=<;HB;"&**VW-X!(SKOT*=:'TIJ[">H9:?#L7E!.
M W]'OO<@,D(,D0 AT P@D=L TB+TG-[S]4/4'3Y(GL@;>72W<V)UXJY;:9= 3!-
M!@H0_B&MJ']IB(!WG = =9!'4H0I5BQB=(H\2"GE=9=W$USB"!PSFA!YY,JO
M?W[&)A=DD"$]X#F!3HB AT ZCZ$A8W']ZGE]!:(FA4AC:$:O&(4*Q3A9*4PYE.0
M.\N)25.Z+$>-6( 70*:,=H6*#NW%IZX/)G4*X%8%F/J4@>)KPV: _$DDC"#(
MI$Q,]#UQ+,FW*@88HTJ!M!5O#"RAW+)82)!B8T"SV+Q,GRQ(]O<%'F+4#A"B
M$G;A8J7RP,O!K'$QL,O"D7S/<UX AT N4_=$8PT+@F038":F&\4'GR/HKZOM2J?
MPL)>1+V$+17PH3Q!C)&ZE3%($ B=JR_X4 AT 9H A" <N=590XR6P>2E(;0.9PP
>7<-J&J))S<!#;(4B%.7]')P#_\7<D4X4)#TIIIC 
end


--------------FAB8F90A3B16C7C580462DAD--