From fa41e6a94974a6f4607d8f8059c47a5f897590f5 Mon Sep 17 00:00:00 2001 From: Oliver Chang Date: Mon, 16 Oct 2017 15:54:58 -0700 Subject: [PATCH] Add script for testing sandbox. --- infra/base-images/base-runner/Dockerfile | 2 +- infra/base-images/base-runner/minijail0 | Bin 0 -> 59392 bytes infra/base-images/base-runner/run_minijail | 46 +++++++++++++++++++++ infra/helper.py | 13 ++++-- 4 files changed, 57 insertions(+), 4 deletions(-) create mode 100755 infra/base-images/base-runner/minijail0 create mode 100755 infra/base-images/base-runner/run_minijail diff --git a/infra/base-images/base-runner/Dockerfile b/infra/base-images/base-runner/Dockerfile index 4427e0ec3..9cdf9215c 100644 --- a/infra/base-images/base-runner/Dockerfile +++ b/infra/base-images/base-runner/Dockerfile @@ -18,7 +18,7 @@ FROM gcr.io/oss-fuzz-base/base-image MAINTAINER mike.aizatsky@gmail.com RUN apt-get install -y zip file libunwind8 binutils libblocksruntime0 COPY bad_build_check llvm-cov llvm-profdata llvm-symbolizer reproduce \ - run_fuzzer sancov test_all test_report /usr/local/bin/ + run_fuzzer sancov test_all test_report minijail0 run_minijail /usr/local/bin/ # Default environment options for various sanitizers. # Note that these match the settings used in ClusterFuzz and diff --git a/infra/base-images/base-runner/minijail0 b/infra/base-images/base-runner/minijail0 new file mode 100755 index 0000000000000000000000000000000000000000..369e0bbd9e8e08b6687be3b25b93038dbdc56dd5 GIT binary patch literal 59392 zcmd44eSB2K^#^=6*+6(Pn<{8j)T;&w8X)0C!>hX_fxECs3IVN%Nk}#!l9%o7T>_%A zxVy-8U7K24t*tGs)?&4a)?z?}Kp;VFE26ekRM7fz*9FBljELmWb4_JaUG@{lRagmi1dsI(2#Ii`M`Gc0`YW(Y|-aqOa{Z?w_ zl^Is#C~u`iC}V%)DdEyj#rtv{J-0u}vPiA$K~E=Yho#Wmird*HkyAsjyW6?k=crXqAJ)n^ae{LE&Po;rJ z($F~ra1p=BKWhO<)$Whe(0@G*etsJKt~C99J`MbaG<1HI2L5Fl__Jx~H>ZKWnFc-~ z4g6Ec;YZ2BL|#e5&&f1&&PjtmB@O(NG;}^rga3LO{8MT0Y4W7fhkMh|IWG--VjB2c zY1;iZjb3G>!QYXF{_AP*uSnCcS%6=hVjOQtL+3YX+Wl)9_=q&^-kyg3eQD${JPn-- z($HxGKdJQdy)=COE)AX0;73d$p8;w3xhV~u*}zZ5PhlE<+SAavHVu4x8oA9(L*JbS zzdjBA?lkS5od*8LG<4of)9%1D^4yn({y)>u&q+h4HVvKWY4A(Hr-Iqk{o4RfH6M?r!JiL#<_hNs;*sivE-z#7JfR>7zF31N<2NxrhX@DH zwI^vz#puwad8K*%3e9Is?O&TsG75~YJrAV+EnB5I6VTZp1N{)9_BGffG-R@R5>j@QHDby}^x3^2};BNK0JVJf#^14R1;Aw1V zsc8~iUKyZPH;6Pg5Zlc)o)xTKP3;OIUR7Vy*d){}YjvYh=PFQM(b&{PP0FoxJYfvT ztxW>D-r#PjX|8e$^?3H6t4&Ri1dyB18JD|OZW6pLp5--eC$;BncFC*JdqTkfXcoO~ zX{|z?8o9BxMX2{Uos65+o~G7@SYN3}sHSxYEurHAfa8g{Q+Bqjq~aEgT2;MKOpOgS zb#+>MEyNL?-A+$KW1Z0KY_4^!hH#o%J>ZRc=WP<2HU6Eli;$|SYUR}~XVo&|kb28n z^3>L})N7=?zydQh?gr3+wo#uvEe0OyIkt0^vv#GENVwX#z_cctg!(pjqwEx*Dm9QV zSgvKFph0zkI`E(Zg15QV+aiw_JgY$votA3J{R zq}cO>*i%XDsd!@SG5$1R>_p7o4E&eL{?ZfuP^$lDjy>s+4D8qVb5@G7IMx7^8fodz zyw<>kQfgnPs@Kx-^%RE5(B42H8@Wuu6#I`jr~RQxcnT@)H%0t<&ubhc2m^%%s*WEM zcJCAt(D%D%H8x_4l`VLf-4ld7mLDM8s^#zf`LD2z&Jym>^21oUS-3~b%jXjPOyRd$ zp0}3~YwzIUYHF6n49;dx{Lc{se7pg!8sL)*@Z$zJt?~L#uK|9e4n$h;RyE5F#9u5u zv7aIXoR2myDlx#(mDrEf0M}y+R45tXu@DL16$ZF5{&1ZEPCV&9)dn~O8T(mofDevA z1;J&24>7=38Q?<=aGwEAdujb=g8^;~60{rO79APs{RX(MJ5;>U05`77n+$NHpRm~g zKg&SB!vLpPi2l=QfDhM!NcS1w=NRDo4RDIB=syPy@N;z_(jx}=c?P&@fS+%GA2+~9 z7~s7I_yq>I@OCxJ(U@OofM*-v7a8EW2DoT|=NaG^8{nb=eu)8IV1Qq0fEO9y`3882 z0Y1_Iw;JG=8Q_uuKFR>EFu)58@aqil%MI{q1N;gDe7ON$Xn?y6@G%DXDg%710q!%v z#~I)o4DccYyxjmVHo)&Uz$X~s8x3$;P4u5l2Ds6VZ8pHK)RB>P7~oeK;GG8eWCMJk z0Y1e5-*13VHNX!V;L{B7BL?_%16(!0XBgne4e+ZC@LmJlYJdxxeJ1_48Q|Fl_)G&l z*8ndy!1E07G6P&Rz{?Hr0t0-O0bXQ)&o;nI3~-k zXMk55;MW-7%MI}P2Dr-ruQ0$@8Q?!Qz>CK*D3+q%*rjp>O0c{Iy(U#S`V16H??zAAUv-raZY6k^L;6LHP{Ice4D+ z-N=Ku5ZTP~pHZG%hsZ{j|A_MBGDO;0{$0wGs}S+A{2P>~=@N0V`~k|-F-oMGj7 z&hpDBPp)Ca$MV-xo|g28i{%$ko|f`RHOtSTJT2jo3YMQqd0M(7R+gVad0Mg~MJzv_ z@*^lOvi#+gzku?&EPn~*X=#oKEPo#5X-SS8|CaiHCgnxSA7S~yl&2*)vY+KMD1Qm% zJ6ZnZF61wz{AQN_jPkV9MmDniN0g@}Hqy@W?^2$Y)`*Yg-=O>`%DY(p0Oe^Zja0Mz ziX^iY=`P(T^E_|euGUEbpfLM9Obu`I{(DOJby* z<(E;OmcodS<*%naErAgi%P*ijx%`o8mY+j;S_&f-EI*U-v;;=1EI) z{$wZerIg>y@}E(@jPe^<{v*oMQWa@u`FAN#OH{Kg-`v`302kWciyZPfJZ?Gt0XvUrG6mEPoT_X=#bHBM-Zr zCxwS!aGN0PFacO6h0G&K+a;weKfAbdXC|K2ddy7qDWJF8uC*<;EwWYGl`j@8RK7v= z#%-)R8a% ztbIx8k(4fVI2sIgT7tPSypnQQ{c;7|7iA9~%asq+bHIts-)FJ}4#QC6DZ>(I!IKo4 zC!jM2@1n=7M|X-E%}@!rx*a4tsEbm_k$+vCG+`*~rzJR=+VJmLzGSKG2HR5Gjkc;T zDO{FcA%(|`y;~5+5+--u_Ov}@ z-UAuRkNR)P7X>*70v``6>ROBe^7^XgjrS#i|fpPfwR=+_Zoj(76h90G2{U>UNZ1paM5QRZ%jDS_n_y zjS<*JYYHFJP`3I7=Jrk^t-gULqPYNTNMt0cf!#dtxP=X1)}iNPv^QfFAti95glZs+ zOd=mfWFk?pOTZ;q%Fyt`s3!Se01vsvos#mO&z_LJdPVX_Owziq`>>i??#KX@9Tay# zsrvrcU^fWFvV6%Bcpkz4;Sr4RJs=E%3yENOk_A0+go+%>S86e|j=E}t^MI05Y&gGC z&*R|Wo1kyo$sCdSoJ4NCD?tb&QlhckOFh2=8GC40J}CJ%2m)prlg^uNg;IKZvRIU+L0rf=wYYJp%?P z-A-*kN&0sSbk-6)#WlmZJtp-xfI(94;6lk`Lb(++sQRstHY8QRfXg*tHnf5YE6@fc zcW#{4Sd@^+W&jf<=b!{EhVM+)j(?*oyi?opM6~wsh6-6jeNY)x?|d%C;rDsT z4wQiKlXrmd#YVNeHAc9WNh|9XhB@g5g;*_7pC>&CPnw5pai3l3Rv+hpX$(N>A*#P7 z5SwV0fQ+%97d&AJtRN+zuH6O$xot4oEIt9-r8f2U^(nigP-VX8P)<-!F28`w(}Efh zoydALhV%XLHt-#i^Ru^+S(H#rhF(`VA4ZWVRrsc0q&m&OP`Ziahj8~IA7Nx6l*d2< zFw8}X_&Oi#sCPhkkr#P+C|0iGdK4Rt&AddR#>3O!2qp_nLWlWijHRxJvSu^PNu!`z zB(x3aBZQVmYRiPy#sLEvfP_}0)^X4m7?I*W0$J4`bI?06P>DK&KoD(_U?-tD@~xJ@ z?=gj#h<}9#Dfof|#;pX_jDaEWVR&#TJxpRGb5tVwC8`a?9H3Fc2-%fRk{xC)8-@3{ zRtKKpY7pMa`o5PGhJ4+aopOK(@B4Tn2Vrl+Y8D|qf*@v4H5#wvp&I!Gm1FpPC4zUb z%{K!B_BcjbYkegw5Gl)*L?%4^Z|kY#QxMDoL9K0Cqu!3q+h_1Ztv6v|iS%I@DDw%( zL_X6ppMmfC_Q?PE5Ix+HhO^M;{W+uibsA@_6=#cTV z{RrO_!>r(#>p12zA6TG$l}0sNwZ`@6$iq}v^$9doIV>rA)n+_8!gX004!H5{5P>6{ zwRIW935$dl;QQ}&D24gOop$BF5E$Bk&U~Pr{W0lyWquyq_F>Fz_vXN5FOU?Kd+l9n zDJX-lMbM5Vbwul1u=F|G-h}2$j?k>^1irAfk(3YFP^$&UnPay>B_2X^L3Q6q6FG|0 z>92f)6k3?;2$kkZp^5oYXsX%)ZeZ$y+|L*7@Mm}n{0~*^GxgLMiL7)(?=|Roto;ZKl zABLvi`Lx(?XQ;jdYVFty()inzQ;VLbF*z48U4NI!Hu){LLX|L-h!MVqeoRX4$D1fqN5%U=i!RC7%(Y?&moIJPy3`^J zi>=ZI)+FUiI4p~+NiRNG2nKVL8B`yF6xfcSOP+~__qYhRr%ZWATbIBFf9?eZlmhQ?6$JiY{=9{r|5;yO zKUUWd+hV(NS`#uRSt`zdqI1625;%o1pev5VyIO>XNKfAekUXVN)C)C87opK`5pa+O z{1c%avMcXJeufflyx7E4{;M36UVYadTwEYG7N4-OZL~vqN1L^uDCT_ibFPQMd7zSr z5Nl|^hH`O#6wdM|>R&aKcfbKurEGGv?E+GjJpVV@mS8K?wIdrvkv2T>eKk6;fsKYG zcnBr-&}{`}%ExLQb{w`7vqqb|b#M%*_c3mJ%=tt^wP|e~Mg}-KMvUEyweo#Q zt^6sJlN?PN8}Jrb{twJ5B&cVjt{@a=ASL;GP0~C)1tRL~2$Ul{+=asEJ9xO79uDH+ z33_-L4_WlkjfdB&@$ftzenSt>;Nd2Ecubw}5u;HEEsQ=0@IzGNUOeokhY%j#p@-X{ zY({;f$?F?+wXeZ+DtU@nw#?4(HDsRhAGvMA?2IJU&!UOfr9KbN6X@yjBECR?c$sC( zRrqZ+;TJ^K_M3^b!_%%TSB{pOj@fp-H*nYc18tqB@!N;rQvy+6R_f6uh*$bg=2sg++$cLuk`5KNm{tj&3xe>F^Et#;yeN?+28$>ag02 zDirR)Uf+>FR0?BNkiyU1j%Hz$PAwrc^naEj z7{?PZ)IU)9(f620`n~oQ2jGEqspd>p;qgkQySv64VmW39_4ldOy>X-ag4v zevtHgpWctX@+v7T=jS>QK7|*AMQu0juzIN+X*Jqr!a=9yMIl!%Ie{-}L8J-9a}a(X zLXdJXLkn4l*^nJdQ=&3oig{9A5hA@#bNr0{O!Pk;SQq-D`_)Mh16v=+KmB%RIoQ@> z)_VUy&d@*X*y8=`Abv4n_5P`xHTb6Tg8u#cP(7&i&-Xt=|HiTYeWK1q|9A&V;vF~_ z9gwsRFi$M{Hs}05>KZmcvGE~&_suu?61XMjHBr;G89alJZqj`5&CkgAVf9a=2mR+8 z>YIO9{T=D*!$mVlJ1zgW^{Y>=8{1o?uuCTfit@$K^NJhvnLv|E-HNgIU3wU%y@=G+ zHzZe5Rum)&Y#^B)IO6IM)?|XblX<0ypXH*A zZ+-`V{`9WyudwmV{DJalLA4a)VX-E&nAAH>9meU^C?ri#ru{)%8d4=P7i&UDIFF4`cW?R7u%iOo4tXO#X;} z-@3HENU@>)AE>{l!FP)G=bL`ucpY#{_i>Ry) zKa4+Cw64ip{9*FW>BldtZ?R&^|G*)82`%@tH>Mw`pm(#%ka%qV#p4J@Zwku^rc*BU zj}C20uk#LxPU8N*zZ0HhZs34?hVNvd_jtE3I2y(JNfy$cHg`!Ex3>RN zhoNO!kH4$EjlkjURsX+k@8P%O{*lk}1J$t=m6$rl<-^9OA!F?i8{e@yfkgSHaBd|3 zT1n`D6WZrJ2XP#g_~m_<IGOSZPNmg>0Kf(DNTDS-H8~_tkwPo75oaRg zxnK-i`<|pp=tba%X^?hE9Px90u-}wu+hI+@FDG)E<42pl$g9}cF~2U+L!BF*SP0V5 zSCi^z!8eNDUEi**0I!Dm!RL3z51e0PS>+!(zcvG#k9h@+d8X<6#^mKg{q!@o&yzw= zs;P#>|Lvf*Iiz7TsWl}Ky&qUo$WO?Ue|r~Y1-SstXGoaalEO;*aYErgTEF>xepf96 zD>R?={ia=c4XmVyM*60VbHJ(0X1Z<(zD~_5-y(>~HZ(g*khd%Uny0+1UaX6w%M$nz zc3-mcVuf`%10TVWqj2z+(W;gOZGJD1GXjSP72n!zjTP z6x1ODa+<@#=Trh&`E;Ig#Gyxz22e4AeXxOV5>uhz20(oC1S@!vr%B3nMUp?*4jAP1 zAeC`>8N#L4LtX{k<7E3-J-!5dAMm3)H9s2r4!BD_>N5waovG^MEM1eWK12_2_J4zv z3;jW!{7T*TUy{8R&rIQ`C8_q%^5Pe0^w|9|HH6AZ`kg$L{a>5ro!e>uYQKG5CyUD_ z`o3pL;WHL4r5Fw;`!zgnbt2;l`mm_@00x)E#I(KLPC93xd6e9a`tlphE}WtM`#;!? zmz<6HD&K}Z`i%}g&}&i7Mjw&32S8+JF8-)50BYH?Faxo6W?%N~de_`}a-e0$0rkd7 z{Op$^zc$OW=6r16To}paNg{EPJW!brP~pOPP*{nN>!>jqSwV;LZz!+ld%(#T@cZ5bI z529o8yAI2&cjpD)lh2~?l0$h{{g66qs?BwbzEm=;NRAQ=g7EnUT|EuaFot96rESr+ z<6w#(aW8aEU#V~uQoW@!T55u`3 z^k+1$jAcZtEG1SR#LHL3$_o<9Bd00US)O5*M}V}8Ou|`~XR$82=p;hg^=_ux4HSEb z&2&()1pbV65#ld{hJ-F9yY~9)oL_Ab{1xyWp<1koAFA6Di`MWWws-%1ViDaBmBJoz z8)+$Zo9@9Njsb?w2Q?f3f2cMkRvE*q6l|lBrz#@|z?Wr9unIj#MB4wnic&!yhw+~m zdiX82Vjwz9^hPAodkb^lKKVhyZ+k6ik|mrC3`0FFUWN0X(>M!~5ErIqC=NjLI?IR?ww(yhgMGM1%aHUP*Zs=0=nhghr?#r5j4i-BP-~kO#Y^ z49ky`-vIJxZt@NJ*_Qj5+ZAufI{?}$F6mMivPM$cF=;X!ngMQv8;6!iN{%!d*#uvh zEuJ{;!}u3>M&DHjGFm?3m&Hr8Pzl*cDKu6JU6ee@B;{k$@~cr#n!H!W48lr1d9UYU zoc<&v!>{rQ7oTs}O3HqI#gMJv=s+b&O(tQ7 zhOu}kfeLUSrtD^mxU}x%C*a(&p1x^-V@SJlyo2WKi7t~RcyAUWizj+AEWri*2@yQH z{jKcU70KLW{#^PK^01DZfFV(eIz>pa)DR76-A63(ugQfmEz8HmC3brJJ`~aq9yjo( zm>HI@zzHXiaN!Xu&z#CfNUJdouA!yXjy`iUnk!G2{A)y94Co|Mp*4BZx;~1(wVgu> z1rmkN6LCkV4lPgKyRrs2FftVTKI;`w(c|7)6q}2qr&OX!C|t!;=0UMX=xjkO3S|lY z3KJEBQ)2K7?BQXB(r6XtlP=Xj@X&HuVNpvpH^#VV3Aiyg*&PpbutyD2k$;UO$P@Z? z{!yAObT#BTHaw%XD2W~n(*6KSff16?58(M(E4opFTokD&@i0+Y%iMjx3MJQmkhOW-OLao21tO%mp@xGVvY1fU=gxWYv%$C*^7l*1c<07A1d?vUzN zXdNB{8|ohQ$^Gc#L)6EZeS&`s>{Z$7FaAlat#PS$;vupH^|bZ$Z?yQ77axOVpeOo? zYaTAPd9RGn$9r`D4wI+kWya+kZ8Ibs`YI$FbzM_7O z#~A;H^Pul!A@CMs!3%ohK@a}AfN#>N7hq_Eov;KOBtF+9y(E*B;7+?`!wRhkcVR*m z#M1CjuNH)@0zE6IRXbzN61-GHQzZtF3)OKi={+J>X=`1YWe&G(LaDFt{MM^ z3YCAWx03>sA^REtsKrc7Xv%(0<>5&lVAIL@f#SZcg4HajyU`exzsbs{FGM-pRjI4B zf`6c(3=`{X5GKT>m~WtaxyJrA$WrlnT7Cxdkd_&A)JI}=Te>F=ctzyaal}NNbsuzr^?fAp= zJ3PG_Mf~1IirATY4iKTzr6)>FR_{o)1fAfDZ5(#5gDZAyygx11MKk~-gV@1FNFKb6 z!pkP$?c?ceoIgOa)dB?Esa4+wWdy$-j6SUUuWA$^!~R^KkI54eXC%sQ|GPtdCx==B z?}Hp2mHwVm+}n5-X=uJV_(FZVcWmg|Y}{%ewJF030|tM~J3mo=mf({>*ZR_4e4@Bd z{fe<=36jaNY{}e|A@2*V$yQEca@?R5`LrUF{8VU-nH9aVk4cTj@h9kHg0}n;TBIK7 zfgIb0(k@Yz`J5u;H>P3GU(xMDs7(Yyp6cNZ1#V#~I{XzvdK}o%GCVw_?m=V7y-wg? z8swEqUrr3nMUWNC8cr2-r4iBLysrB8Brxqw^CDj%WTY-b3-#^k?4u%%GV4C2?2rNFLcCr4-d({`ac`PLOSE`i2HO9}ois+!{ z&p{4M#7kI^0(QI@TH8)0X>X%tOKC=o*I*?C3nl$c0fkJwmw{vn zNa_{MRPit>Ql&@%aMd4U_<;3MY0}tk1(s?C*C?Dvqw@|P?gdu#V0}C6dGRq#h>1Z| z908vgSY!#_3^R*~23eM)QBpT(^7Cju&}rE)9Rk{9wFKV>5;!qYnL@B!OVCCswEYjT zNSj1#IFKi9sq9NC1MF5xQUB+Znjk-rW@wpIN*_xi><B z72Jo`sa`@g(98o^-if;WN8Ec{rOSWee0Qn(BqR>Y9td(On;_iC?ZiHvxA6Hzu{HG$ z4X=TQ>CQcx{;Z@1!o%;GsgD#yeo4&`<5Au$l1G{iChemqI&1v6BAAM0514v8SpQ*Dn?5JR(VF^zvL&P{? zoqT}fGFJ-S{TsR)SqgRGb~&_W+73qYRgENV9H3;8N6;MP7+PaRxnNcQrj;MpHBGbx zo&XLQ5;D}iU3?^d3kVwd9W~O665?0LRv+QTY-2?HMs8r#Fg3&|P-xtTA~5@@ zO;;!=7%5Z-u+>apk=}>a6yZAHA`16F%D-bRLk=V-t9l!di0$97u^j#wIvRb3`5An# zcN-#Yk)NYZ%pc_NdV;?UczXhyKjUMjSWyyL293t~&0}Z+Oq#72p~ZaO+>B--bNKUO zdgiXs@M^*t&*2Z#^JV<`#Fcm^4+wPLMnpN1qu~IKTbKz8+jg*^4&23XH&VTKdDrqG zq{zSd^Zi8oMLa`3xGy~^4`CeT+nwYD(2)rRTDU7ivx)9%gm1_m8=CQi|)5Ux>}lwG4__IT{~FN5z#w}5Dn$7tQAX0ksckwGGb*W@_wMQE5OnH z?P`cJpOI8z<*Q<#&FbT5%IH5s-=;q?kt-S+GAJ4%tZEKw@}aZ@?txS&v^0g74X+xZ z*3gI&*NCgEN1<;jW`C9k#2n!>7GOogIna&B*>PF92NDCeg8T5{tnqkTnoSaP*kLK( zhlajnvvPVq(6vj%WcXta7Ch#}5hGm$@}jm@`_MO`46ic79>0SZQi?mb;*BKE z=MH*83|TdU$zbPgXG5HKO^9{k19dy#(T&g1WQqP7{HRx;R|bC+6OO+Xk-!~Ia{p;l z2Ws`Toh>QHand1ubue_x9cJ|=5D1k$2ulhDf7%is$JwP@iZmmjQi-<+5mqa3P;AY%>%#$L3UlcO zGTlTr$S#mi8~fr;n`K8&@EDNtEWtc1>G1I_!NVv*;F0ZNy4c`bf{y`)I9IR~NQhg> zXG-B)@~hQ+FiuO~2!QF0$ZUa^xYWT~34KwNN^%8xxD?)=?}H|&$F}oo(Jn_n7xnr6hKh7<3*af(F=C-o+Hcjl^WcJK@3kfL0#2fV?fbXW|^|4 zgdC+`qix!nJc{%LcCdIMfjD&J=LcWF3&>csNgl(@pbj-Cz!aBJw}gcABg8|iRTYh( zq|T<40|i!*PQolGlGT6mBA1d$ul?l~9|EWH*`e+E0rX3Kl1c;lK0Mo$0aEBLHdwJq ztsJxj2T-Th?IE4e?Hu0!kL$Dg(pJsen0=bMIJ|TUe1!93{s8=Hde{DJUiblA%Y@~4 z3`DA~0ttOT4Iw=_4y@$^hMrmi9_lyD+yw9n0Nz2i1R4NS4|w+sw8h}`XfQi4 zt*`^YR^~04SPFM(vrN!KF)0?QIOf(P{_K0`Lp2WnvtErA#D0C{J^2}T~TZB>-vR>o@x z2$0f3Q3KaPH1UwA9l7%2_cVWXPUxBc-49+vYf9|?Jtp1RMqa__(75|CK=N6nya+Hog3dyHgSTRKXtFvVcv@*MFAZeVz+%5~IVhhE%FNHz zSS}+Dc~{5-o6p8pZ2^>KdGH80(|dX@fRU%Q`ZOFHQAipfKm>&RXXJ|yz`U}rNvMPV z&cFc=s-XExsAKn`$J%Z$@@o)zjvU&^J19_1)Xifu4*kDU|NabXYbEVAt^gX^y@#GJ;?Ez@^I81)Cfa2T zKQL;QhFbtS zwP(>oJ$?v!c4Z$}EPmm8Db7#JpOaB6Bkere&uyk;Ep`4FapJEYbC~=|ax%hzk2h>z{ zgEw>V!0H#GJ5&Kp(47FdA%UP4FWU8v{^}oN?JKD14XmKYF(_D$yA1uMO zjCFQZk?B`>k;!+`blX8J2ACuGG&A{*ipre^ER2GB5(5B z^huri6z^vAmy8~#a~bHws0<(~&wz@eMw&6Z)dEOH?>}x&vE50(P5z15I2b-32chf& z(V6Uw^U2LLOt-q!N7%!I#1#2nj<|n>^H8|UK~{qM3+gQlb4{-5;SbsBP3&Q+x{Oj- z;pdya2y2HvUfSO*rOLup+guzVireu6d*hc@O>JeE~B(&3{Dht&1diBA8?%e*h6 zqUqeuk+i{$?#6il;xRiYVv@{(dOH+>eC6|!n$YgcO&}?Shu<>Z=#i=qLKRf?iMT#6 z`URlRuD|wcgapg*(S!fu5&@53h%@&iWU%&=9u0V9r zQLhqxNqvxaKVDA8hKZi+TXMtdY4SJ{B)^SjcaN1Uh0txy5bBlOZfmCCCB;HV4l}=F z31VQ8KfsiG5dGX7AY~UrbltPx`(EyN{rjp<$YL>{A5HZ(2kzj-?Xnqwu3BjEfV1F7*Z| zFal&5Ufc_T`+)Vx%tK$3xIhs%{E#+=Y=aWHhI@ebVF#D6&6`D*KaFQWX?}Tgs)B)A1gkj*)e-)=$n{IOZ66UfKOvjw=!PA z*y6K1Zz@r>{%qz!;`>#nFba;zQFrqD3;bp-I%11WIDSD1J{=So< zBV3Kc4nIm9$`SUilQ;4lEMXtwoQQ^yutqSQwFK{`>P%pKpb^T@=u8vsc<&r^mH-7W zN8tXAIX}?p{m`y_ReXZhEbbrCrk0g~)6WB)tdjTK=+E@>X`&RK12RW3#**@)WlIK# ze1w-9aLtaaGi|`D@PG@1mcU|yU^nq>FYP7QB5-?mDS^V%1#COFVuOz^o&Nk0%Y9vz zdpbvVS#})4?d0G^z_I&#GRgZA*|*i`y@@lS0FJ5n-XROcSpr`}(+LAHx(`+QzMf-p z9im4p1Q&Rd3h~LRGUYS+8pLAFuH|8naafIQl1=FZ{Kg#g0$Z-Y;|!ldf7nA|>~^cQ zUt?eN0Kk0z*qwnrANcCV#)F9K^1y50*h$f03de&uZQZy?j2kwQd_dL5Hj&E4?vL?L zrNHW^43Tn$$zl6b++N+1N%~TJBG5_S4k$H6f7A|rkirrM;5jw``!s!ElL+siPJax$ zuC262eEx{la^GGO>t3s6$1xa~+{nX#>;4h$Pg}N}1#u5t=!T zX{Mrj$CEwPBHU%9J8wgjlJZhyHl!M_4>?EgejcE{=ytXB&m_Bq`L4a+gYYy24d3A( z^n&F=cEP&eJXHH00VC7q0UlhL_VqXZpgl5wd;|{b9q#AVV3w3F-IeB&O ze#{;k(qCej*{TXk!_s?q@vE@SzrNV539mD)%HC|^b zfkTg-RD~_3^~&mO#Wqw@{?%<8e7f5!1A#(X7B?|6t(m3CMH&G)+u z^F5}w(MQ>OP<$xTOw};xkqPvG?a@k&Y5Kk~$yP#7G&#tk*YhJxu? zy)vL)Sq$s*iE^X4dlpm;F*BiiR_5uRS-9`ex3+uMU}T2~YB#Eqc~j5etVTX$tmFGR z5MT5c>Xi>ec4^ml+D2WC7d~;uFbF>Q11W$&LM^6x6}Cmc_{dj1^kcCH3Om6 z0fl)x7(C4#uUE3kfz|B;n@1O*0)#VyBJSs+37Wb^Quw#|v_(NwnWhVymk8bN;MVD| zx|{};=I+nH-wvENfP=&8JxnZsnn>Zp%T3IF9#&7D!5GJVS}YSC(=L^tVfU!d0v546 z7n+0cIbA{B&nSJO?n4bj z9>cdzxd!i5t3HJj@)4W$Fr+X+YBPz8HY`MusW0ZYdJcre?xZ`EuL&RDX6#nSQz#F+ zs%GXY+)LtzO~FR%fF;mPU8LPzs3Ol!uOLVvt7tbtR*_fPWE6^zMf&j64&S&jpGFa+ z4MCK@Lxi9R8u#Rx`fR6^wI?Qv;?LDYR4raY!LV2s)B&AZd=cG@nmve_yb8}Xg*#LD1O22 zUyW%vQJVZu%lc{v9)V1niSjdcbcwn#+GN}l0B~f z-A7`F{L0{Q>BAVI+x^TgshQB72)&o4*(tJSFGG-#|DrXF?kc2n{5 zC{FM{7H!3T0lS-ZM+-<}Fq3`ACs>?36tL~h=h9=?;?05ZvFGRsu;4Tt5HJ#8wN%T- zzP=q7F$msA!2G6{n%>??5cO|p8GA7L@SpMlb4pYJAZ0h=j0Y^&?55L9Y6&_#l$+hb z&|hMTc1x3fr^%U2?}ls7v~^U2sDVugsJOEOE}dZ8N`Jd&Q!HU1PUqq0;AMzis@OA| zU9#(*Jy=j?o5Qw@?%6{y$i^+CO4wqgERdJKs8Cq1V2=bx3P{c_em z{q3He`91B=)Y>=3q44dG#P+W}Q*VDly!~w=8eqLl7C^mn&JJ>xduE&2z$A2zL_%zB z&ctgC*^mbAXm>&yCXz!v;yOLEVJ(RDGx2+tptrpBw@j%6RL1(hjRefx!xZhauVNWx zsx@ocOm9H}>o z$8e+Y4Y#jEo_`>Tp6yyk?MZS`{$*QKPPb6#OIsArMR2oxyk=Nzej z0$=bz=7i1Pl7x9&g#^1(#2+qWrIh5m?%Q>M)GI@}aihc$UL$sw(oFJX_muMKTMEr7 zC52s+tCSAwE`_p|o+UsurFlK2T)L%@Zt3}gC2%)Lt^0O8{>m%;dwp`TUAvY?Zg+x@ z*G9TxSSj`O5e85B27WE<5blh!k4*RV?YD=`J=?MvpSfkqazs5k;VYf&>&8EsA&ow0 zSFo+b$84hyv}+YXW;e)0cN8DkN~DkA(s#o7nR|ejbXT<4+O3ksF^cTH ztgdV{alyDFT%j z8G+S9Z2%eFKZmx2=kz6X3znRDO?Yt>JI!5~mfh0i?v=SwH=Q4-+4Qd*?xVS0LUk7&#-vxd-RAI&|<7UZpvMe++*M`ra@oyd2 z!WDg}wu@X`ia2Y8%SP{3Duz;Xe_-|q?#uPGFNl-z-<;d$6{%_&JUY!+)~Q5pK>yf2 zEi{Kde(}@uG1j51kC%wrjXm~Hcl2OZbucxc=nN#qqY7U7j2gbY#j9S3s?jdy-$nnU zPP~uPjqMKDKUf0k=SsEXlBI{>$XY2}g;no;vm;!1Me#8Tq2@+slKi@IG3xfoZ>^jt zg(lEmcr-=>H)`HbvTCZg5$v!K2aBxeT*s0Chil*YlK%2GvEs((FHrEa#=}(`da@xD!0K`W@DveuAVKqyYLNIyHKt$A5!hUqW$?+g8ql)Cs0Jlr&0v_yZ*^h1+r8C|U%%KGZ1 z7pP?mdHZWf&ZfO~eAPN}4aUi7wwIkUXi+gAMi}FhU<gs19ZLn23^-xF&P4IOPt@0c0hI6!SvV$* zx~F5ZUW&_B@H zg#Qdf`fIcW=DB}lyf@u%86-`;4WA!iK^0v0m4C`VyeVhlA6W2~+k0q{hRi4sZgio% zO=KAO>O`N~CO=_vmv<`7!{|LU9$j{2DP16zFJiCN9#)@$SlRU4>wPWyNL=S(&mJN@ z#%3EI_<%Zps6NUlU__g#fZXUMj8AsW8&@iE&r@}MOXG$zX;7DA^0#s+7Nvi~mn0_kV0#395wY<8gYG=y zqYC&?gYiZMeR_cmr17giuxGeGUwkO~5A`g@H1kgr_`zc0yLv6YVv;CP{wY<&hu50Q zz5m1MwZr=sFxO_zvfSGlJ)rLSxn^${ZN-E!m4Mej?vI49Drst;8O3J6276)$Pm``6$f?6@Fm)yL02Ek9G9X?eD^#0Ilp zHd$RcQvc93`!*C!mV$Q39xn~a2O@5mV>WJVd5SoZ<@(0F;K(B6)klGD(D(R^MF$Lu zfITxssSIBsAvY0c?ASo-5A2j(9v=yyQfAH6+RFT9Vi5pBd!^d)&+3PbKAt2h1G2 zbw}I5zCnC}{0#u0mxzkvlf3*(E>JLfsr3aKE?RlJSs$;2km4#3q~C)@-)mo0h-U`=albd`ycjB$yZ5kz~&D z{@t>rEI(_SNzN}mHZ8;Z2xZOFGUUb6Ox|CUBC=DJqnP8$-slFs^kN|6&a@YTU_#W; z_A<1{jY;6UPf=}lgc758GlxweQI17V;u8u47EkDNA`P`mQFtrD&7cZl?!(iln?I!3<_o4V`UOxV?I^-m!h+hg*D zy8b%opPe~@8@;wZFo;7I;^rf?o^9By82pLPyU;=Uw@HD4N4U_m%liHwNEhz1AdK{k z8|e|+gr>%2&5bRMH`O#YO%dx|?#33mzF?$h^b~Pqb5db#Q>(`rD;rric4VF47RCw7 z8e8gwv5Cm8#+9vdmAkc7?oY_u-0E$S3&!y_JdHOyr(Zd7USV@r&Q2kyk5nJB5+n#3t)KwKXki zMB{DoEU$4p3s%;r5}aPz=&DU2R=u>vDW@o{U7lKoOoUYsQU9K}ove@*ILfLj7L+^Y z+sZKD^q(*e15UsCpu618rq-Iev7T0;s%oD78v7iZ-BC5Gj7xpo$hvWmNmX-=D-MAC z7=S68fz%XHZ`dP_nIVqkW232L0v>6M=xzmz{V)^oYFoWcbz)1aEY`VOT_RqWty$LC z)F`hO>)ox*;xgz_U1Ljwh#_a)MOz8=>!H=oI#F&FTV2i;anwl9sFZjZ*-^6C;FLvr zhu7)xP*a}%{o{DGP0kv(*x0h%>28#3mNhx!*h%dh@tyVc&RV%~rG}lrrxDNPbT>E3 zGT3H3q`<4Gs}mEb5u<7F5~zI#UQ%yT({s6+R-@mIa$`-CNK$CgxOB>?+UIgg;xq-H z950E}w0QkEWy6%J{Tjw^ePc_1Zj<`w^*Ec@s4uT+X>gLhK%ylkmyc6wYjwNAqfO&EV>S7OFOlvlerDp*gz zBcYQu<2IqTwzb(M);Bgma)l5-&l3*Gu+@z@mQ+89FTDyUL6nRfrjT2_J~d6~NhD@g z%pw!h;I3)Lh_dc-GKu|&(_!)%C)T&R#roRib&c+n_A3b=R<&P+1Ubd=nI-1pHCo5C za^Xxciwes;PUj{qJ|kT)t`NO$TnU93EiQ9{H>a5B1SHkh3&|Q6iu10itST$7w3SMu zMb3GlC@*jHi1^>R$_1+mGt{;m2HxwTk;g1`i!q(zW;{{8vb&Kl3qNdzP9;4TTU%iL z>adi+B}wAf<*t>R3Mv*UBY;mD|_QIbm z6k&Dhnw)%S6Y!c^8yfoSG82Lq-bz2Zy0#_hct5-ZeixRPmd>A7Q7CE;RrBVTl~>KO zJ1WZ;q~Sj%KNvE|x<+(0){TityiO!tW@r3cveYIL{xnoGl z{3XbDZh3h{sjWieF@atJ9>l+BLHSI3rJ*-T{f^<=9Fwh9$Ph*3#*(I+g zu6Z9~ikUzccw_>bYdkBy6VD)r)h)Gb+(azEn4O938t_P7F3}@nt;Fng@ky4f$EomX zW*RCa@S6%B9!OezrVufodnEP*&RQp2OCuavcOzkJ3oqqM4tDrVm1YkMPryAMo z(W@rbi|r?3eig0AO*PA$aI9d}S{hQfm%1LAakm#veQS%j%nSeCoitzL`+aoVpxpc4y$TD%7$6Y(4a9W+yBhOe;IE~pY+6&HDx)kO0;xzIW zXV7!4IE{94?738&1|N<+Hi*;MD#9{eaT=|KGdT5yhT1CMw01T;llJ9*GN zK0?^WpLyOUxe*&JV89x{r=Z;nNuiF>T@j}{kK~~duE7Hv&-8>fv5RonfJ=gBuHiED z0)A*?J-L-Na7H>Yy0U=71yC(_W39~M0Ib(cjaUyfJ)(Ya37{n|7-&~= zlh;XErgyf9yQG zl4`q)-3>*5puwzCY$8n&OZomC+R6y?`Nfcy$0yjkALHV^oEs-v)=HaqI4dh? zcEksmdCizH9&z46wvDk>mNSMBA=ZE5+G4LLjkm|p9C5S-PTFUSNp_wMJElFhH^zON zzI)+PCsM|rS*>oG$D~8`tx4+~BZx_;P4X#8Rf&wg&XQeejx)Freh`s_GC>k97gO+h zh?2~4ykAB+F6uXi3&~T3t@Bb~hY1b?0g514P&~R&Y}U<@)`Ca$V1tAGGuaI-Qi9BC zaa7?bu>e!Gxu#zmDfMJo%tfa@jG{$|OzbFxJIN_wqcN|4XK8-?f7@A5{QpH~TM|3l z(prU)sG`_|hY91FcsbW#K4p!&QYV(Vc(_IW;&=g3VdRiPM zZkTl{l$MWe7+WZg8naLw=k>V9v4f9se9C&pF&i~wY<_{4?cT;Tj~+$M8GjZyf9h?7 zKPQf9;gg>%B%%W?H1%L}=)8lmh>*Vi!&hl`E+k@=rlTR<=*1m?F}nMMdfc?tFn`rx zIJMZ5bCt7pr4yr4hz32FwVK}~mOEyNh=?IJo6I$LtT2;3ux6NQw8?0!#YA(9qv}?p zv&b;6bx#gVXsZ#K7Fy<*gU4_d#d{Xltn>zlYu3tCm6)kc(%Z$_iVA#AJ?@$$qr)hc z#c-o{2^H;S*}?|K@L*s|i2Lc#$Z4)tYzS75B{aCMDIC$k3s+;C(+r=A_EQvh zjt7IMP*(>pbUI_Z_M(DG5C(I8YOs!?X`+wibZk<;;LVOn@MB~BCzWFH>hDnD)hdCI&gE2h*;aZZ_1Ic24L_HwDQzhH!Gha{#%!=zbF)O#Wf?`Vp8ZKm&Nt7VWwtpi%g9SZ`Q^jP=qZ~lCw{XVcm&1a> zUeTU;aFS~128t18Qq;&|Z)u>+0FLuZa8@{NAg<%W$(}A8rjD!0%-qjyFL|sa`XlyYX9w z@;`fS`oMsEsyYYLdjpuiO9@RMj*uMZf4%#nid^)r;2l79`Z#{m! z_&o$1)A^ZGCz|mJ8PwEu6aHacJRfQ8>+8hDkX#pDz{0KDiEH}$DgYO6>Fe8sbTd*F zsc>6gUtSjANQ;nmB6T74tpy&^3L9`o1DB|*NJXSRq*kQIk-CspDBvGy zJJQWa_aohp)OsiC;pHJ8QW0q2aj{krv@j%Wa zN062vt-v*xYNYK*eMt8s-H5aZw{!Lp9O-dNaq&qSf^wwGkrv@HO*_)fNINNi59s1j zzYA#*(oUomNRR&lct|Vm#WiW9?MM$I6@CePyz6)5SHMGR#br(x(v3*(M|vD-2U6Gl zeSN)1eZNEdcq3l;J@Am`;ti-xNUM?VqdeYFI*!!(5XKeXWNJrRf^`4G;1}r;d{tp1 z(u%);U!>w=kR$G{RXh&5NQ?g3*S8Akex#cz{{+SfX(!SGe1US~7L+4Bj`V({)@Q*V z(srZ=ksd+Xi?pZ%?L+^3NK23&M_P?^|5nHWsqh@|sT^r9(j!Ro&O$%710U&eq%O+i z_HjGX{YX2IT6cgSq??iE;?*AOPVkNN2-0?>B0l=N8R>Bj$n9@6TA7+<7C|Al^?hkhgVAuW0XbdXjYLcfvv-o(7Xyx;#8_(SS?8*rpY zkQUJQy72??upiUS3k1`uT+{hO2WGdM29j6>LV0s#U*F{%h5b#9F9`V>zKW}rWIKeM z+*vt!b1XyJvVFqU=S{tQLjEO0U>bhQ@at;B*Ru#PGbcBkQJ#}`SEemTTyM7J6!^2| zVcm)|J3&~)Z34GHFSjy_3ozrhcnA_ z#Ji~f>$7Y*Mg9S0Ie7KMG&rXSATTg9Q4lmXcY#jtn!dhLJX60`4~~gRZ~*i;$_rrQ zU#D`k^Ro;PxjS=ajuL=flNxt`6nZ zDF3mcTpNB?9zglVH03ld52O4D%HN~q)=-W>OM|aa^>9iI+D~@BZ7co@(_p zy|l;l(w^fpWo%4R2wDlaK8?r}gc7Woe~;ClLwe2hiRraH$Ca@zsk+uNlFJRK-+}t$ zsXl5gPme=dlizlfUx#uW%QJqxhW3b`H&MRoJL;c8`Tc3iiQf^hdmSiu5&Z;yAsNjq8THr! z{N6P5h@U2u=fUTiMD!qEm_*$Svi{zM@)DG%>Tf=(JdX0~P~JrK*?gUoBW5h*(^X@H z@LmJn#_z!+eog^T1zxK0qVf^&`Lg}#`I(0D0+cTWF6U=9_?g|0pE}@Ge-B}!#C6(%_3>v(>$HO#a?-0p z_~_Tc$Nw%lk-RI(w+G&IJQE+7-7!5UdoH7VGs>4ydEA}@liTw-MtiR5HSzyA>Zz#r zW{m$iG5(<+{w!KzpMw-rEbzqFQPkgny~cIaE-mQS#2KUh4aFW}AIjtU4AYb`H$f4I z&P3n|*qhjqQ2$nf489J-eu&RXloz4gLl7os<_`f=^M}A^hLpr6UvAkte=q90P=6@& zmg^1br(WmFa$K2psr7~nj{5Z;@q@ig8}Y;Ro95|!-Y>q~2{bN4u@~9^JTul!!??uO z*{6-;f|ugyhvZR)deyWiA^>`sF*B}s)IN^Fg?5zx>Hlf(`a|ow>iFGF34>&M;uso-KUn5U z=A>dKB?PC^KSC%i#fUTX55fE~L&4JL=X1{I``&#wuVaY*_YUNK?m6G@_ndRT_j|tQ zd(M6LhIH5dSL)MazIj#S;*k^JYs8xBz}aiL9ZV+dKnm%C$V-rKe6dj2Dtn&{ zyDP?(x$w^$U7s8S_3LOtwf6wW677WL6khw%yi=gFTKpAh*2MEh#Mnmqjz{F_sp!@gR=2Vq)jkn~p2 zdqLOuZ+W&vcJh5()4z{=9`sqzcc}jFB;-$nzVbfuXF*TRRF>y>TLL`--Qt$#;ODuR z;4t#DiC=eJ2j6k=*C5vkJc+ZU%kP z=#X}L4I?PFr~XzA1nR#Jd@1b3xO#5FM}3ZgZx8qmusx@L7Y}D)aU3r_PMtCT{0s1( z0slDp-F1O~qQ?0tm?=DJ`eC~)EtlQe{9VYcLGDG#O>%skf{rVUD z*TDZd%}*NVSZANylo;n-T-p7g;xP9LrJYJ>;0ntS&Q3=#=$PgwcY`J zV(;wJSYIXmO*j1wZpH-G`&fr((T|!N7#tM>J7@8woCU6b*eYUNJRgS7CpyUb^59j(X-ICt&C+r{Y(*o)*I=L<%kDyO%C9=ug~pN94K zf!=ZxI`2;&^c?7q%I;2azi5*CMY7`_+D|v_rwjWyZ&tJ(Ida^`a9Q4TbXnZ}fr2*?d?BO=EpP<*&!;qyY&fguNH=Zl) zuV~+^!g_6BqhC>+L;D#=J+r9Ctp`f>&6yWLUAcYpde4HNd&zm6$Nak+w-iEa6|eUn zkZb>KWxL?@)O{HKAM~G<*NZFn`+sHgMmGb_lE1Y$mi_BPJu9f^&0;-nzp7ZzD;4_J z0p1gk8^#{^qU1L0qcUQ{nx$-cqlRf$e}w!s$p2FEasOBv_wq|Q?u1tGO0hV53--qM z{I0Z~^l>&T_wj89=*L0lzg6dbIEnqkvi&ivPB=Ep`m6br*E#h!EhBr%SJL&libX z6ikgC0&ESHC9wsmD>+wgdj~0X09$1)@sS!6wisMmyd!dG<-N*VzmIsf0FRtqvi1#C z9Q<2912TQzP<}oYIhKO*)~_|?*KYT8tLOiQmva@XzVq(Ll{X37gjr#~a7Z{RoDfb6 zXM}UY1>v%ARk$v!y~nqEr?5%bCd>-^g+szo;e>EnI3t`BE(n)}tHO0*?H08!Y!bE! zv%-GikZ@EuA)FS@2~!+04BuW|+% z_t~$JAcHqx1~U&n)Uz$Wcb{_mzI8a`J`u5PKR&<6-0zp~vdQ;_5psAIp@Ou_l@6Oqr|#@N9OLr&FmmO2$!~SJ(jh6|3eq}!w6%XG zj2!bB6|}otX&$rrLdC%YIH3+q-sZInDmbDEh4UV--Q*i_&XmO;=QNYId9qs*wats< zWlHMr5tMPxF?pM3*6{3{=?@-?^RV$5@>wJ2Fw5IKHjih_Oj8~L_Mbe~e-#H$;)FUi zd7D>z@hq3=h=*ePCU4hIJB-WQJiRD+o7WjfP$fzEqbQ?JEUvJ)=Hgu_M6!6r=X_gs zPJ9M`arxlxh{Z)g_YQ$CaYw0zuc^2+j$>SYME+~!UQZ7XdbFd-S^oPtiOX9YmY?(- z7LOQz(tde=C~x{dra11HNU^Lce&yzkqu@*jJLn|M&#HR z-|$j(cB6f^c>k0QW^q!FKa1-u?!0=*bJ+bh{$&0f2sCw*U%QlZtZN@oei7X4zsX;d z{Iw4#|0l@O_DnvwoI?)jvWJvzjM=C4-|oXQ*y8P{uH>9x>WY_Nvm5KPMg3VlY$h%r ztmHiBiifm^;?df*g1_Q~by@$@l25OA4r|BfHjbZF5ZHc;F$him{zN%>nc`?|dx}5q PT=DqNcp=VB&Wis7fORMo literal 0 HcmV?d00001 diff --git a/infra/base-images/base-runner/run_minijail b/infra/base-images/base-runner/run_minijail new file mode 100755 index 000000000..856105980 --- /dev/null +++ b/infra/base-images/base-runner/run_minijail @@ -0,0 +1,46 @@ +#!/bin/bash -eu +# Copyright 2017 Google Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +rm -rf /tmp/chroot +mkdir /tmp/chroot + +mkdir /tmp/chroot/lib +mkdir /tmp/chroot/lib64 + +mkdir /tmp/chroot/usr +mkdir /tmp/chroot/usr/lib + +mkdir /tmp/chroot/dev +mknod -m 666 /tmp/chroot/dev/null c 1 3 +mknod -m 666 /tmp/chroot/dev/urandom c 1 9 + +mkdir /tmp/chroot/proc +mkdir /tmp/chroot/tmp + +mkdir /tmp/chroot/bin +cp /bin/sh /tmp/chroot/bin/sh +cp $(which llvm-symbolizer) /tmp/chroot/bin/llvm-symbolizer + +EXE_DIR=$(dirname $(readlink -f $1)) +mkdir -p /tmp/chroot/$EXE_DIR + +minijail0 -U -m "0 $UID 1" -T static \ + -c 0 -n -e -v -p -l -I \ + -k proc,/proc,proc,1 -P /tmp/chroot \ + -b /lib,/lib,0 -b /lib64,/lib64,0 -b /usr/lib,/usr/lib,0 \ + -b /tmp,/tmp,1 \ + -b $EXE_DIR,$EXE_DIR,0 $@ diff --git a/infra/helper.py b/infra/helper.py index 71f2c7852..5ea96fd3a 100755 --- a/infra/helper.py +++ b/infra/helper.py @@ -214,7 +214,7 @@ def _build_image(image_name, no_cache=False, pull=False): def docker_run(run_args, print_output=True): """Call `docker run`.""" - command = ['docker', 'run', '--rm', '-i', '--cap-add', 'SYS_PTRACE'] + command = ['docker', 'run', '--rm', '-i', '--privileged'] command.extend(run_args) print('Running:', _get_command_string(command)) @@ -462,10 +462,17 @@ def shell(args): if args.e: env += args.e + if _is_base_image(args.project_name): + image_project = 'oss-fuzz-base' + out_dir = os.path.join(BUILD_DIR, 'out'); + else: + image_project = 'oss-fuzz' + out_dir = os.path.join(BUILD_DIR, 'out', args.project_name) + run_args = sum([['-e', v] for v in env], []) + [ - '-v', '%s:/out' % os.path.join(BUILD_DIR, 'out', args.project_name), + '-v', '%s:/out' % out_dir, '-v', '%s:/work' % os.path.join(BUILD_DIR, 'work', args.project_name), - '-t', 'gcr.io/oss-fuzz/%s' % args.project_name, + '-t', 'gcr.io/%s/%s' % (image_project, args.project_name), '/bin/bash' ]