>Synopsis: cronjob /etc/daily false positive on umask inside conditional
>Category: misc
>Environment:
System : OpenBSD 7.0
Details : OpenBSD 7.0 (GENERIC) #224: Thu Sep 30 14:13:34 MDT 2021
[email protected]:/usr/src/sys/arch/amd64/compile/GENERIC
Architecture: OpenBSD.amd64
Machine : amd64
>Description:
Daily cronjob "/bin/sh /etc/daily" results in false positive security
notification, if root owned script (in this case, /etc/profile) has
umask considered unsafe, even if the conditions for umask execution
will not be fulfilled if the script is ran by root.
The umask detection will not happen unless preceded by beginning
of line and whitespace(s).
>How-To-Repeat:
Create a file that will be checked by the daily script.
--begin: /etc/profile --
if [ "$(id -u)" -ge 1000 ] && [ "$(id -gn)" = "$(id -un)" ]; then
umask 007
else
umask 022
fi
--end: /etc/profile --
As you run "/bin/sh /etc/daily", resulting error mail will contain
this:
--begin report mail--
Running security(8):
Checking root sh paths, umask values:
/etc/profile /root/.profile
Root umask is group writable
--end report mail--
>Fix:
Preventing the false positive from being detected by having some null
function on the same line as "umask 007" is in, or writing the
conditional
on single line.
-- dirty workaround 1 --
if [ "$(id -u)" -ge 1000 ] && [ "$(id -gn)" = "$(id -un)" ]; then umask 007
else umask 022
fi
-- /dirty workaround 1 --
-- dirty workaround 1 --
if [ "$(id -u)" -ge 1000 ] && [ "$(id -gn)" = "$(id -un)" ]; then
true && umask 007
else
umask 022
fi
-- /dirty workaround 1 --
dmesg:
OpenBSD 7.0 (GENERIC) #224: Thu Sep 30 14:13:34 MDT 2021
[email protected]:/usr/src/sys/arch/amd64/compile/GENERIC
real mem = 1056833536 (1007MB)
avail mem = 1008934912 (962MB)
random: good seed from bootblocks
mpath0 at root
scsibus0 at mpath0: 256 targets
mainbus0 at root
bios0 at mainbus0: SMBIOS rev. 2.8 @ 0xf61e0 (9 entries)
bios0: vendor SeaBIOS version "1.11.0-2.el7" date 04/01/2014
bios0: Red Hat KVM
acpi0 at bios0: ACPI 1.0
acpi0: sleep states S5
acpi0: tables DSDT FACP APIC
acpi0: wakeup devices
acpitimer0 at acpi0: 3579545 Hz, 24 bits
acpimadt0 at acpi0 addr 0xfee00000: PC-AT compat
cpu0 at mainbus0: apid 0 (boot processor)
cpu0: Intel(R) Xeon(R) Gold 6126 CPU @ 2.60GHz, 220.50 MHz, 06-55-04
cpu0:
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,MMX,FXSR,SSE,SSE2,SS,SSE3,PCLMUL,VMX,SSSE3,FMA3,CX16,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,HV,NXE,PAGE1GB,RDTSCP,LONG,LAHF,ABM,3DNOWP,PERF,FSGSBASE,TSC_ADJUST,BMI1,HLE,AVX2,SMEP,BMI2,ERMS,INVPCID,RTM,MPX,AVX512F,AVX512DQ,RDSEED,ADX,SMAP,CLFLUSHOPT,CLWB,AVX512CD,AVX512BW,AVX512VL,PKU,MD_CLEAR,IBRS,IBPB,STIBP,SSBD,ARAT,XSAVEOPT,XSAVEC,XGETBV1,MELTDOWN
cpu0: 64KB 64b/line 2-way I-cache, 64KB 64b/line 2-way D-cache, 512KB 64b/line
16-way L2 cache
cpu0: ITLB 255 4KB entries direct-mapped, 255 4MB entries direct-mapped
cpu0: DTLB 255 4KB entries direct-mapped, 255 4MB entries direct-mapped
cpu0: smt 0, core 0, package 0
mtrr: Pentium Pro MTRR support, 8 var ranges, 88 fixed ranges
cpu0: apic clock running at 999MHz
ioapic0 at mainbus0: apid 0 pa 0xfec00000, version 11, 24 pins
acpiprt0 at acpi0: bus 0 (PCI0)
"ACPI0006" at acpi0 not configured
acpipci0 at acpi0 PCI0
acpicmos0 at acpi0
"PNP0A06" at acpi0 not configured
"PNP0A06" at acpi0 not configured
"PNP0A06" at acpi0 not configured
"QEMU0002" at acpi0 not configured
"ACPI0010" at acpi0 not configured
acpicpu0 at acpi0: C1(@1 halt!)
cpu0: using VERW MDS workaround
pvbus0 at mainbus0: KVM
pvclock0 at pvbus0
pci0 at mainbus0 bus 0
pchb0 at pci0 dev 0 function 0 "Intel 82441FX" rev 0x02
pcib0 at pci0 dev 1 function 0 "Intel 82371SB ISA" rev 0x00
pciide0 at pci0 dev 1 function 1 "Intel 82371SB IDE" rev 0x00: DMA, channel 0
wired to compatibility, channel 1 wired to compatibility
wd0 at pciide0 channel 0 drive 0: <QEMU HARDDISK>
wd0: 16-sector PIO, LBA48, 10240MB, 20971520 sectors
atapiscsi0 at pciide0 channel 0 drive 1
scsibus1 at atapiscsi0: 2 targets
cd0 at scsibus1 targ 0 lun 0: <QEMU, QEMU DVD-ROM, 2.5+> removable
wd0(pciide0:0:0): using PIO mode 4, DMA mode 2
cd0(pciide0:0:1): using PIO mode 4, DMA mode 2
pciide0: channel 1 disabled (no drives)
piixpm0 at pci0 dev 1 function 3 "Intel 82371AB Power" rev 0x03: apic 0 int 9
iic0 at piixpm0
virtio0 at pci0 dev 2 function 0 "Qumranet Virtio Network" rev 0x00
vio0 at virtio0: address 52:54:00:74:59:7b
virtio0: msix shared
virtio1 at pci0 dev 3 function 0 "Qumranet Virtio Memory Balloon" rev 0x00
viomb0 at virtio1
virtio1: apic 0 int 11
isa0 at pcib0
isadma0 at isa0
fdc0 at isa0 port 0x3f0/6 irq 6 drq 2
com0 at isa0 port 0x3f8/8 irq 4: ns16550a, 16 byte fifo
com0: console
pckbc0 at isa0 port 0x60/5 irq 1 irq 12
pckbd0 at pckbc0 (kbd slot)
wskbd0 at pckbd0 mux 1
pms0 at pckbc0 (aux slot)
wsmouse0 at pms0 mux 0
pcppi0 at isa0 port 0x61
spkr0 at pcppi0
vmm0 at mainbus0: VMX/EPT (using slow L1TF mitigation)
dt: 445 probes
vscsi0 at root
scsibus2 at vscsi0: 256 targets
softraid0 at root
scsibus3 at softraid0: 256 targets
root on wd0a (d62fc98416a8724c.a) swap on wd0b dump on wd0b
fd0 at fdc0 drive 1: density unknown
usbdevs:
usbdevs: no USB controllers found
pcidump:
Domain /dev/pci0:
0:0:0: Intel 82441FX
0x0000: Vendor ID: 8086, Product ID: 1237
0x0004: Command: 0103, Status: 0000
0x0008: Class: 06 Bridge, Subclass: 00 Host,
Interface: 00, Revision: 02
0x000c: BIST: 00, Header Type: 00, Latency Timer: 00,
Cache Line Size: 00
0x0010: BAR empty (00000000)
0x0014: BAR empty (00000000)
0x0018: BAR empty (00000000)
0x001c: BAR empty (00000000)
0x0020: BAR empty (00000000)
0x0024: BAR empty (00000000)
0x0028: Cardbus CIS: 00000000
0x002c: Subsystem Vendor ID: 1af4 Product ID: 1100
0x0030: Expansion ROM Base Address: 00000000
0x0038: 00000000
0x003c: Interrupt Pin: 00 Line: 00 Min Gnt: 00 Max Lat: 00
0x0000: 12378086 00000103 06000002 00000000
0x0010: 00000000 00000000 00000000 00000000
0x0020: 00000000 00000000 00000000 11001af4
0x0030: 00000000 00000000 00000000 00000000
0x0040: 00000000 00000000 00000000 00000000
0x0050: 00000000 80000000 11111000 33111111
0x0060: 00000000 00000000 00000000 00000000
0x0070: 00020000 00000000 00000000 00000000
0x0080: 00000000 00000000 00000000 00000000
0x0090: 00000000 00000000 00000000 00000000
0x00a0: 00000000 00000000 00000000 00000000
0x00b0: 00000000 00000000 00000000 00000000
0x00c0: 00000000 00000000 00000000 00000000
0x00d0: 00000000 00000000 00000000 00000000
0x00e0: 00000000 00000000 00000000 00000000
0x00f0: 00000000 00000000 00000000 00000000
0:1:0: Intel 82371SB ISA
0x0000: Vendor ID: 8086, Product ID: 7000
0x0004: Command: 0103, Status: 0200
0x0008: Class: 06 Bridge, Subclass: 01 ISA,
Interface: 00, Revision: 00
0x000c: BIST: 00, Header Type: 80, Latency Timer: 00,
Cache Line Size: 00
0x0010: BAR empty (00000000)
0x0014: BAR empty (00000000)
0x0018: BAR empty (00000000)
0x001c: BAR empty (00000000)
0x0020: BAR empty (00000000)
0x0024: BAR empty (00000000)
0x0028: Cardbus CIS: 00000000
0x002c: Subsystem Vendor ID: 1af4 Product ID: 1100
0x0030: Expansion ROM Base Address: 00000000
0x0038: 00000000
0x003c: Interrupt Pin: 00 Line: 00 Min Gnt: 00 Max Lat: 00
0x0000: 70008086 02000103 06010000 00800000
0x0010: 00000000 00000000 00000000 00000000
0x0020: 00000000 00000000 00000000 11001af4
0x0030: 00000000 00000000 00000000 00000000
0x0040: 00000000 00000000 00000000 0003004d
0x0050: 00000000 00000000 00000000 00000000
0x0060: 0b0b0a0a 00000000 00000200 00000000
0x0070: 00000080 0c0c0000 00000002 00000000
0x0080: 00000000 00000000 00000000 00000000
0x0090: 00000000 00000000 00000000 00000000
0x00a0: 00000008 00000000 0000000f 00000000
0x00b0: 00000000 00000000 00000000 00000000
0x00c0: 00000000 00000000 00000000 00000000
0x00d0: 00000000 00000000 00000000 00000000
0x00e0: 00000000 00000000 00000000 00000000
0x00f0: 00000000 00000000 00000000 00000000
0:1:1: Intel 82371SB IDE
0x0000: Vendor ID: 8086, Product ID: 7010
0x0004: Command: 0107, Status: 0280
0x0008: Class: 01 Mass Storage, Subclass: 01 IDE,
Interface: 80, Revision: 00
0x000c: BIST: 00, Header Type: 00, Latency Timer: 00,
Cache Line Size: 00
0x0010: BAR empty (00000000)
0x0014: BAR empty (00000000)
0x0018: BAR empty (00000000)
0x001c: BAR empty (00000000)
0x0020: BAR io addr: 0x0000c040/0x0010
0x0024: BAR empty (00000000)
0x0028: Cardbus CIS: 00000000
0x002c: Subsystem Vendor ID: 1af4 Product ID: 1100
0x0030: Expansion ROM Base Address: 00000000
0x0038: 00000000
0x003c: Interrupt Pin: 00 Line: 00 Min Gnt: 00 Max Lat: 00
0x0000: 70108086 02800107 01018000 00000000
0x0010: 00000000 00000000 00000000 00000000
0x0020: 0000c041 00000000 00000000 11001af4
0x0030: 00000000 00000000 00000000 00000000
0x0040: 0000e377 0000000b 00000000 00000000
0x0050: 00000000 00000000 00000000 00000000
0x0060: 00000000 00000000 00000000 00000000
0x0070: 00000000 00000000 00000000 00000000
0x0080: 00000000 00000000 00000000 00000000
0x0090: 00000000 00000000 00000000 00000000
0x00a0: 00000000 00000000 00000000 00000000
0x00b0: 00000000 00000000 00000000 00000000
0x00c0: 00000000 00000000 00000000 00000000
0x00d0: 00000000 00000000 00000000 00000000
0x00e0: 00000000 00000000 00000000 00000000
0x00f0: 00000000 00000000 00000000 00000000
0:1:3: Intel 82371AB Power
0x0000: Vendor ID: 8086, Product ID: 7113
0x0004: Command: 0103, Status: 0280
0x0008: Class: 06 Bridge, Subclass: 80 Miscellaneous,
Interface: 00, Revision: 03
0x000c: BIST: 00, Header Type: 00, Latency Timer: 00,
Cache Line Size: 00
0x0010: BAR empty (00000000)
0x0014: BAR empty (00000000)
0x0018: BAR empty (00000000)
0x001c: BAR empty (00000000)
0x0020: BAR empty (00000000)
0x0024: BAR empty (00000000)
0x0028: Cardbus CIS: 00000000
0x002c: Subsystem Vendor ID: 1af4 Product ID: 1100
0x0030: Expansion ROM Base Address: 00000000
0x0038: 00000000
0x003c: Interrupt Pin: 01 Line: 09 Min Gnt: 00 Max Lat: 00
0x0000: 71138086 02800103 06800003 00000000
0x0010: 00000000 00000000 00000000 00000000
0x0020: 00000000 00000000 00000000 11001af4
0x0030: 00000000 00000000 00000000 00000109
0x0040: 00000601 00000000 00000000 00000000
0x0050: 00000000 00000000 00000000 10000000
0x0060: 60000000 08000000 00000000 00000000
0x0070: 00000000 00000000 00000000 00000000
0x0080: 00000001 00000000 00000000 00000000
0x0090: 00000701 00000000 00000000 00000000
0x00a0: 00000000 00000000 00000000 00000000
0x00b0: 00000000 00000000 00000000 00000000
0x00c0: 00000000 00000000 00000000 00000000
0x00d0: 00090000 00000000 00000000 00000000
0x00e0: 00000000 00000000 00000000 00000000
0x00f0: 00000000 00000000 00000000 00000000
0:2:0: Qumranet Virtio Network
0x0000: Vendor ID: 1af4, Product ID: 1000
0x0004: Command: 0107, Status: 0010
0x0008: Class: 02 Network, Subclass: 00 Ethernet,
Interface: 00, Revision: 00
0x000c: BIST: 00, Header Type: 00, Latency Timer: 00,
Cache Line Size: 00
0x0010: BAR io addr: 0x0000c000/0x0020
0x0014: BAR mem 32bit addr: 0xfebc0000/0x00001000
0x0018: BAR empty (00000000)
0x001c: BAR empty (00000000)
0x0020: BAR mem prefetchable 64bit addr: 0x00000000febf8000/0x00004000
0x0028: Cardbus CIS: 00000000
0x002c: Subsystem Vendor ID: 1af4 Product ID: 0001
0x0030: Expansion ROM Base Address: feb80000
0x0038: 00000000
0x003c: Interrupt Pin: 01 Line: 0a Min Gnt: 00 Max Lat: 00
0x0098: Capability 0x11: Extended Message Signalled Interrupts (MSI-X)
Enabled: yes; table size 3 (BAR 1:0)
0x0084: Capability 0x09: Vendor Specific
0x0070: Capability 0x09: Vendor Specific
0x0060: Capability 0x09: Vendor Specific
0x0050: Capability 0x09: Vendor Specific
0x0040: Capability 0x09: Vendor Specific
0x0000: 10001af4 00100107 02000000 00000000
0x0010: 0000c001 febc0000 00000000 00000000
0x0020: febf800c 00000000 00000000 00011af4
0x0030: feb80000 00000098 00000000 0000010a
0x0040: 01100009 00000004 00000000 00001000
0x0050: 03104009 00000004 00001000 00001000
0x0060: 04105009 00000004 00002000 00001000
0x0070: 02146009 00000004 00003000 00001000
0x0080: 00000004 05147009 00000000 00000000
0x0090: 00000000 00000000 80028411 00000001
0x00a0: 00000801 00000000 00000000 00000000
0x00b0: 00000000 00000000 00000000 00000000
0x00c0: 00000000 00000000 00000000 00000000
0x00d0: 00000000 00000000 00000000 00000000
0x00e0: 00000000 00000000 00000000 00000000
0x00f0: 00000000 00000000 00000000 00000000
0:3:0: Qumranet Virtio Memory Balloon
0x0000: Vendor ID: 1af4, Product ID: 1002
0x0004: Command: 0107, Status: 0010
0x0008: Class: 00 Prehistoric, Subclass: ff (unknown),
Interface: 00, Revision: 00
0x000c: BIST: 00, Header Type: 00, Latency Timer: 00,
Cache Line Size: 00
0x0010: BAR io addr: 0x0000c020/0x0020
0x0014: BAR empty (00000000)
0x0018: BAR empty (00000000)
0x001c: BAR empty (00000000)
0x0020: BAR mem prefetchable 64bit addr: 0x00000000febfc000/0x00004000
0x0028: Cardbus CIS: 00000000
0x002c: Subsystem Vendor ID: 1af4 Product ID: 0005
0x0030: Expansion ROM Base Address: 00000000
0x0038: 00000000
0x003c: Interrupt Pin: 01 Line: 0b Min Gnt: 00 Max Lat: 00
0x0084: Capability 0x09: Vendor Specific
0x0070: Capability 0x09: Vendor Specific
0x0060: Capability 0x09: Vendor Specific
0x0050: Capability 0x09: Vendor Specific
0x0040: Capability 0x09: Vendor Specific
0x0000: 10021af4 00100107 00ff0000 00000000
0x0010: 0000c021 00000000 00000000 00000000
0x0020: febfc00c 00000000 00000000 00051af4
0x0030: 00000000 00000084 00000000 0000010b
0x0040: 01100009 00000004 00000000 00001000
0x0050: 03104009 00000004 00001000 00001000
0x0060: 04105009 00000004 00002000 00001000
0x0070: 02146009 00000004 00003000 00001000
0x0080: 00000004 05147009 00000000 00000000
0x0090: 00000000 00000000 00000000 00000000
0x00a0: 00000000 00000000 00000000 00000000
0x00b0: 00000000 00000000 00000000 00000000
0x00c0: 00000000 00000000 00000000 00000000
0x00d0: 00000000 00000000 00000000 00000000
0x00e0: 00000000 00000000 00000000 00000000
0x00f0: 00000000 00000000 00000000 00000000
acpidump:
begin-base64 644 APIC.3
QVBJQ3gAAAAB7UJPQ0hTIEJYUENBUElDAQAAAEJYUEMBAAAAAADg/gEAAAAACAAAAQAAAAEMAAAA
AMD+AAAAAAIKAAACAAAAAAACCgAFBQAAAA0AAgoACQkAAAANAAIKAAoKAAAADQACCgALCwAAAA0A
BAb/AAAB
====
begin-base64 644 DSDT.2
RFNEVNcTAAAB7kJPQ0hTIEJYUENEU0RUAQAAAEJYUEMBAAAAEEkEXABbgERCR18BCwIEAVuBC0RC
R18BREJHQggULERCVUcBmGhglmBgdIdgAWFwAGKiEJViYXCDiGBiAERCR0J1YnAKCkRCR0IQIl9T
Ql9bghtQQ0kwCF9ISUQMQdAKAwhfQURSAAhfVUlEARBNCF9TQl9bgkUISFBFVAhfSElEDEHQAQMI
X1VJRABbgEhQVE0ADAAA0P4LAARbgRBIUFRNE1ZFTkQgUFJEXyAUNl9TVEEAcFZFTkRgcFBSRF9h
emAKEGCgDJGTYACTYAv//6QAoA6Rk2EAlGEMAOH1BaQApAoPCF9DUlMREQoOhgkAAAAA0P4ABAAA
eQAQJS5fU0JfUENJMFuCGVBYMTMIX0FEUgwDAAEAW4BQMTNDAgAK/xBABS5fU0JfUENJMFuCQwRJ
U0FfCF9BRFIMAAABAFuAUDQwQwIKYAoEW4EmXi5QWDEzUDEzQwAASC8AB0xQRU4BADgAA0NBRU4B
AANDQkVOARBAHC8DX1NCX1BDSTBJU0FfW4ItUlRDXwhfSElEDEHQCwAIX0NSUxEYChVHAXAAcAAQ
AiIAAUcBcgByAAIGeQBbgjdLQkRfCF9ISUQMQdADAxQJX1NUQQCkCg8IX0NSUxEYChVHAWAAYAAB
AUcBZABkAAEBIgIAeQBbgidNT1VfCF9ISUQMQdAPExQJX1NUQQCkCg8IX0NSUxEICgUiABB5AFuC
TgRGREMwCF9ISUQMQdAHAAhfQ1JTERsKGEcB8gPyAwAERwH3A/cDAAEiQAAqBAB5AAhfRkRFERcK
FAAAAAAAAAAAAAAAAAAAAAACAAAAW4I+TFBUXwhfSElEDEHQBAAUGF9TVEEAcExQRU5goAaTYACk
AKEEpAoPCF9DUlMREAoNRwF4A3gDCAgigAB5AFuCRQRDT00xCF9ISUQMQdAFAQhfVUlEARQYX1NU
QQBwQ0FFTmCgBpNgAKQAoQSkCg8IX0NSUxEQCg1HAfgD+AMACCIQAHkAW4JGBENPTTIIX0hJRAxB
0AUBCF9VSUQKAhQYX1NUQQBwQ0JFTmCgBpNgAKQAoQSkCg8IX0NSUxEQCg1HAfgC+AIACCIIAHkA
EEgILl9TQl9QQ0kwW4BQQ1NUAQsArgoIW4EQUENTVENQQ0lVIFBDSUQgW4BTRUpfAQsIrgoEW4EL
U0VKX0NCMEVKIFuAQk5NUgELEK4KBFuBC0JOTVJDQk5VTSBbAUJMQ0sAFCVQQ0VKAlsjQkxDS///
cGhCTlVNcHkBaQBCMEVKWydCTENLpAAQTjZfU0JfEEsKUENJMBRECl9QUlQAcBICgGBwAGGiQgmV
YQqAcHphCgIAYnB7cmFiAAoDAGOgEJNjAHASCQQAAExOS0QAZKAkk2MBoBGTYQoEcBIJBAAATE5L
UwBkoQ1wEgkEAABMTktBAGSgEZNjCgJwEgkEAABMTktCAGSgEZNjCgNwEgkEAABMTktDAGRwfXli
ChAAC///AIhkAABwe2EKAwCIZAEAcGSIYGEAdWGkYFuBJC8DUENJMElTQV9QNDBDAVBSUTAIUFJR
MQhQUlEyCFBSUTMIFBNJUVNUAaAJewqAaACkCgmkCgsUNklRQ1IJCFBSUjARDgoLiQYACQEAAAAA
eQCKUFJSMAoFUFJSSaALlWgKgHBoUFJSSaRQUlIwW4JMB0xOS0EIX0hJRAxB0AwPCF9VSUQACF9Q
UlMRFgoTiQ4ACQMFAAAACgAAAAsAAAB5ABQPX1NUQQCkSVFTVFBSUTAUEV9ESVMAfVBSUTAKgFBS
UTAUD19DUlMApElRQ1JQUlEwFBdfU1JTAYpoCgVQUlJJcFBSUklQUlEwW4JMB0xOS0IIX0hJRAxB
0AwPCF9VSUQBCF9QUlMRFgoTiQ4ACQMFAAAACgAAAAsAAAB5ABQPX1NUQQCkSVFTVFBSUTEUEV9E
SVMAfVBSUTEKgFBSUTEUD19DUlMApElRQ1JQUlExFBdfU1JTAYpoCgVQUlJJcFBSUklQUlExW4JN
B0xOS0MIX0hJRAxB0AwPCF9VSUQKAghfUFJTERYKE4kOAAkDBQAAAAoAAAALAAAAeQAUD19TVEEA
pElRU1RQUlEyFBFfRElTAH1QUlEyCoBQUlEyFA9fQ1JTAKRJUUNSUFJRMhQXX1NSUwGKaAoFUFJS
SXBQUlJJUFJRMluCTQdMTktECF9ISUQMQdAMDwhfVUlECgMIX1BSUxEWChOJDgAJAwUAAAAKAAAA
CwAAAHkAFA9fU1RBAKRJUVNUUFJRMxQRX0RJUwB9UFJRMwqAUFJRMxQPX0NSUwCkSVFDUlBSUTMU
F19TUlMBimgKBVBSUklwUFJSSVBSUTNbgk8ETE5LUwhfSElEDEHQDA8IX1VJRAoECF9QUlMRDgoL
iQYACQEJAAAAeQAUCV9TVEEApAoLFAZfRElTABQLX0NSUwCkX1BSUxQGX1NSUwEQSTdfU0JfW4JD
ClwvA19TQl9QQ0kwUFJFUwhfSElEDEHQCgYIX1VJRA1DUFUgSG90cGx1ZyByZXNvdXJjZXMAWwFD
UExLAAhfQ1JTEQ0KCkcBAK8ArwEMeQBbgFBSU1QBCwCvCgxbgSNQUlNUQQAgQ1BFTgFDSU5TAUNS
TVYBQ0VKMAEABENDTUQIW4ESUFJTVANDU0VMIAAgQ0RBVCAUDF9JTkkIcABDU0VMW4JMLFwuX1NC
X0NQVVMIX0hJRA1BQ1BJMDAxMAAIX0NJRAxB0AoFFBFDVEZZAqAKk2gAhkMwMDBpFEgGQ1NUQQlb
I1wvBF9TQl9QQ0kwUFJFU0NQTEv//3BoXC8EX1NCX1BDSTBQUkVTQ1NFTHAAYKAak1wvBF9TQl9Q
Q0kwUFJFU0NQRU4BcAoPYFsnXC8EX1NCX1BDSTBQUkVTQ1BMS6RgFE0FQ0VKMAlbI1wvBF9TQl9Q
Q0kwUFJFU0NQTEv//3BoXC8EX1NCX1BDSTBQUkVTQ1NFTHABXC8EX1NCX1BDSTBQUkVTQ0VKMFsn
XC8EX1NCX1BDSTBQUkVTQ1BMSxRIDkNTQ04IWyNcLwRfU0JfUENJMFBSRVNDUExL//9wAWCiQQuT
YAFwAGBwAFwvBF9TQl9QQ0kwUFJFU0NDTUSgRwSTXC8EX1NCX1BDSTBQUkVTQ0lOUwFDVEZZXC8E
X1NCX1BDSTBQUkVTQ0RBVAFwAVwvBF9TQl9QQ0kwUFJFU0NJTlNwAWChSwSgSASTXC8EX1NCX1BD
STBQUkVTQ1JNVgFDVEZZXC8EX1NCX1BDSTBQUkVTQ0RBVAoDcAFcLwRfU0JfUENJMFBSRVNDUk1W
cAFgWydcLwRfU0JfUENJMFBSRVNDUExLFE0JQ09TVAxbI1wvBF9TQl9QQ0kwUFJFU0NQTEv//3Bo
XC8EX1NCX1BDSTBQUkVTQ1NFTHABXC8EX1NCX1BDSTBQUkVTQ0NNRHBpXC8EX1NCX1BDSTBQUkVT
Q0RBVHAKAlwvBF9TQl9QQ0kwUFJFU0NDTURwalwvBF9TQl9QQ0kwUFJFU0NEQVRbJ1wvBF9TQl9Q
Q0kwUFJFU0NQTEtbg0UEQzAwMAAAAAAAABQMX1NUQQikQ1NUQQAIX01BVBELCggACAAAAQAAABQL
X0VKMAFDRUowABQOX09TVAtDT1NUAGhpahQbXC5fR1BFX0UwMgBcLwNfU0JfQ1BVU0NTQ04QTwRf
R1BFCF9ISUQNQUNQSTAwMDYAFDlfRTAxAFsjXC8DX1NCX1BDSTBCTENL//9cLwNfU0JfUENJMFBD
TlRbJ1wvA19TQl9QQ0kwQkxDSxBDFFwuX1NCX1BDSTAIX0NSUxFACgqciA0AAgwAAAAAAP8AAAAA
AUcB+Az4DAEIiA0AAQwDAAAAAPcMAAD4DIgNAAEMAwAAAA3//wAAAPOHFwAADAMAAAAAAAAKAP//
CwAAAAAAAAACAIcXAAAMAQAAAAAAAABA//+//gAAAAAAAMC+iisAAAwDAAAAAAAAAAAAAAAAAQAA
AP///38BAAAAAAAAAAAAAAAAAACAAAAAAHkAW4JDBEdQRTAIX0hJRA1QTlAwQTA2AAhfVUlEDUdQ
RTAgcmVzb3VyY2VzAAhfU1RBCgsIX0NSUxENCgpHAeCv4K8BBHkAW4JKBFBIUFIIX0hJRA1QTlAw
QTA2AAhfVUlEDVBDSSBIb3RwbHVnIHJlc291cmNlcwAIX1NUQQoLCF9DUlMRDQoKRwEArgCuARR5
ABAPXAAIX1M1XxIGBAAAAAAQO1wuX1NCX1BDSTBbgi5GV0NGCF9ISUQNUUVNVTAwMDIACF9TVEEK
CwhfQ1JTEQ0KCkcBEAUQBQEMeQAQQXFcX1NCXxBJcFBDSTAIQlNFTABbggtTMDBfCF9BRFIAW4Ip
UzEwXwhfQURSDAAAAgAIX1NVTgoCFBJfRUowAVBDRUpCU0VMX1NVTluCKVMxOF8IX0FEUgwAAAMA
CF9TVU4KAxQSX0VKMAFQQ0VKQlNFTF9TVU5bgilTMjBfCF9TVU4KBAhfQURSDAAABAAUEl9FSjAB
UENFSkJTRUxfU1VOW4IpUzI4XwhfU1VOCgUIX0FEUgwAAAUAFBJfRUowAVBDRUpCU0VMX1NVTluC
KVMzMF8IX1NVTgoGCF9BRFIMAAAGABQSX0VKMAFQQ0VKQlNFTF9TVU5bgilTMzhfCF9TVU4KBwhf
QURSDAAABwAUEl9FSjABUENFSkJTRUxfU1VOW4IpUzQwXwhfU1VOCggIX0FEUgwAAAgAFBJfRUow
AVBDRUpCU0VMX1NVTluCKVM0OF8IX1NVTgoJCF9BRFIMAAAJABQSX0VKMAFQQ0VKQlNFTF9TVU5b
gilTNTBfCF9TVU4KCghfQURSDAAACgAUEl9FSjABUENFSkJTRUxfU1VOW4IpUzU4XwhfU1VOCgsI
X0FEUgwAAAsAFBJfRUowAVBDRUpCU0VMX1NVTluCKVM2MF8IX1NVTgoMCF9BRFIMAAAMABQSX0VK
MAFQQ0VKQlNFTF9TVU5bgilTNjhfCF9TVU4KDQhfQURSDAAADQAUEl9FSjABUENFSkJTRUxfU1VO
W4IpUzcwXwhfU1VOCg4IX0FEUgwAAA4AFBJfRUowAVBDRUpCU0VMX1NVTluCKVM3OF8IX1NVTgoP
CF9BRFIMAAAPABQSX0VKMAFQQ0VKQlNFTF9TVU5bgilTODBfCF9TVU4KEAhfQURSDAAAEAAUEl9F
SjABUENFSkJTRUxfU1VOW4IpUzg4XwhfU1VOChEIX0FEUgwAABEAFBJfRUowAVBDRUpCU0VMX1NV
TluCKVM5MF8IX1NVTgoSCF9BRFIMAAASABQSX0VKMAFQQ0VKQlNFTF9TVU5bgilTOThfCF9TVU4K
EwhfQURSDAAAEwAUEl9FSjABUENFSkJTRUxfU1VOW4IpU0EwXwhfU1VOChQIX0FEUgwAABQAFBJf
RUowAVBDRUpCU0VMX1NVTluCKVNBOF8IX1NVTgoVCF9BRFIMAAAVABQSX0VKMAFQQ0VKQlNFTF9T
VU5bgilTQjBfCF9TVU4KFghfQURSDAAAFgAUEl9FSjABUENFSkJTRUxfU1VOW4IpU0I4XwhfU1VO
ChcIX0FEUgwAABcAFBJfRUowAVBDRUpCU0VMX1NVTluCKVNDMF8IX1NVTgoYCF9BRFIMAAAYABQS
X0VKMAFQQ0VKQlNFTF9TVU5bgilTQzhfCF9TVU4KGQhfQURSDAAAGQAUEl9FSjABUENFSkJTRUxf
U1VOW4IpU0QwXwhfU1VOChoIX0FEUgwAABoAFBJfRUowAVBDRUpCU0VMX1NVTluCKVNEOF8IX1NV
TgobCF9BRFIMAAAbABQSX0VKMAFQQ0VKQlNFTF9TVU5bgilTRTBfCF9TVU4KHAhfQURSDAAAHAAU
El9FSjABUENFSkJTRUxfU1VOW4IpU0U4XwhfU1VOCh0IX0FEUgwAAB0AFBJfRUowAVBDRUpCU0VM
X1NVTluCKVNGMF8IX1NVTgoeCF9BRFIMAAAeABQSX0VKMAFQQ0VKQlNFTF9TVU5bgilTRjhfCF9T
VU4KHwhfQURSDAAAHwAUEl9FSjABUENFSkJTRUxfU1VOFEUcRFZOVAKgDHtoCgQAhlMxMF9poAx7
aAoIAIZTMThfaaAMe2gKEACGUzIwX2mgDHtoCiAAhlMyOF9poAx7aApAAIZTMzBfaaAMe2gKgACG
UzM4X2mgDXtoCwABAIZTNDBfaaANe2gLAAIAhlM0OF9poA17aAsABACGUzUwX2mgDXtoCwAIAIZT
NThfaaANe2gLABAAhlM2MF9poA17aAsAIACGUzY4X2mgDXtoCwBAAIZTNzBfaaANe2gLAIAAhlM3
OF9poA97aAwAAAEAAIZTODBfaaAPe2gMAAACAACGUzg4X2mgD3toDAAABAAAhlM5MF9poA97aAwA
AAgAAIZTOThfaaAPe2gMAAAQAACGU0EwX2mgD3toDAAAIAAAhlNBOF9poA97aAwAAEAAAIZTQjBf
aaAPe2gMAACAAACGU0I4X2mgD3toDAAAAAEAhlNDMF9poA97aAwAAAACAIZTQzhfaaAPe2gMAAAA
BACGU0QwX2mgD3toDAAAAAgAhlNEOF9poA97aAwAAAAQAIZTRTBfaaAPe2gMAAAAIACGU0U4X2mg
D3toDAAAAEAAhlNGMF9poA97aAwAAACAAIZTRjhfaRQfUENOVABwAEJOVU1EVk5UUENJVQFEVk5U
UENJRAoD
====
begin-base64 644 FACP.1
RkFDUHQAAAAB50JPQ0hTIEJYUENGQUNQAQAAAEJYUEMBAAAAAAD+P0AA/j8BAAkAsgAAAPHwAAAA
BgAAAAAAAAQGAAAAAAAAAAAAAAgGAADgrwAAAAAAAAQCAAQEAAAA/w//DwAAAAAAAAAAMgAAAKWA
AAA=
====
begin-base64 644 RSDT.0
UlNEVCwAAAABKkJPQ0hTIEJYUENSU0RUAQAAAEJYUEMBAAAAFxT+P4sU/j8=
====
begin-base64 644 headers
ClJTRCBQVFI6IENoZWNrc3VtPTI1MywgT0VNSUQ9Qk9DSFMsIFJldmlzaW9uPTAsIFJzZHRBZGRy
ZXNzPTB4M2ZmZTE1MDMKCgpSU0RUOiBMZW5ndGg9NDQsIFJldmlzaW9uPTEsIENoZWNrc3VtPTQy
LAoJT0VNSUQ9Qk9DSFMsIE9FTSBUYWJsZSBJRD1CWFBDUlNEVCwgT0VNIFJldmlzaW9uPTB4MSwK
CUNyZWF0b3IgSUQ9QlhQQywgQ3JlYXRvciBSZXZpc2lvbj0weDEKCgoJRW50cmllcz17IDB4M2Zm
ZTE0MTcsIDB4M2ZmZTE0OGIgfQoKCglEU0RUPTB4M2ZmZTAwNDAKCUlOVF9NT0RFTD1BUElDCglT
Q0lfSU5UPTkKCVNNSV9DTUQ9MHhiMiwgQUNQSV9FTkFCTEU9MHhmMSwgQUNQSV9ESVNBQkxFPTB4
ZjAsIFM0QklPU19SRVE9MHgwCglQTTFhX0VWVF9CTEs9MHg2MDAtMHg2MDMKCVBNMWFfQ05UX0JM
Sz0weDYwNC0weDYwNQoJUE0yX1RNUl9CTEs9MHg2MDgtMHg2MGIKCVBNMl9HUEUwX0JMSz0weGFm
ZTAtMHhhZmUzCglQX0xWTDJfTEFUPTQwOTVtcywgUF9MVkwzX0xBVD00MDk1bXMKCUZMVVNIX1NJ
WkU9MCwgRkxVU0hfU1RSSURFPTAKCURVVFlfT0ZGU0VUPTAsIERVVFlfV0lEVEg9MAoJREFZX0FM
Uk09MCwgTU9OX0FMUk09MCwgQ0VOVFVSWT01MAoJRmxhZ3M9e1dCSU5WRCxQUk9DX0MxLFNMUF9C
VVRUT04sUlRDX1M0fQoKCkRTRFQ6IExlbmd0aD01MDc5LCBSZXZpc2lvbj0xLCBDaGVja3N1bT0y
MzgsCglPRU1JRD1CT0NIUywgT0VNIFRhYmxlIElEPUJYUENEU0RULCBPRU0gUmV2aXNpb249MHgx
LAoJQ3JlYXRvciBJRD1CWFBDLCBDcmVhdG9yIFJldmlzaW9uPTB4MQoKCkFQSUM6IExlbmd0aD0x
MjAsIFJldmlzaW9uPTEsIENoZWNrc3VtPTIzNywKCU9FTUlEPUJPQ0hTLCBPRU0gVGFibGUgSUQ9
QlhQQ0FQSUMsIE9FTSBSZXZpc2lvbj0weDEsCglDcmVhdG9yIElEPUJYUEMsIENyZWF0b3IgUmV2
aXNpb249MHgxCgo=
====
