[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: /tmp exploits



In an attempt to save the world from disaster, Manoj Srivastava wrote:
> Hi,
> >>"Ian" == Ian Jackson <ian@chiark.greenend.org.uk> writes:
> 
> Ian> I think noone, even humans, should type `echo blah > /tmp/junk'.
> Ian> Make a directory named after your userid, or use your home
> Ian> directory, or something.
> 
> 	Right. But my machine, my rules -- and this proposal would
>  change the behaviour of Debian to be very different from _any_ other
>  UNIX I have been on. 

Actually, I agree with Manoj. But to make a long thread much short,
I've written a lib that contains a wrapper function for open().
(Yes, I know, I should also wrap fopen(), I'll do that tomorrow).

I'm sure that the following uuencoded .tar.gz (that contains the .deb,
the .changes, etc) is much shorter than the discussion. (Or, it
would have been if dpkg would have used bzip2 for it's compression).

It doesn't contain much at the moment -- just the lib, and a
/usr/doc/libstress/README file that explains how to use it.
But that should be just about enough, I'd say.

---------------------------from the README-----------------
Hi, this package is intended to do several (at the moment only one)
stress-tests for you, by changing the way libc works.

If you do 
  export LD_PRELOAD=libstress.so.0
then you will run with the open() function modified, and it will now
test for open()'s of files in the /tmp dir (not subdirs of /tmp) that
forget to set the O_CREATE mode. This is usually a sign of a security bug.


If you find other things libstress could do, and you have a patch
for it, please mail me (joostje@debian.org). Note: NEVER wait more
than 6 days for me to answer your post. If it takes more than 6 days,
assume I'm swamped with work, and just upload a non-maintainer
release of this package (and, please inform me about having done so).


Example of how to find security bugs:

   $ LD_PRELOAD=libstress.so.0.0.0 man man
   open called on /tmp without O_CREAT mode, file = /tmp/zman26517aaa, flags=1101, mode=666
   man: can't remove /tmp/zman26517aaa: Bad file descriptor

There we've got a man security bug. Let's file it:

   $ bug man
   Getting package's info...done.
   Please describe your problems using man in one line.
   Man still doens't specify O_CREAT when opening tmp files.

Now, let's find more...

Oh, note: I sometimes get:
  id: error in loading shared libraries
  /usr/lib/libstress.so.0.0.0: undefined symbol: dlsym
I also don't know what it means, but haven't looked at it too closely.
It did seem to go away when I added -ldl on the gcc command line, but
later it returned again. Hope you don't see it.

(note that due to a security bug in glibc2 (libc6), this also works for
setuid binaries, as long as libstress is installed in /usr/lib)

Thanks!


-----------------------end from the README-----------------


begin 644 libstress.tar.gz
M'XL(`$!4/C4``^V[951<R[:_37`:AQ`<FA`D:.,.P1V"NS1TX]JX=O#@%C00
M-!#<@A.<X)+@[A`(&ES[S=[G7+_O_]X/9YS[93\]EM5:536K:M9<8XWZM8.M
MA9L[#.KF9@;B`+%S<4#<+)'^T7"!0/R\O$`D(!#(S<OSYY'K[]=_P`7BXP<"
M^?FX!'CYN$'<7+]3>$`\O$A`T#_<DO\&#S=W,`P(1+)S=G9S_W\^!X6Y_3,,
M^N?"_@=2LO**:L#7\J^!6HKR:K(R0%59+2U)>=D_;P(`6LX>,$NH,-#A7WP%
MH/N[+VR=G82!?SH-0,K6"0SS^?</J()MG=Q_;U"8,/#/G@5ZV;J[0SVA4">@
MZ)\)=M!7$*B%+=B)PQEF+0Z0A%G:V+I#+=T]8+]K`COY`+3<P4X0,`SBQOZO
MM7%S</W^@0!RM@Y0-V$@X+?K0*S`5@)"`D)@/C"/(!\_KP#T]Y6EE2"4AQ\*
MX0?R<_%Q_9M9?_?QWP/.8>T+`/PW;9?4UM'\>[/_7:W\'#RV8("T#1CF!G47
M!CHY6SH[>0(`MAK2NI)>.E)JVGPZLDIJNF!Y02E;62E-20TY;1>OUYRZKYWD
M/-Q4]7RL;!4-)'G!&MJR5A`K!3U>2SDW=1\7(8">D(N;G:2BO9RODS7$`6(O
MH\5CI^L(T=54UI)R='>#V<CY:+CJPR0-W1WDP;)*G!ZLAHY092T7!RY7*V^(
M,@@@J^4)L[50$I3F!WO+\O!I<BJK.3J"^/F]?'D]=%QE.>4XM61Y.?7UG%]K
M&?BX^FBZ:;]VM?)ULO)6T)-2>6T@"%#U5;;VA%GK^EI+B@'$)'6U=?_6*[)J
M,O]=G_Q?>^M?_*/Y[^?&/[:._W?\Y^(%@03^)?[_WOZ,_[]?!'_%_W\&M-&8
M2.M:XGS(*`?&`3%4\KK'8E66SOV#VUII6_G&T-G!L4IKJV(_7_$&@63O;!,1
M-?[+(=K3,&6GI4DMGLF5#T=YK=:S[_'%QSI?HBK?/UE'PDH@4``^2DE%-85$
MNS^A<Y<"AKHCNTMA'L&07^:*H"*'^ASK7/3'7!W(P)Z]6U3[^E"F5V7ZQ?=B
MWT/'XZ)%C34&F2:\[WOP+T*3$>9I%I(BT%?W`A6O4=`/CBHBR^DH79XUO4K)
M2EW6/4`9<ZL+;L\`@$R+XR:0;#DA'B/O5TWKD@JB>*[]HX?-1TV=RRNUAZKI
M4IUYA%R]-CNX4I?]9?GG603M33VHJK9P]6P$KXG$]6M()[[4CI_#)(`*CNG2
MB<(*\^>$:(Q'I9.XH+=5MHZJ2:195X`+B=C=6SHWO/0'#L%K,HOENZVB;*4L
M?@NT#AAJC:09![VWAHGL^`4?:-,/##Z++L+RWSK#CFJH//H8`C^/&L5MDSSD
MBA2/<7[:C]F</ZH>G2=>]VPB<,1_Y70\R,7M;LVK=#AGNA7')1>TZ=%OZ]C?
M$0=!LW1P)-VB4]2AYK1H7W0*=FS+PBV*3%]&L<ZDU=<8K[L5'4_XN&EH`G)<
M=3ZSDFD497T6[595&I/7$*?JT'PS!@3LB+_+;9:SQ6(;SE+#PQ:@*!ZKJA@M
M$2P%C5*P,<G`%6JD4"T=!9:.=L>RC(QL/Q@^'#2+OO_:H#;.+AG860!>8[!C
MX@X3)*HK;.>H.`]B>TH)G;1KP:LV1"EG*B"M)X&Y#L@)V2>0,NQ:-*!O249H
MQ#'SD[YG2I/NWBQ^KYYC8"(N(-!OZA<;*;?322[:*C&@RBGST.4NKC,*K%PJ
MZ#2_"BX,D_]\?]!]L)3U.>FS]`:F9;CY=R*<LI\XG<?Y>-KSX72I3/;<E'*$
MSIOFTF@NP/-[<&]AZ7>P<-QPG@@M-O0]9?R-%.^;M+8]4>5IFJHT,\_\+$9A
M:5.!:$1EA]^I6=D[N].SU4\_?$G<AG4L.1^/OUX4E-GW,S$R)IV'UJIG#&QU
M!'0T49X[JS5K-0<4WM\(/)YV8UNO2E\WTR(6Q)N^W-SF"41XF=S45B\45YIV
MW=U^M#]^N*JWGUW)G4KQPF]W61\]PQAO4QRTAP>FP(_=<IS;3\<YX8Y,/AB2
M*QV(4XVG::V\/NO[*0_,B5LF/E<3ZNT\;;O?NZ>)B;FV@:]IO'_GCQ@S!@Y)
M4#=3B%4:/PRQ`4C.R_1<,,NC]V6;E8G=E?D(#T72YV0UE`QK"A7+F3O*3Z2C
M8!BY#5M"'[JLUZY">Y_=!ZILL)+?GY'?I^`\EN$\.J'/,FK>VZ$C+-#A0B$=
MB5VKPVN+XHD;&#SZXVM6Z!U)7<[0DT7R>XYU#"P$VGH$)CSYI!@+'G'2$XJ(
M/:$/O3J4OB?OSGDARCF#&WH6&D_`05!)Q$%DRLB6RF$?*CMUS0:.!3&5$],0
M<!`'QE:?''`2/6.-RZ%W('I$Z<;MABM=*W;#I:]?=J\R^FO/99QPK?,DO]7#
M6E6\IEHOQC0#WK.MDV)U*%QK=#MV3X8&=/.$<A*+JUQCA]+2W_.$TC+=,W1O
M'0U5J1==WE-WRV,B5B!VBQ)9*HYW3,DEC@@8=_WAJEI1P\/,[^0K)JW%QWZ(
M74_`G1;EBJ)WY(GTG5;K*(&X;-.K:X&P'.+`U!.-[G$L(T)3XLUHE[23X5"_
M4$Y"3YD3.G_%N:@3]/6R4)/N#IDF]6L!3+]0>-K)FQ.1.RT).!QN5X98REF`
M(!Q?JK\,^=U;V.3WUN3^)Z^BTGBNZW$>#W$>T=?O,!$/0>Y4#\-_[/#!<M=Q
M(25F8OZ@BQON=3,Z_P-S%D0T^;TN.EPL!,$:$JV5T938U9'2M3JT%C']U&QD
M3;5[]:DKMS3B`>>1?_T*RVQX(J=)K,^DFZG7F^D^YJUEZ.KS>RWRQRHB4\)?
M3VAU>U'W6M_`<4%B*'A8.`)0I8U6R`T)0_;KBLZSTR#4U<0NKR&:5_YIFNHG
MR^=+3900&C0A#)<8!1R.?!640-&SD0",P)J1CN1QJ@>"?7_.;RK?#TV_WX3V
M1B2U'(W^\,F!P8-I!]8BN(4EV-@CK@FW+8(E"AR8TA.I9Q5W_101:5BKZK?]
MPJLYWX3(*4_N?GY3_%3!=O[%)F_;7:2=ECU4K&.<U,:N8:+1?!^GPSVS)2&[
M+0YS;Z%AY?/#(Y+5Z&$^,MJH@CWJ@J;D;$RF1L0>-.!E4#T#FAZ#5:$`<D#)
MY\*]5ZX!5<.?S&_DT")H*KW!MVKEZ+6IJ8!,-HE,(_)AU;)/FG@CR5Y-J4KU
MV97E,=_L[%XX:(=>!D#>!(4H/"W3XAGVK3`TZX8G+VGL1><33BM]-'Z"ET@_
M4IRB$%HT&X:5',QM1"Q[`7AZT-0>EIU//XI4^OTR@CT-)?+`1)Z(CR,OV97O
M`(C6.K.=%B9G^)%PQI6S>^K71W\#,]BM+JF+0;_,$)5>Y-?**.'-\D*\SR:J
MVC2[L2Q!NJ7*[/P!Q;B%?>$-GWC?]U@MJ2@E''8:OR,8DR3H"V(E>%S/FW:R
MB)=D^:K3J]M*;2[%R;>3.+'SGFMU@H[_Z8QJWN8-ID:Y_C6@=E=X12[K1(0Z
M%/JFLI?9#UB8.P/^T=:]*</TE+P%?<>17Z"KO66E^A-V'FWGE`Y*.?90WX+%
M2Q&-+TOILT$$0@$T>I1.]4NQ@N#6]NP7PH=6JP`!&6P@(>PIF%?*I4A-Q*$A
MBYGW(JJ\O9Q=)S>PHA`;E__:T[B#IWKS&3M+!L>@N\)W:EOKPJ_CGDIV3QCV
MWO3N1/9I^5F79\\)U[M;[!9B\.R,S8$L)1EL]>WZFG`^T=I+J+QG-$)O%"9A
MBYR)"@UWKXAJXOCQO.;M>2U'O3TC5I(6GT7/B\A,HI-*8CE1A11LC"7^\3V=
MDQ0;XI9Q_F$+D-00\:"WJ-6M\*$MFE?WJU>XJ%,]F&(KY5BT**3U"YG-F(+X
M*%<,YK)P`=:;/A:ET!>705C-OB9$GU@3-!D8/N',4;^,;MG:TS2<Q<W`D\GV
M_1A5WU[X^HOPE-&,LCY7=>YI#4.*/OHUSS>6&]BR@IU=GGW$*][/^M+8L:BR
MN"':H:X'N-)XH\A%OJ669K4ZO&+#12A&?6])ZBV+#'6>QLP/=>JRQVJ;`P>9
MH8HD+Z8WQE[I=!UYD-GI-$:^+[424S_T>&\D=C2?'FZ5L&U2<Y'J7K3HWHQ1
M4DJGN;9)X"W;R/;2:(V+^SK+QLI8O=`B(F0*M!G%3>X'E!%RMA'83@5Z#UE8
MTO0<#DZ."@8.0%8!_-[F'UC30':\8H'DYU,49]M)+KU6<Q2>([5X[V";L+>R
M<3G&1GQ0K<XH%`G40UFCU'>AZU0G$?5VR9?3&]8X.]T\Q<M4,D$E:5IT7-E^
MCH78MECUT#"JP>CI=P&L+L\_;"G0JO%`T"*9BH5J`7O?%"*>,0876D8CI]/-
M?^M@\+-Q+"+Y>5&XD0IUQL%0Q+N%/X\<4M"`42E,1I@?>9.9KWET\IQ[8[X"
M+W6'@LL8+($THH:BJ">$8:?`4S@S%!\E?;"YIQV#GK`?23#?':(UKM?)<L%`
MN%CBAWOS]HTM.F2&CAB2$)_&^D/H-'?PW%F;0ZO[\@$W0H"Z8Y[<E__+S]P$
MH[Z\H"_6J?9KHA=R\K>=RH"+$`/T'%XEA6>F!#"\&@SC\0G*[#DT4\VU((Q+
MWK5F&[*!MG0-F9E81NYQ<E!>4#.088A,#JS"Z2CW;.Q5#$N]5!R,0`E--8"+
M9MO@8A26(B<\-I#ZKK"&VL7]%#2(PPKM"].8/P5/3%=W.<[:>KI(S_/NG[P@
M96?,=XGNZ]U.)%-2F]=_ONZ&<[/A^55D:\=5-=*K;#1(0Z^WD\+FG!DMZ@5J
M$@'2$XPN;/2YYF!/72<VQCST5[&RYH1H`G,I1G5[>,KMQ.H2CK5+D5J[N^FF
MY207%N0SW>N>M+Z`(PW@T1<R68+$=Q:=)I$+NI"7?;ID+++C\8+/)/DAF!\Q
ML=-X7_U"XU11O%N*%A]Y/"K>#H2V/1.AJ&K>(JD"NSH*I^0A#D*B8`9L?B7W
MA4O88L\G[S;J[T,'HJO([),D=BR)"WS[_'6NJ0<^D""UWW'O-<T1DZO<?4O0
MET@X&E=3,HF/K=]<DP8<3E`E\;]=K$G]AEN5@_1<PCW@RR[#8Z@*?%>\IE%D
M[.I7>J#RU?%27&O_OABN?S;U=:W'QL5*<>XQ8V_@V6$MM==@@]7V=NYJB\@`
M90>CW.V&617T[#(V94%`$Z6(23%^[HAX=EL]]N-5_$=G2F5:*N6RP<`NX?NC
M(`H:\C,#2S9'I96<U'OUV.T<,N4<"F7$A'X+G[A<[2(V65R4H5BD#<C60"3`
MP:?"Y_;ZM*YL-W,W-;ZB@I_$UX\%.=Z__]-;O<@-2:5CI/=1_DR?UNR%99N)
M2S6[\%VO_`$C4:WM6HV1K@(^$61Z"A(LQSEI]]*#5RR_`C0U*C>HGR)TVD)Z
MVMC/.J(NT9CNZ0M7"YC-^N^^=.LQ=:ZGMR%0W.=1WT7GCJ!.G3&TA<#L,60>
M5RY.11#T8T9+MY;FM/OW:4&[\*%,W641Q`5\"M$UL=WX^2,H[8L&@O(C3"@0
M858VQ>N+B-]%7*X@X.>S(P78/2!]&Z$5J=6%M?()#>LY`^Q&\0Q1N.PC<*<;
M;>84!9W']!+'RR1G^[.%3R4F0U*=B8J1<:]J:A_`WK$N.;7_0U@?Y(??@$?2
MA7=GT(H'O]#B981#9\B3^/#4X?`//\_!?--RAJM8TOJ=U0/6_`ICT@;IGB+9
MCE8^CN@\D/X=TP&#*;=0*Q]^S'O58MR^/6^*(:<[G)WISN4K`2&E.:LF%O/L
MSF,44E)56'Y":_9SR^;D$4!>,CWDX.[)CQ>&6P6*YJI=*/CC=;ABWDY:-X7?
M?!JZ^[H$M)VI];\P0X;Y#0M,.<<D;]QJBLJ='>MHV/)K7-G'S%\BJ3[Q:UK,
MC\5S+M-&4NESR6`EYPQ_!%7?L$V[$I*)U.$8-P[GL?0/9R*3WZ8VJMHM4NJ2
MMHS#I&E+PY*JN:_>)`U@%<C@Z3\I16ME9%4@D&QI.#$W1<7;X`)9O0E8I'%P
MQY8J;E-P;V8**W!@5IJ:F7!=U,37GHI*81$T5TRGJN\R=!A>>!85DDFX!_1`
MYO*NG'`.:Q^F-]76,6A+#.70^2BLXK'O,G;DZE=PB.J6[AUXTZR#E"CQV2_&
M6WO:LWD[MNY9L+AW.R02F]LB)4,R8A3QEHKPL\4[$$/^88_/1-]IN;D1[UA6
MOA(R[3V(\,,,Y14W_\39NM65.>K<-Q`9'UYDJA.(JJD=+1`OK&O%FYE8%+4E
MY-8L$_WV%((QB@EK_(2,3W[-O_@K@J-ZT@7I)2]-=.38ITY5;;7RQ$RI;)@H
M9G[E,."0F@W5!0R]F/O]=;X:D8A,X+X36[O8_L5%D.D]AN'(7.2]'@9!4PTD
MD.#5EO?#K2]IU/[3DY[NP.V;:4IETU??Q,@B#@:VJ5%C9V5AD_(V/TB5KU?C
M8MW$=#$ER,ZZF4FGGS<?O)A8::+N2Y3B93'I\$N6PC)S#;N>*CEB'7M#\DS`
M6=/%-)MH/1<C,V0UO+S))4"9@3@<:S4:>16-VN_QV=PVCC2<-6D22JWLC@;Q
MPC9:5\!3LD`C-*Y5TT-U=CJ+VW1])L*.BD0C)]BN%1O-SZJO,#3FHTWE1(W3
MWM^):<0K2":G,XP%%)YT<7/P.1"BX=V9TO;LK1MYK:E#2$..;H\I)"_$FR9V
MTS1F!45'%QVAPG(]>1=6G1-;53Z1:8+,MY0@C10=L>M-4*";A$7I<+NA.]YX
M.]9GJ\->*>%V.Q5=-,56!J3\EM5-K=Q;YA==0#MR84:$YKEWAU]D/PUYT&/?
M<W\Q-W&Y@VA=0+!A$+;DCJZ[XOM.5_>&/PG?/T3OE1*5E1A7ZX*06*\N=;]"
M74\SH;CSW,1Z3A7F8G=UF#\,ECO"%;.N^]&LSNT9U'BF,CO_"]CI(45=74)N
M]7$L[MVYIN(RMA""\RM<M&^NXG3<3J[V<1;'&*'W6=/1^?[X*]^M1BH%/-EC
M+\0_N5[`5[QH,X=QM]$=<1R^"I?R_'4_:W?]4*4Q??D546EL;1L$+OJI><%6
M7$%+G"KW?DEG%J6__UA0=0<_P:EY_^S7"XY5NM>BK@&YWIIBE%U2_8`%\#H:
MZ#G6;#3%/4;\O4?-\V&[ZJQY#"[78RF3O(J$"4B$V4<&*QNEH9\))`M!/`0L
M9ICE76\P/BLKTFZ.KE=BL<<8]CAY&;4?]&M1@C7Z5(F:-01'.?%/RG\N*+D]
MC.PO[&V3H)=]^L9P\#G*CYF&9!YFG(8F'8^'-V&56\ZQ(J1\^:NW,I4X\CF-
MRL=0\9*HNO,OY7.;>;&B'%.A.M3#ZWA6@@Y/&#E&T@O8U4@8W'U"<7%.T?NV
M]L)TA`M>/_6+.T&`J+Y'M#P+R(ZV*#\_,ZY6=N5,.NY#\#Z&M(9]*_+XF;^L
MN@OW93!!?+M"D%2T73W\[J:"]:=74X?[IH+7752(C..."B.#_M&O\&F%%83N
M[\CL_$[9[TZB%39:[5!5AZR"^X;@ICWZ"DD@QM4J?ZR:>+Y1U2DTQY*DA^9=
MYVR7*WGZ]XNM1>73VI25KTZN5D8T]JV\ZUT"7QU)W2CKZ@;\`<!1IQ_4J>4-
MGY0F9,:JN5I[WB=K?%>`><I@)XUN=C1('L_S^VCTG1G5II;[1P.&2UAZI&LD
M<QXOL507-,5)BEX_N<J74^R[2F3@6WN/E_H$$UDW"VFG.K":/2;!D>I,T+G?
M^7S+B/.V<ZA7MP=2Q479@9VIX^5X+^'LZ')P8&32/SH#AXJ>T5W!AW2,$2ET
M1`>Q"!-R1../>,3(TLGO'23^[8`$@H?],K-(8HT6"9G0-:%+#R8=OP]5B\CN
M1:.*JVS3SUE7X&SBKV@%."VF5,W2SZ``V@7C?[Q]\G.!OX=X>F!W`UM:N3S_
MY"<%V5YHF*++CV&")%1:FRF#WS-CK+MTS"X(9RV2I!<4-!)`&V^/LFM)9J2*
M+F"6G:%T_3HD>!QO=R=^G"X"5;Q$O904671D+*EQ@.?%,)/!I4=^2[F+H36:
M"'&!`QNR&#2NUT>'FIZARF;ZIZV!N%EV?F8W#1G)B%_7**E4C@7;1LV;+/X>
M:P&<U<`&T]614@F^A5HIZX>MR?+J8(35?&\SWEO&(N&+CD/CU6@*+H+`U8[G
M8<&`%4TQ.\D?RI*^4O;*+Z_:5XI:/+S<TNN-[F:O[A@-U(]%E21OO]]T,IU9
M<F>H,-:9$0U0R>-^H/P4'JA^#P<J&+?'2UPC?OXLN%^E]$%8B_I4W'3`@]];
M>$M1Y[NQ[X>K8-)]V![A>*B&]%P4P'%,<>]0ECK*#H%8Z.Y]GU-)5QN]6ND*
M9&Z2C*=82V:L_"I[1"9;#L/QN\4@JUN)I?(WC8WQ@B!2Q2\FC&>>7;V+DMBK
M@+?["O,;[E-E]$4$_"^3&F"D7WN^=P_2)U8V&VE1X<!LCK9;RR7-32FN-]U:
M;>R>5=9HU:4OC[6;RP':RQKJ7W/X[_9NS8NKF#,<])9?5J3,+U$0Y6@RJFB$
MB;[B)!G5Z`,G^71(C_I4<;>/EOKI)XP0,HD./%*7L7//`0,/]\OV$Y35-B*V
M>R1SZP;$[6CD2/-=`>GL/F#L3.:M0/%+YV/TJ1\'UKE5^=GU]D($&D<U&P_O
M:#^/#N\>JO(SAZ+?U_PP,Z,@+IWBG**9K(,:S"S34<::QFZPUPY"NALT;(90
M-*OHR\0K1/F.<[EMA>.QG!M5DZH2-V:ELTD.^(@3U55&_*M5Q[V,9YV6KHLI
MY_T6>;7!VE[CT7&3O!_5M%*OJ;1IA4T7;`B,&MD<9>FM'2^C&7IMS=D8+L0U
M4\/M.;T:+LEHG".3^Q9M8TAC9.LW7N1J&D2G]X;91Q3%)"6/`2R5!P]O/]-P
MIX;@CG.MIJ2T[J(/NPYY/?ZR?6OZ$A`;,_KU-4-6&^"GQA'Y!Q-,SX%C!CC.
ML[JJ5#QPTM*FXDZ0-':%.9#2FU@!/WZ`(72@)\+E'78R(FW,<4+JFO9)9N)P
M#H-:_1GZ4=B,#6OF#F`XYH,&;Q`'[-8D,L,X@%\)=]U349A[$:\*O[:,!']K
M!WTAQBD%EDOY+GCEQ]B&K>AJV'2`!=/47-21C\-M$BI5;X`D.CO'^P]T0?V+
MDOYT<9(9^C/B;0F)U'YL\S(T:O488?@VM09?3CFWR*6R4$88`BE&7CX%A$GE
MO6;^+X<-B7YG!?7+)23O_^M%B+_X/^,_K?^9V?((\G-8VH"=K*'_L-6N_TG_
MP<_/_6_Z#Q[0GW=Y!?Y:__MG\+_1?\@YPQS![L)`+@X^@`S8'2H,U(-"V(#<
MW$!)%QB02TA(\/>Y,!>O,)\@D!7$#0+]-XJ1_RH1^8^*#[<_<P#_<+__K"Z1
ML?V=P];"P_W/-`^GWP-FX0`%Z,"LH4Z6?Q3I[/6_T)N\@GDX6#I:<CA`;2%0
M)P\G6T\.)P=Q@`S4S1)FZ_*WL@'_9AX0R`[4@X%=7*`PH)4S#.CL`G5B?@ET
M=P:Z0W^7;N%A;>T#Y'1W=`%ZP7ZWPHWC#WG('Y/F/Y;"_&<37OZKU2)`C[^9
M+?:'U4`.P&__9P&J0;W=@3"H`Q3L!OTW<8N%$`\$#+6`@JSX+7AX+"V@ED)\
M%MR6?&`+2^@?4P7(][N_(;_;Z/#;NC\:`';X+U(7B)OE_U8E\S^4]'?1#)#7
MPL+24D"`B]^*2P`"`O%8@:R$+*R$H)80/C`WU,("R,_]/YKUMR@#@5K\8S4X
M\O]1@V-C(?F:T\+33L@=RN<CK:#@8J-AXV.HK^=NZ:T@Y>HMP`V58Y4&V-JK
MVO-HV['J6>BHVWM[.JE#7>2D5)0UG;FY+"T=E3RUU6%Z<M8J<@(&K.IRSMJ:
MAM:""JQZEHZ>GEJ:/LKJA@`82%U)S\W!WD!+TIK+0H]?7Y)/60>D+ZDNX./B
MJR%MY^.B".)4LK;S4E?7<N"TX)=7T;&5\V2%*+EH6SL9J,D`+%2M;+DL6%DU
MM)W%`&+*%KX"_T0-SO_?R/PCZ_B?]!]<_S[^@_C_T'_P<_'\%?__&=")@G_'
M87'`W[1X[!9_ANG?HR(HQ,/]>Y8+"OT^!_TY3J"_BS7_'$L@+_!?,`=P<X``
MOV>C.\S9X>]AXG^1GT_H7_/_H4%!T_Y#@W+XS<1Y$O04?<WX3J]M`5?:(D,K
M$YWEE?9GTN1P_E@LCF)>(451;I%::J6;BSER&V2L)A:B#5'-I_`/;@[%Q8-=
M8(YH4?E@A<=SQ$S7\_$H'_%D;OP'"\8Z5)]?I#%C:<\4RKD>O7X^\B+B2V,N
M9\XQ1A,5F]/'X0^/LJF(Z\>,$6M9Y,%CN$L:]*+&P3;2U#&[<2O+6WWF94%:
M0HGH8.^0;O8O[9MOX=#]O;HP_<E7+9Z3179T8^Y-/>W%MUO9MT0SD/&^14U;
M6O%:Y26*35'/(;];F<)3"XJFC[-\CCHE6I:+>G2%9>44]^^N0]@C@M@H+,%2
MI9O])^@?I-(/YQK\LFY;GXA0#L%*.@U"OI!K4%)]V^W2CS^[&-V>WKFWJ$<W
M%:=B]V!,D4=NQX;VLHM,7U47Q$U[N%[[M5A-Z92C>17IQN;?8BF92-_<L2\<
M]`:(X3.(PT"X%-/)(=^UJDM&#`VH[#?7OSK:J)=MR`AJZ?D2TG_>VGQB<A_F
M2"K@7,E?]E-51>UEI0C)<^$8)YS&-GFL8D/JGM!G.I9-X0%M:=HO8KB^DEG^
MI]T!_(RD5("@$(D9"0D``;N#_]4)_A=^Q,</XONO?G!@A.W]5+;A""LY@@B8
M*XK:M_[27,'*ER9#!1/XPAPHA4-W&L2?G*'(#>$64QM'#6Z-DI/%)/0WEI7=
M+AF8[+_XQ9Z_$8493"1S"MC?L`JJ?O,)Z$(ZL^166MIJCS[EUX'??.1EVZ[T
M4+Q_7J*UFU6Z7\+"S1VV>L\U/V+@V:H(6K>,&R8'P^;8#?@5/`E_L'VS(%3Q
M7'\NJL&P@?=>14H_E;ZC]\K^`I&OKHUE_=A^[RR+$*&*4W[LT'_$OQ[F@>L]
M-J8[ZBXR(,Q4$-*:S\$Y^1!F6#@YPJ2)GVW'[%>'#=^BH^MCXP*U0?"@_R"B
MX\;-.7"=.:0K]YOC&JTF=FRP>8C_WO1GJG#Z*1R"2J(6S'!!<F>F;^_>RF2^
MVA=`_E*#K7J'FIFD'X!L-9C0\IU7/1?K9YY!'GTAA\HE"?)V?[&6<6MDC`3:
M]Y0$X5<M5)HL>_W-ZO*IQ:[0P?)ESQ@G[!*W);]#-,F?9U`)2_GR_O8)SW9G
M63'QP_Q)QD#QT%#B(_'7M5'GK(J=S9683VL(;KG!R#_-"?.T0A67[C[!A7Y)
M/SCHF@WNFYI[)I$_5`9]KX_AL/!LROF&0H9PD#NV/#>6H\QH'X?QMG?PQIGV
M_,@[>!``DC#N/:R^X>J;W_TBZ"M/Q:[@TQC7NEX4G!C,V^)R_Y82\/&T0$YU
M@#-1R8E,(YT3*TG;@!Z#@:J-$$L!/D%+6`@80$T?$A6,%@I]X^7221NC)JWT
M=.N-7I)T>^X:+K,''W(0:!=-C(]N1$P'+,E"AO_\2[N+/A&+%!@.TJ2[+LJ#
M*++@ZRD[59&FOU#GQ7F*9%8]0YL:$BPBU>R?8+GC(;_TVJ2265N:&>`;-B?T
MS`'C037XC7(753`;B9L[QPX!Y1TP,*DK'-Y#%=R"YH;929\NO188(42&0-TA
MZ"SFBN@4B1:B1"*V/LR9"%Z[O%L1P8DK@?-0ERA8#-,GC`K/UY(B%Z['U=7%
M+9V:_OSY8W2&X>5(6H6RRPMP*"#BLKZ[#C6EK'M?6C7TJX9>6%@$/U$+Y??K
MW0G6T*^#!8">W0DI*?KR[@01WOB)@,2OMH\3.%*6.BG$>P0)*@C-"I207)38
MB^*\4BY(>8[5T^<EN(H5JA?O8R^DPWY$RJWN+1[WQO'*W6+'4E:*%".HZRO'
MM&@_<4Y2SD51P54<WQ9-=_B@\KWU="S/@9?7U]LHV0_SO0:5T43_%/CX+I5/
M1>6E$Q!BKU5PW'OHI<0LJ&M*G9B&_$O-D28N>O3-RZ^U7V]W7UL,&TGD%4YA
M",B)J`XZ4#DRVPFI*&GF%AK9]O1.;=2F"C,+^8O-TAJNZ'>0R?).%1Q&&8IV
M\O5-U")QFQ!7P%N$X>K2=]G`2Q$CB4.',KN.N@MI(_AR(.OZ1;BO,0D%C3P3
MGWMFRLQW$@JH7.QN!^6U$>S<EWN#FQZT1)`A>O2J<Y=O4)(X-:/HEEX'QFM!
MP1G+-M:1UZM-[Q>P5P2`=UH/\5UH(:$OI2@Y20AE:S]I,H[5>L9J5SG6<WT>
MGO",+O:--DX)E2;9]X<$&IX/<)IQL(_X^SL)J#U@;/9P3C2V2KQK)O<&RQW7
ME>+'[>3(3")O`]ZZ\!O[.9<&-8]":6/]B?`-B<]Y;D61%5XO=VTNRA.2E3Q.
M2K%I(S3&Z6+J4+_CA-L+W8,B9F'>V!'X+MX)DOV2>./K)Q1XSILGDG@(T@@M
M8O>E^)X^JLKU$S:\JJT3X>"JY][$7<M8*XHN^,$=+](#VSX3+"6O):.:*;M(
M4?:&_/!"[X(X/?4E$DU?"T*UGG`&!N^I?P2C3G).U:`:8;:'F2>:XW?I!D.#
M'5'5F=(?6S(4JZ/7]##'&*[9@R.([KFZ>C!7I$]<[*R#Y0G\@]?\*7KD>AE0
MHU'3"+.43RI028F6HM>X@_V(C=5<:(/+L(Z4)9*QCN0[R+&.U%U0NB"E!!]X
M]R_]@]9^8IDZ33G>E6HT'KZ76VYX']OBZ$7FL1@(_IVH5^"TV".W',X4VX*+
M&_G6#=,I[=-B!7;7YH\KTB[.[X),WCB_3>S7-"(T5G`1[SK'+GMK7LL(\"(X
M8&J*6GLYI8NJ1RP:LH;4%8LZ2R":LP;L&L;$([SWS:?9A:M..7KP:C0.VL85
MJR?%#0N*ON\YAEWC1#@."J<*W5-%-!+Z,W3E,/S<_"1D0"N_2CS2[J)UWK2?
MD-_O#P_.89K[D#^<,[9N0!48T;,*:YJ%+K5UK:-1/0;W4'/,GJ+BW6$]9HXE
M&]_8X1W379-U2;AL9SAZ^%-V%>QY,UW+"<<3WK_H\J!"V*/N:MR\N=L`(#V*
M(GG3F6?=Q?/$G#T8A+NR<TE)TMR12+LRY;T/K]IRL=YX$M4*4,/U(I9;3TJ,
MLM>0_[58+-;3%.CQ9(D6LN',O[6*"2U5N3=Y<WRI+IO=FNSZRN-H;&\I^X?*
MXO[8WGS(?5'^M2'>U8;[D32;O*L$N#;\#MN#HCUNCBODQU+V),+N=C%Q;REC
MT@>]ITGWZ$GVA;-+?((!<0PD]8Z5=:TXH$B38?::NWB@EFBPW+4G3>)%@%[H
M(BV7-2"%)I[99RN3P#_+FP?5W%.6K1FL/&;^S6*X5J@"[SV/?(B!4'#Q$+6G
M;.]2=;KE6,W;UT0)(2F,O_(OTDQCT$G@4(+V),PR7(-1H1#V@X<Y0S_CBI70
MD"G]D5T_V(C!KI\W><THA!!<\YQ-@AXEAB)N8C:K\+TNU_#Z2%>'H6/YN<,"
M5L2R4ST*1D7>3EUZ)&;TCT+&*5/(]+/;4IL(4E;D6LKLYQ89N$IH553L^->Y
M;^<6(V4+W0R%N"K1J%_DVJ.TVVK31XOIN88''+T93G)2:XP2>J3P8C`O>QLZ
M5LX?^=5S@G^:I0+WL\DS1^.*:!WDBBV(X=10(.=3Z*YA[7HC1%NS51'30@1$
M2F?C0O!V`_@4LYUU_U+I!U>N]L&K&`G+1(+1YI#JSI]E.C?Y@=WAW2P>/_"'
M,#78`OW*^B2O/4PJB&"R:%*LG4@]S"(R'W-GHC9RCK0B`6&Z;Y^!JEY,!P?(
M<LVJ&F,&(FF).)B;O%:;?K;ZRZ;4R`TC\C7!Z>SUE%5*R7:07<H)*B1>3MO[
M(T6CIJH?4NB&-&&#,5IP27>9PO;CVPVBPW*?,H9^O$.CD>?3N0MZQ0W'^#Y3
M-%#L+&7!")NCB>P\RARO**<GDFYOK-Q&-UJ^"-G;-\RP5\P;G`&MG<;"L]#0
M*BQ;2*:]7@7HW'U:X9OA&<C:DN4Y9&=@TW=R!7I^ARE!+)MU(`N*%));@@ZE
M8-[GRIAW+`]*O:0S*5I2XO%E,NZORF7LN@)HTE+PY'*#WVGWT^_:+T\&$P5U
M&3RW"D(J)NIZZP7]1A9"X.''7NG0N0=R87K"^K5U^,.'PU>1K_+QC5^S"AL\
M<45+%7Q+M$5=+9(*B8XI3IK(M[%T3V]XN4`]M_\BZ#.K5*ONMQA<%&P*6C\+
M/>@KT61NOY9IVTE#EOX)W=P)*PT^]X+$-9WWL9\P-P7)=/PGV,UA^\(S(/Y6
MV:UY&?.Z16U9,1:MU)#V3[4&0:/@.-O.<%E^'C-(?S[;-/DGEKEE+.E1PH3G
M'G0YPQEJMY0)1;HWP32%>92]OYZT&!4)\0#1_"5SJ?B5)&-Z>I67D^A5PMZ"
MD\=M(K'%E$J>8&B_PY:5*R7$K#,&[0?-RP->]4H60G;QNO<:S-L*QVACRETC
MR@+`>I'3,77A3\]54<38FT/*K2C>)FG25+@8R#+7[*AIG:1HH(7=<,R05%LH
MZ+[R6TBCDK1D?A+(,$R7>(CK$=MEJ._6ILE,Y!FI:_+6\`C;MR9+:5)I>#D*
M/[J.6OANJEIB8]).'^<G2?D3]J0+BAG4:!NV"!J[8'WS2=+JX!I+?Q[//I,R
M`3;A^O#AY0_[-@IE7=>S+Q*]TIGY\=+W2$"-PC@N&Q?2D+?[!.FA?AT$;-QD
MKZE1]M=J/DDCI3%GX7^^CF@4_0;R'T3+YY,DBQ1$!Q(8`%M[W47T^S*D=STW
M3"F-GJ_QH+!DO\;B5H@Q.B03VL]=OZ>L,<1:3]RVZU#_-:PIRXMIJ8+'`AGR
M6)MX==Q<;D`@.K8$>(:2C+J!D49B\=WJJP4%6M0XAAM^Z`?5D8K7TN9)2-@T
M<Y/H/_-'PT?FLYZ7._(FEO6BT_*>L"M@LJH5@(K<[.B=[I%KA!0XYY@Q\K9D
MT](KXF"F`6G3DG+"@8G;F(;6K,")/8MN7%8Z3J2"6JEPR;0PZDOT>TW9"5SB
MV%$L5J%#KI>%X,2*,-%G+#')'JE/UX7#_>TDI@\#9IFC"6#RI0.L=.^U<E%8
M(73*+]]AEK\84>KF?TTN)UF"B^,H+XV].X`50@4^'TCDF'SS;9,1CS>2W(#<
M(OPB..VCRV*"E7+X?+<CANDG;CKIDK(G7M(T6)-M2K(Z3A^5!DYFT$Y#0[<2
MJQ,(+]&X6;8QT?*0D&!+4G1"OP:`3)SDX(PL?\A$QX>W5+IO<LD)D8B6^0+C
M$S0JF>?$I[M-U#*#U#<HS`B:@F&]\I3T5(C)8HQ%"E5SOSKU:K=2U*-R@!9G
M@\3[SDL'+E7^B2^&*)M=JXLH\X^.R(N;?5-4C7HJ8XWSS>;(B\-]$`MWOZ.8
M[WVGZRN<1>LQ:CO7<MSSB@[CY%J^2S>TXFA49J6)13Y4.0NKKE2T'WY:&$(%
M]4RQ^B/\EM(KQ=5;&[G$IT029+1.?0XTQT`+"5EH=0%NIA)!V:`2__=OG+4T
M#VB:AIC<_!>#G._&3Z9A_DU7C[9)[1)CB]M.,[/\!R-(XX6[KM;]I1(TYCZ4
MGG+-("'^HRE/:]>`?HR;J*0+-WMZ$?ET2B_Q!VI4K*/C_D7GP*RVGW[58@C!
M=EFVP"F>H&:)GBLBK\#8NT<WH,+H2#QU\Z-GS.2QX(#?A>@OG*6Y;NN02$"7
M6/;/9E=W@ZPVW``T.HB@WDI*>0#Q,`(]9!X)+PHD,1ZQA)0+NO&W?G'N(]7:
M_^JC,"Z+*E]V3NZJ&\&<]T?>BPWDV*((MCO>3!JK8@J=3$/_/#FMV*@D[4Q#
MX=QOYY_M+$E3G)3'.7DST3L]8XL$B,2G?UPBPQNFPY<\)\9'%GN7[%ZU6%(M
MOXQKEY*0?GZ>8FC\NL6-"IXFV&)/M:S:*I#OA%K<%Y-X;%03:)9ONAI20/SF
MJX^[,BD?H^;@7L1+Q2K.M0,HTMUZB5RR7"/]89D77F!E@*D$IWS!_5[6@P;-
MAXQ#GJ\-'8GVB%.R`,U!P:U%H]'KV!A$;),(M7/_,OD-\&BLM]_5B_^R=WE0
MD,`+8[.U282!:?/(^_ZIE_R+ETZX"GR]*UT_K-Y^2?X^2>#77V!&!6^ANQP;
M?MMT^RU</R`:I\9+C9'"XOCSTN]G>C;X>U?R(E<C+D+IE5X8:B2N=SG2&Y3B
M#&P?O9$1EW[AY4[Q+HZ-W(QM.WXX^<43"?`+Y\]%16J?$GIH<IXF,G@ZTZOO
M;J#Y"$F&?JPVE\(Z66O$3^XU-">YM^()M+#2S[IE?_H0C-W*U[TL%OG%*7^%
M.R_->,KOY?XTB>][AIU:K!NRR:/"";5LQ#-<4^5O1W4$@1>&.,UXQ'Z#.]_/
M$-N/NV&./<\WR'L0.X]5/4D,`,;3QK9WOGN/Q3OPJH.;AV5$@VD+(H#KH2K'
M_9'FGG/!X5+Y$=%QVB&/-QWVD**3&#.T1WKPV-%C=>>#,.HM%T0LCAHT*%\A
M.+^Z.4HK#:UC21]B.?)V8`_U9PQ/2K`M<:U-;[R..&['*L9?:6$XJ]]@IST:
M&&GRZ8P[#T(+Z5\Y_Q;*F%?AE6&_]_VQ_1$#[_"XI5S8@2"KJWXXPOBV]%:/
M!M%W(["U_`[>A8ZHBH=']Q`B$'`'J]:;[]<=39LYMR;Z8J?Z'CGEG^&5/L7W
MOWJ_W.E"&1'>9E5%^]1FC('?KX**ZGGLBYV832X,;BWC\HIG:'[6W$:IQ2_5
MU=X4B2Y65PE,&8S[\WJOU8@\Z_BIL&)_4P3M#2HZF3-*\Z)Q\[P;VQL_4,T^
MV<B>7)18OCHGN?)'['[4L^:TGQ,_:1%#4Z;-^?T*N5:/G_JL8I?QQ6OWS&C%
MN,-FL"B1=>=^[V<:J4[ZV9COSJB$N_EB"0]/?.#Y=-=(K=X'9696_6]T);-O
M]2*:XW#]>T%NTCL%[0%6)2_3?;4<F=93;,8PY&FQM1V7.^I74[-1^)=I`1++
MQS7V<1R?J-H")QWOC@V:1!`96Q7J#D>!U?X&LPUG")Z$AFJ?Z<3V<?SKR8P<
MO':O7]YN>Z@,\*/T)\Y^+55J-'=;EA''M!='Y=;L/Q'5WK>)ZW"G17XFGYN'
MQJ6VQLW;MGH)M1]U,H%>>H-+BW'4]9?S8@8^7T:$@,:OS6X<M,9[I`/91`.7
M"]3;7&ZGDJ=3Z(G?4UAAW%'#F9N.3&\6BN+R3"R_G)4NE@?>Q*:9MG/R"N_K
M+^R6K'TZLF7U&_=V.8"_*/YR/1`YZG6#8GF+8V"4T>HP^&WKR;#ZTISEI[N5
MH^,&X>(OPMYFOZ`F$5<$?N+?$1%$>7:WRD:U$0JL)#U[>Y$ZTWI?.#B4/AVE
M".S4YVO\#!]=O'MW=G3P\@O-/6RY*(WB6&3BE\_/(VMXYNEZ=_-X>7K;?7CY
M^ZH#HWV3^\?.B'=:EO$2*1(<W%Q?/GML9NS`RQ?Y`Z\<S=066QVV&QRI/RSH
M!EY1>E76B^P(TK07;>RM%`?.B;/).^V]UA:V6`ZV-J116A6"NRMO;!X;J<MG
MZN)]N$H+%I+<'0@YAC<@2BZ\J#D?\P\VC3#PYE-$+KMV2%@_S/%9G33./CQ\
M5+TD)1+A$+G9'F+/60YLNP^".U]=N"'N2P0?9H;JLQ?-&N#S`6(SVVT,,X$M
MG]R'&OI#H>T<(@++'[)K+L+DTZ9P83BD^*BK/D#]7RN[[%I>_J>66L>C7M/C
M!F<Z"QC#\<7+Z8A\O]G9`H?#.'YAXTW3YB^N:YG'.X$-]%><JOAP?C?)3VL?
M&UO;ZFR\ZKQ&9^!LCGYG&0-R$6!?X'&FZ?LTM<>=HNJK"JTOR6<[\#O?J(<Q
M-6O&ZQE]+X%R[_,C>%FZ[?S%-_:SB'$.L8O#D%]&K(#AKX%.K;+7FPL[#(LY
M5+4^QYZS\;9A8FE+B*]\G!QF;.KB[7F?W7XQ47*NN@QX!)P=$(\V5,7)/AN/
MK(0'SC$E&^IYB'G;]79>E"&;?62\2(BUOA(5S$?L'(W'W1P+.50N?SE]US@T
M.4(6E%-!:_BELEX((7R[<?.SHPV^?0>/,EN\N=CAXL]L1'`3G7W7<OLU>6&L
MF<Q-?,9<A859CXA1J3Y'R`_#?1L1$QO9DI>]BNV,*(0SV/5WM'NC%QLM`YH3
MIU5TM\+Q-[5,B>('I)?JJV#'#'>CSIF;SI*GC;OS+!N*:<VW8H\^IE5BSNYC
MT1JW8^-C^,^M8HMY?(FA6?%;+R1<:S+/JD[*=BM/]K*:'R=W1_@T2>$NU94!
MWX(:G9G"(XZ67(_N9L/D*R.I)J^'[N\^W#:T?]N99R9#*S!_&A.L`0+(=?WM
MXC4N$E)+'ET4TFLDI+_^0_X7?_$7?_$7?_$7?_$7?_$7?_%_PO\'[)95U@!0
"````
`
end

-- 
joost witteveen, joostje@debian.org

The upstream maintainer is allowed to do things different 
than Debian, but only if he has good reasons to do so.


--
To UNSUBSCRIBE, email to debian-devel-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org


Reply to: