pax_global_header00006660000000000000000000000064152065161750014522gustar00rootroot0000000000000052 comment=0bd3dbf050d651847dcfdf2026a78966985a7cbf jnuyens-modulejail-06d8d74/000077500000000000000000000000001520651617500157025ustar00rootroot00000000000000jnuyens-modulejail-06d8d74/.github/000077500000000000000000000000001520651617500172425ustar00rootroot00000000000000jnuyens-modulejail-06d8d74/.github/workflows/000077500000000000000000000000001520651617500212775ustar00rootroot00000000000000jnuyens-modulejail-06d8d74/.github/workflows/ci.yml000066400000000000000000000031751520651617500224230ustar00rootroot00000000000000# CI for ModuleJail. Lints + runs tests/run-fixtures.sh per fixture-tier axis. # Spec: .planning/phases/06-release-hardening/06-04-PLAN.md, D-Phase6-06..09. # Five named jobs (lint, arch, alpine, opensuse, host-local) produce the # five GH check rows that D-Phase6-10's branch protection list names verbatim. name: ci on: push: branches: [master] tags: ['v*'] pull_request: concurrency: group: ci-${{ github.ref }} cancel-in-progress: true jobs: lint: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Install shellcheck run: sudo apt-get update -qq && sudo apt-get install -y shellcheck - name: shellcheck --shell=sh run: | shellcheck --shell=sh \ modulejail \ tests/run-fixtures.sh \ tests/lib/*.sh \ tests/cases/*.sh \ scripts/*.sh arch: needs: lint runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Run arch fixture run: sh tests/run-fixtures.sh --only-container arch alpine: needs: lint runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Run alpine fixture run: sh tests/run-fixtures.sh --only-container alpine opensuse: needs: lint runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Run opensuse fixture run: sh tests/run-fixtures.sh --only-container opensuse host-local: needs: lint runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Run host-local cases run: sh tests/run-fixtures.sh --only-host-local jnuyens-modulejail-06d8d74/.gitignore000066400000000000000000000000451520651617500176710ustar00rootroot00000000000000.planning/ packaging/dist/ CLAUDE.md jnuyens-modulejail-06d8d74/CHANGELOG.md000066400000000000000000001231161520651617500175170ustar00rootroot00000000000000# Changelog All notable changes to ModuleJail are documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [1.3.6] - 2026-05-30 Hotfix release. A third bug in v1.3.5's `--verbose-logging` install line, caught and root-caused by @retry-the-user in [issue #18](https://github.com/jnuyens/modulejail/issues/18) within two hours of v1.3.5 shipping. Default (non-verbose) install-line form unchanged; v1.1.4 byte-identical contract preserved. ### Fixed - `--verbose-logging` install-line emitted bare `\001-\010\013-\037\177` as the tr `-d` argument and bare `\0` as the second tr's first argument. modprobe's libkmod config parser processes `\\` → `\` on the install command BEFORE it reaches the shell, so the bare backslash-octal sequences were collapsed to digit strings (`\001` → `001`). tr then saw `001-010013-037177` as its argument and rejected the `1-0` substring as a reverse-collating range (`tr: range-endpoints of '1-0' are in reverse collating sequence order`). The pipe failed, `pexe=` ended up empty, and the syslog entry was incomplete. **Fix:** double the backslashes in the emitted install-line text. `\\001` in the file → modprobe collapses to `\001` → shell passes `\001` to tr → tr parses as octal NUL byte 1, as intended. Same for `\\010`, `\\013`, `\\037`, `\\177`, and `\\0`. Verified end-to-end on Ubuntu 24.04 with kmod 31: the resulting syslog line shows the expected `ppid=$N pcomm=modprobe loginuid=$M pexe=modprobe $args`. ### Credit @retry-the-user in [issue #18](https://github.com/jnuyens/modulejail/issues/18) for the real-time test of v1.3.5, the `tr: range-endpoints of '1-0'` error report, and the diagnosis that backslash doubling was the right fix. ### Notes - v1.3.4 and v1.3.5 had related issues in the verbose-logging install line; v1.3.6 is the first version with `--verbose-logging` that actually emits correct syslog entries on a stock Linux host with modprobe + GNU coreutils tr. Operators on either v1.3.4 or v1.3.5 using `--verbose-logging` should upgrade. Operators not using `--verbose-logging` see no behavior difference (the default install line is byte-identical across the v1.3.4→v1.3.6 patches). ## [1.3.5] - 2026-05-30 Hotfix release. Two bugs in v1.3.4's `--verbose-logging` install line, both caught by @retry-the-user in [issue #18](https://github.com/jnuyens/modulejail/issues/18) within hours of v1.3.4 shipping. v1.1.4 byte-identical install-line body preserved under default flags. Default (non-verbose) install-line form unchanged. ### Fixed - `--verbose-logging` install-line was wrapped in `/bin/sh -c '...'`, but `modprobe` already invokes commands via `system() → sh -c`. That created a second shell layer, so `$PPID` inside the inner shell pointed at the wrapper sh instead of `modprobe`. Result: `pcomm=sh` and `pexe=` showed the install-line content itself as the cmdline of the wrapper sh - not the actual caller. Fixed: drop the `/bin/sh -c '...'` wrapper. modprobe's own `sh -c` is the only shell layer; `$PPID` resolves directly to `modprobe`. - `--verbose-logging` install-line used `$(cat /proc/$PPID/cmdline)` to read the cmdline. Shell command substitution strips NUL bytes from captured output, so `modprobe\0cpuid\0` became `modprobecpuid` in the logger message - argv elements concatenated with no visible separator. Fixed: pipe cmdline through `tr` to convert NULs to spaces (`tr '\0' ' '`) instead of relying on shell substitution. ### Added - Log-injection hardening (defense-in-depth) in the `--verbose-logging` install-line. The cmdline is now also piped through `tr -d '\001-\010\013-\037\177'` to strip control bytes (newline, carriage return, form-feed, terminal-escape, DEL) before the logger message is built. Shell command substitution treats the substituted text as data (no second-pass expansion), so **command injection via attacker-controlled cmdline content is not possible** - this hardening covers log injection only (attacker fabricating fake log entries via embedded newlines, or terminal-control sequences appearing when an admin views the log with `cat`). - New `MODULEJAIL_TR_PATH` environment variable (test-only plumbing, parallel to `MODULEJAIL_LOGGER_PATH`). `--verbose-logging` now requires `tr` to be executable; modulejail exits `EX_NOINPUT=66` with a clear message if `/usr/bin/tr` (or the override path) is absent, rather than silently generating broken install-lines that would emit `tr: command not found` into syslog at modprobe-time. - New acceptance case `verbose-logging-requires-tr.sh` covering the missing-tr error path. Suite is now 34/34 PASS. ### Credit @retry-the-user in [issue #18](https://github.com/jnuyens/modulejail/issues/18) for the real-time bug-hunting: both root causes were diagnosed correctly in the issue thread (double-shell layering, NUL-stripping by shell substitution) before this hotfix was committed. The command-injection question that prompted the log-injection hardening also came from the same thread. ### Notes - Operators on v1.3.4 should upgrade to get the corrected `--verbose-logging` output. v1.3.4 operators not using `--verbose-logging` see no behavior difference between v1.3.4 and v1.3.5 (the default install-line is byte-identical). ## [1.3.4] - 2026-05-30 Patch release. One new flag (`--verbose-logging`), five new `BASELINE_DESKTOP` entries (CPU power management + TUN/TAP), one documented baseline-addition policy. v1.1.4 byte-identical install- line body preserved under default flags (no change to default behavior). ### Added - `--verbose-logging` flag. Enriches the per-blocked-load `logger` call with the caller context, read from `/proc/$PPID/...`: the parent PID (`ppid`), audit `loginuid` (persists across `su`/ `sudo`), parent short command name (`pcomm`), and `argv[0]` (`pexe`, naturally NUL-truncated; full `cmdline` is one `ps -fp ` away). Default `logger` output remains the bare `"blocked: "` form. Requires `/usr/bin/logger` to be executable (modulejail exits `EX_NOINPUT=66` otherwise); mutually exclusive with `--no-syslog-logging`. Resolves the triage request from @retry-the-user in [issue #18](https://github.com/jnuyens/modulejail/issues/18). Three new acceptance cases cover the enriched install-line body, the mutex with `--no-syslog-logging`, and the logger-binary-missing error path. - `BASELINE_DESKTOP` additions (5 modules, target audience is laptops / workstations where modulejail may run before all udev/late-load events have settled): - `intel_pstate`, `intel_cstate` - modern Intel CPU power management. - `amd_pstate` - AMD analog of `intel_pstate` (in-kernel since 6.0). - `tun`, `tap` - VPN clients (WireGuard, OpenVPN), VirtualBox/ VMware, qemu/KVM bridges. ### Changed - Documented **baseline-addition policy** in the `modulejail` script (new comment block above the `Deliberately NOT in any baseline` section) and in `README.md` `## Contributing` (new `### Baseline-addition policy` subsection). Policy text: > Modules join a baseline only when there is observed operator > pain in that profile's target audience. CONSERVATIVE target = > bare-metal/VM Linux servers (hands-on admins, post-steady-state > runs). DESKTOP target = laptops/workstations (set-and-forget > UX, ModuleJail may run at any time including before all udev/ > late-load events have settled). "Defensive add because the > kernel sometimes loads it late" is insufficient justification - > a real operator-reported breakage in the relevant profile's > target audience is the bar. `acpi_cpufreq` in `BASELINE_CONSERVATIVE` (added v1.3.2 with the same speculative reasoning the policy now disallows) is retained for backward compatibility; no future additions follow that pattern. - `BASELINE_DESKTOP` comment header updated to reflect the new entries and the target-audience phrasing. ### Credit - @retry-the-user in [issue #18](https://github.com/jnuyens/modulejail/issues/18) for the `--verbose-logging` motivation (triage of who-tried-to-load what for whitelist decisions). - @teou1 in [issue #16](https://github.com/jnuyens/modulejail/issues/16) for the CPU power management + TUN/TAP suggestions and for the push-back that catalysed the baseline-addition policy. ### Notes - `ntfs` declined from the same #16 feedback round. The `CONFIG_NTFS_FS` kernel option is explicitly marked backward- compat only in the current 7.x tree (`"NTFS filesystem is now handled by the NTFS3 driver"`); the actually-maintained driver remains `ntfs3` which is already in DESKTOP. Adding `ntfs` would pull in deprecated code paths that only exist for users who haven't migrated. - Adding `intel_pstate` / `intel_cstate` / `amd_pstate` to `BASELINE_CONSERVATIVE` was considered and declined: on servers the cpufreq driver path is either kernel-built-in (the default on Debian / Ubuntu Server / RHEL / Amazon Linux), or loaded via udev modalias matching within milliseconds of boot. There is no load-on-user-action path for CPU governors on servers, so the policy bar for `CONSERVATIVE` addition is not met. ## [1.3.3] - 2026-05-29 Hotfix release. The v1.3.2 baseline additions (this morning) broke the v1.1.4 byte-identical regression test in CI: three of the newly- baselined modules (`inet_diag`, `tcp_diag`, `udp_diag`) were present in the v1.1.4-era reference fixture, so moving them from blacklisted to kept shifted the install-line count by 3 (6363 -> 6360). The modulejail binary's behavior was correct in v1.3.2; the failing test was a reference-fixture issue, not a code issue. ### Fixed - `tests/fixtures/v1.1.4-regression/expected-blacklist.conf` regenerated to reflect the v1.3.2 baseline additions. The contract scope is clarified in `tests/cases/v1.1.4-regression.sh`: the v1.1.4 byte-identical regression contract applies to the install- line **rendering** (the per-line `install /bin/true` form), not to the **set** of modules that end up in the file. Intentional baseline additions are allowed to change the module set; the test reference is updated in the same commit. Future baseline additions follow the same pattern. ### Notes - Operators already on v1.3.2 do not need to upgrade for any behavioral reason; v1.3.3 ships identical modulejail logic. The upgrade is recommended only for clean CI signaling and to be on the latest tag. - Adding `tests/run-fixtures.sh` to the pre-release pre-flight (it was previously implicit via CI-on-push; running it locally before tagging would have caught this). ## [1.3.2] - 2026-05-29 Patch release. Baseline maturation driven by operator feedback - the DESKTOP and CONSERVATIVE profiles gain modules that turned out to be load-on-demand in the wild but were not yet baseline-protected. No flag changes; no behavior changes outside the keep-set growth. v1.1.4 byte-identical install-line body preserved (6363 / 6363 install lines). ### Added - `BASELINE_CONSERVATIVE` now includes: - `inet_diag`, `tcp_diag`, `udp_diag` - inet socket diagnostics auto-loaded by `ss(8)`, `iotop(8)`, and most system-monitor tools (KDE System Monitor, GNOME System Monitor, btop, glances). - `acpi_cpufreq` - ACPI-based x86 CPU frequency governor. Loaded on most laptops and servers that don't use `intel_pstate`. Often built-in to distro kernels; baseline addition is a no-op there and safety-net on kernels where it ships as a module. - `tls` - kernel TLS (kTLS). Increasingly load-on-demand for HTTPS-heavy daemons and modern package managers. Server-side too (kTLS in nginx, NFS-over-TLS). - `BASELINE_DESKTOP` (on top of the CONSERVATIVE additions above) now includes: - `f2fs` - modern flash-friendly filesystem, common on partition tools and external drives. - `ntfs3` - read/write NTFS driver, in-tree since 5.15. Standard for mounting Windows drives. - `isofs`, `cdrom` - ISO 9660 and optical-media support, for `.iso` mounting and CD/DVD drives. - `amd64_edac`, `i7core_edac`, `ie31200_edac` - CPU EDAC (memory error detection) for AMD and common Intel families. These are loaded by udev later in the boot sequence; including them in the baseline avoids the race where a ModuleJail run at steady-state might find them not-yet-loaded. ### Credit @Dizirgee in [issue #16](https://github.com/jnuyens/modulejail/issues/16) for the well-organized, evidence-based survey of modules that turned out to need baseline protection. The feedback loop was nicely closed by @teou1's `examples/blocked-module-popup.sh` (v1.3.1) which @Dizirgee was using to catch the blocked-module attempts in real time. ### Notes - Declined from the same issue as better-as-operator-`WHITELIST` rather than baseline-default: `ntfs` (superseded by `ntfs3`), `nbd` (sysadmin tool, not desktop default), `ib_core` (HPC/datacenter, not desktop). Operators with specific needs can add these to the `WHITELIST=` line near the top of the script. - Manjaro forum operators have started a community knowledge base at https://forum.manjaro.org/t/howto-modulejail/187877 (authored by @andreas85) covering operator-specific module sets we don't bake into baselines. ## [1.3.1] - 2026-05-27 Documentation-heavy patch release. One small additive baseline change (exfat in DESKTOP), one new operator-recipe example, two external doc contributions, and a substantial new threat-model + defense-in-depth documentation surface. No flag changes; no behavior changes outside the DESKTOP profile keep-set. v1.1.4 byte-identical install-line body still preserved (6363 / 6363 install lines). ### Added - `exfat` in `BASELINE_DESKTOP`. Windows-formatted flash drives and SD cards above 32 GB default to exFAT; without this addition, plugging a Windows-formatted USB drive into a desktop-profile host after a ModuleJail run could fail to mount. Additive only; no module is blacklisted that wasn't already. Contributed by @tjmnmk in [PR #13](https://github.com/jnuyens/modulejail/pull/13). - `examples/blocked-module-popup.sh`: a small desktop-session script that tails `journalctl -t modulejail` and fires `notify-send` for each blocked module load. Ships under `examples/` because it is a separate operator-launched recipe, not a ModuleJail feature (a longer-running popup tail would cross the v1 "no daemons" line; the v2.0-alpha "Managed Mode" roadmap covers the eventual built-in version). Contributed by @teou1 in [issue #12](https://github.com/jnuyens/modulejail/issues/12). - New top-level `## Threat model` section in `README.md` making the scope explicit: ModuleJail defends against unprivileged-user → root privilege escalation via vulnerable kernel modules, and does **not** defend against attackers who already have root (root can `insmod` directly, bypassing `modprobe.d/` entirely). Cites the May 2026 "Copy Fail" CVE (CVE-2026-31431, `algif_aead`) as the canonical threat-model fit. - New `docs/DEFENSE-IN-DEPTH.md` with a 7-tier taxonomy of which kernel modules unprivileged users can autoload (socket families, AF_ALG crypto, FUSE setuid mount helpers, binfmt, char-devices, netlink, user-namespace amplifier) and 5 stand-alone hardening recipes that compose with ModuleJail (`kernel.modules_disabled=1`, disable unprivileged user namespaces, Secure Boot + lockdown mode, module signature enforcement, seccomp per service). Each recipe lists who it protects against, how to apply, and what breaks. - New `## Failing on blocked module loads` section in `README.md` plus a full `-f` / `--fail-on-module-load` entry in the manpage SYNOPSIS and OPTIONS. The v1.2.3 `-f` flag existed but was undocumented. Contributed by @tjmnmk in [PR #14](https://github.com/jnuyens/modulejail/pull/14). - New `## Options reference` table in `README.md` covering every flag plus the three `MODULEJAIL_*` environment variables. Contributed by @tjmnmk in [PR #14](https://github.com/jnuyens/modulejail/pull/14). ### Changed - In-script `usage()` text extended to document the v1.3.0 flags that were added on the manpage side but missed in `--help`: `--dry-run`, `--quiet`, `--verbose`, `--output-format {json|logfmt}`, and the `-p none` profile arm. `modulejail --help`, the `README.md` options table, and the manpage are now in parity. - README `## Scope of the blacklist (what it blocks, what it doesn't)` section now cross-references the new top-level `## Threat model` + `docs/DEFENSE-IN-DEPTH.md` instead of duplicating the framing inline. - Manpage `HEADER FIELDS` section: minor prose cleanup of the `# kernel:` line description; behavior unchanged. - README native-package install snippets: stale `1.2.4` filename references in the `dpkg -i` / `rpm -i` lines (left over from the v1.3.0 release URL bump) are now consistent with the download URL. ### Internal - AUR `modulejail` PKGBUILD switched to sequoia-sqv signature verification. New `prepare()` invokes `sqv` against a pinned `modulejail-signing-key.gpg` shipped in the AUR repo; local source filenames use non-trigger extensions (`.tarball-signature`, `.gpg`) so `makepkg`'s built-in gpg verifier does not compete. Published as AUR `modulejail 1.3.0-2` on 2026-05-25 ahead of this release (no upstream code change in that pkgrel). The v1.3.0 GitHub release now carries `v1.3.0.tar.gz.sig` as a third asset alongside the .deb and .rpm. Per AUR comment from @Velocifyer (2026-05-24): "use sqv, not gpg." ### Credit - @teou1 for [issue #12](https://github.com/jnuyens/modulejail/issues/12) (the popup-script contribution and a wiki HOWTO on the Manjaro forum at https://forum.manjaro.org/t/howto-modulejail/187877, authored by @andreas85). - @tjmnmk (Adam Bambuch) for PRs #13 and #14, and for picking up co-maintainership coordination on AUR `modulejail-git`. - @Velocifyer for the AUR comment that drove the sequoia-sqv switch. ## [1.3.0] - 2026-05-24 Operator-flexibility CLI surface (four new flags, one new profile, one new header line) and the first release cut from a hardened pipeline (GPG-signed annotated tags going forward, GitHub Actions CI matrix on every push / PR / tag). Single biggest release since v1.2.0. ### Added - New `-p none` profile. Produces a blacklist that preserves only the currently-loaded module set (`lsmod`) and the `--whitelist-file` entries, with NO built-in baseline added. Most aggressive profile; recommended only when `--whitelist-file PATH` is supplied. The >99% blacklist sanity guard is skipped on this profile and an `info:` line documents the skip on stderr. Supports the centrally-generated deny-list / shared-node operator pattern from frymaster on r/archlinux. Closes OPT-01. - New `--dry-run` flag. Runs the full pipeline (compute the blacklist set, render the header, fingerprint the body) but writes NOTHING under `/etc/modprobe.d/`. The would-be header is rerouted to stderr; `DRY-RUN: would blacklist N modules` summary on stdout. Exit code 0 on simulated success. Combines cleanly with every other flag. Closes OPT-02. - New `--quiet` flag suppresses all non-error stderr output (info / notice lines and the post-run human summary). `error:` lines still fire so fleet automation case-splitting on sysexits codes remains correct. Closes OPT-03 (quiet half). - New `--verbose` flag emits per-module decision lines on stderr, produced by a single-pass `awk` (O(n), one fork). Mutually exclusive with `--quiet` (combining exits `64 EX_USAGE`). Closes OPT-03 (verbose half). - New `--output-format json` / `--output-format logfmt` flags emit a machine-readable run summary to stdout on success. Schema v1: 11 fields including `tool_name`, `tool_version`, `kernel_version`, `profile`, `modules_available`, `modules_loaded`, `modules_blacklisted`, `fingerprint` (sha256, raw hex), `output_path`, `dry_run` (bool), `whitelist_file`. JSON form round-trips through `jq`; logfmt form round-trips through standard logfmt parsers. `--output-format` bypasses `--quiet` (the machine-readable summary survives the silencer) but never emits on error. Closes OPT-04. - New `# kernel version: ` line in the generated blacklist header, on a separate line from the existing ModuleJail version and sha256 fingerprint annotations. Lets a recipient of a centrally-deployed deny-list see which kernel's module tree produced it. The v1.1.4 byte-identical install-line body is preserved under `--no-syslog-logging` (6363 / 6363 install lines). Closes HDR-01. - Twelve new acceptance cases under `tests/cases/` locking the Phase 5 surface (`-p none`, `--dry-run`, `--quiet`, `--verbose`, `--output-format json|logfmt`, `HDR-01` header lock, and the `--quiet` + `--verbose` mutex). Total host-local acceptance suite is now 30 cases. - New `## Verifying releases` section in `README.md` documenting the `git tag -v v1.3.0` verification path, expected `gpg: Good signature` output, two key-import paths (`curl https://github.com/jnuyens.gpg | gpg --import` and `gpg --recv-keys `), and a maintainer-aside `> [!TIP]` callout for the one-time `git config tag.gpgsign true` setup. ### Changed - Generated blacklist header gains a new `# kernel version:` line per HDR-01 above. The install-line body remains byte-identical to v1.1.4 under `--no-syslog-logging` per the D-39 contract; only the header annotation set grows. ### Security - **Annotated release tags are now GPG-signed.** `v1.3.0` is the first signed tag; `v1.0.0..v1.2.4` are intentionally left as annotated-but-unsigned (history not rewritten; downstream packagers rely on commit-immutability). Verification path documented in `README.md` `## Verifying releases`. Signing-key fingerprint published in the release notes. Closes REL-04. ### Internal - New `.github/workflows/ci.yml` runs `tests/run-fixtures.sh` on every push to `master`, every PR, and every tag push. Five explicit named jobs: `lint` (shellcheck across `modulejail`, `tests/run-fixtures.sh`, `tests/lib/*.sh`, `tests/cases/*.sh`, `scripts/*.sh`) plus `arch` + `alpine` + `opensuse` (the three already-supported fixture-tier distros) plus `host-local`. Each fixture job calls the same harness the local fixture-test path uses (no parallel test logic). Branch protection on `master` requires all five checks. Zero secrets in the workflow; only first-party `actions/checkout@v4` is used. Closes REL-05. - `tests/run-fixtures.sh` gains `--only-container DISTRO` and `--only-host-local` per-axis selector flags. Three-way mutex with `--filter PATTERN`; `DISTRO` is allowlisted against `{arch, alpine, opensuse}`; bad usage exits `64 EX_USAGE`. Used by the CI matrix to dispatch one job per axis. - `tests/lib/case-env.sh` split into a slim `case-env.sh` (shared boilerplate, centralized `EXIT / INT / HUP / TERM` trap) plus new `tests/lib/case-tree.sh` (synthetic kernel-module-tree builder, 13 representative touches, 50-dummy padding, fake `/proc/modules`). `tests/cases/v1.1.4-regression.sh` now sources `case-env.sh` only (drops the duplicated boilerplate, migrates four failure paths to `case_fail`); the v1.1.4 6363 / 6363 byte-identical install-line body contract still holds. Twenty-seven other host-local cases source `case-tree.sh` for the synthetic tree builder; two open-coded outliers (`emit-install-line-sanitize.sh`, `ssh-unreachable-regression.sh`) are deliberately untouched. Closes IN-03. - `man/modulejail.8.in` line 7 `.TH` date is now a `__DATE__` placeholder substituted by `packaging/build.sh` at build time (parallel to the existing `__VERSION__` substitution). Honours `SOURCE_DATE_EPOCH` per reproducible-builds.org, with GNU/BSD `date` fallback (`date -u -d '@SDE'` first, `date -u -r SDE` second) so both Debian/Fedora build hosts and the macOS dev host produce the same output. Closes IN-04. ### Notes - The v1.1.4 byte-identical install-line body contract (D-39) is held through every Phase 5 and Phase 6 commit; `--no-syslog-logging` still produces the exact v1.1.4 bytes (6363 / 6363 install lines). - Phase 6 introduces signed tags forward only. Earlier releases (v1.0.0 through v1.2.4) remain annotated-but-unsigned by design; re-signing them would require force-pushing history and break downstream packagers' commit-immutability assumptions. ## [1.2.4] - 2026-05-20 ### Added - An invocation header — can be copied and pasted for reproducible results. ## [1.2.3] - 2026-05-19 ### Added - New `-f` / `--fail-on-module-load` flag. When set, blocked module loads return a non-zero exit code (`modprobe` fails loudly) instead of silently succeeding with `/bin/true` / `exit 0`. Useful for operators running CI or Ansible against `modprobe` who want blacklisted-module attempts to surface as failures rather than silent skips. Default behavior unchanged. - New install-line forms for the flag-on case: - silent form: `install /bin/false` - logger form: `install /bin/sh -c '/usr/bin/logger -t modulejail "blocked: " 2>/dev/null; /bin/false'` - Two new acceptance cases: - `tests/cases/fail-on-module-load-silent.sh` - `tests/cases/fail-on-module-load-logger.sh` ### Compatibility - The default-off install-line bytes are byte-identical to v1.2.2 in both the silent and logger paths. The v1.1.4 byte-identical regression contract (`tests/cases/v1.1.4-regression.sh`) still passes (6363 / 6363 install lines). - New header annotations when the flag is set: - `# install-line: /bin/false (silent, --fail-on-module-load)` - `# install-line: /bin/sh + logger + /bin/false (syslog tag: modulejail, --fail-on-module-load)` Default-off header strings unchanged. ### Credit Proposed by @tjmnmk in [PR #4](https://github.com/jnuyens/modulejail/pull/4); applied directly with the following adjustments to fit the project's POSIX and byte-identical contracts: - `local install_final_cmd` (a bash/ksh extension; not POSIX) replaced with explicit branching in `emit_install_line`. - The default-off (`FAIL_ON_MODULE_LOAD=0`) logger path now preserves the trailing `; exit 0` byte-for-byte, instead of swapping to `; /bin/true`. The byte-identical contract for default behavior is intact. - Two new acceptance cases added under `tests/cases/`. ## [1.2.2] - 2026-05-18 One-line follow-up to v1.2.1: when the host has neither `curl` nor `wget`, the best-effort update check now leaves an operator-visible breadcrumb instead of silently giving up. ### Added - `check_for_updates` emits `modulejail: notice: no curl/wget in PATH, cannot check for update` to stderr when neither downloader is available on `$PATH`, then returns 0 (the function's documented always-succeed contract is preserved). Severity-prefix matches the other three `notice:` lines in the same function ("newer release available" etc.). Authored by @pepa65 in [PR #1]. ### Notes - `check_for_updates` is best-effort (documented at the function's block-comment header). Its exit code is independent of blacklist generation; this release does not change any exit-code semantics for the script's main job. - v1.1.4 byte-identical regression: 6363/6363 install lines preserved (this patch does not touch the blacklist-rendering codepath). - Packaging metadata (`packaging/{deb,rpm}/`) and `man/modulejail.8.in` pick up `1.2.2` via the existing `__VERSION__` substitution in `packaging/build.sh`; the `.TH` line in the manpage stays at `2026-05-18` (same calendar day as 1.2.0 / 1.2.1). [PR #1]: https://github.com/jnuyens/modulejail/pull/1 ## [1.2.1] - 2026-05-18 Bundled cleanup pass discharging four code-review findings, two cosmetic items, and three carry-forward items from the v1.0.0 audit. No new features, no UX changes. ### Fixed - `parse_whitelist_file` now propagates real `awk` failures to a typed sysexits exit code under `set -eu`. Previously the `_awk_status=$?; if [ ... ne 0 ]; then exit $EX_DATAERR; fi` tail was dead code: `set -eu` aborts the shell at the `awk` line on any non-zero awk exit, before the `if` can run. The new shape brackets the `awk` call with `set +e` / `set -e`, captures `rc=$?`, and routes 65 to `EX_DATAERR` (the documented data-error path) and any other non-zero exit to `EX_OSERR` (awk-internal failure: OOM, signal, future program-edit syntax error). Fleet automation case-splitting on sysexits codes now reads correctly. - `tests/run-ssh-hosts.sh` now classifies unreachable hosts as `UNREACHED` (harness exit 2) instead of mis-counting them as `OVERALL_FAIL` (exit 1). The pre-fix shape `if ! run_host ...; then rc=$?` captured the inverted-condition `!` exit (always 0 inside the `then` branch under POSIX `/bin/sh`, dash, and bash), so the rc=2 dispatch was dead. Replaced with `set +e; run_host ...; rc=$?; set -e; case "$rc" in ...`. The documented exit-code contract on lines 33-37 is now actually enforced. - Header-annotation byte string aligned to comma form (was a semicolon in the implementation): `# install-line: /bin/true (silent, --no-syslog-logging or logger absent)`. Edited in modulejail, the manpage, the README, and the two logger test cases that asserted the byte string. - Whitelist-file lines may now carry leading whitespace. The `awk` validator strips leading whitespace symmetric with the existing trailing-whitespace strip before the canonical-regex check, so an indented module name (e.g. ` vfio_pci` copy-pasted from a YAML or other indented source) is accepted rather than rejected as `EX_DATAERR`. - README.md audited against the two v1.0.0 carry-forward items; both are already-discharged. The dependency list at line 122-123 already names `awk, comm, find, sha256sum, and standard coreutils` correctly (the script truly invokes none of `grep`, `sed`); the stale "420 lines" claim was already removed from the README in an earlier edit (the script has grown well past that, and any pinned count would invite future rot). No further edits needed. ### Security - Defense-in-depth: `list_universe` and `list_loaded` now filter their output to the canonical kernel-module regex `^[a-zA-Z0-9_]+$` before names can reach `emit_install_line`. Severity: medium; not user-reachable today without root-equivalent write access to `/lib/modules/$(uname -r)/`. Closes the documented "strict regex is the gate" contract for both the `--whitelist-file` path (already gated by `parse_whitelist_file`) AND the filesystem- walk path (previously un-gated). Pre-fix reproduction: a `.ko*` file under `/lib/modules/$KVER/` with a single quote in its basename flowed unescaped into the generated install line, breaking the shell-quoting of the logger form (`install evil'name /bin/sh -c '/usr/bin/logger ...'`) and causing `modprobe` to evaluate syntactically malformed shell at module-load time. New regression test `tests/cases/emit-install-line-sanitize.sh` feeds three adversarial characters (single quote, `$IFS`, whitespace) through the full pipeline under both install-line forms and asserts the generated file contains none of those characters in any install-line module-name token. ### Changed - `tests/run-fixtures.sh` with no flags now ALWAYS runs every host-local case under `tests/cases/*.sh` (15 cases as of v1.2.1). The container distro matrix (arch, alpine, opensuse) is additive when a docker or podman runtime is available. Pre-fix, the no-container-runtime path exited 77 without running anything, so the host-local cases under `tests/cases/` (whitelist-file-*, logger-*, v1.1.4-regression) were silently skipped on every developer-laptop invocation. ### Added - `tests/cases/ssh-unreachable-regression.sh`: regression guard for the SSH-host harness exit-code routing fix. Drives the harness against a guaranteed-unreachable host (`unreachable-modulejail-test-host.invalid`, RFC 2606 reserved TLD), asserts harness exit 2 and `UNREACHABLE` SUMMARY token. Hermetic: no real SSH server, no `~/.ssh/config` dependency, no sudo; total wall-clock <100ms on the dev box. - `tests/cases/emit-install-line-sanitize.sh`: regression guard for the defense-in-depth filter. Builds a synthetic `/lib/modules/$KVER/kernel/` tree with three adversarial `.ko` basenames, runs `modulejail` under both install-line forms, asserts the generated blacklist contains no adversarial characters in any install-line module-name token. Mutation-tested against a pre-fix `modulejail` (filter absent): correctly FAILs with diagnostic dumps showing the leaked install lines. ### Deferred (with rationale) - `case-env.sh` duplication in `v1.1.4-regression.sh`: v1.1.4-regression's open-coded REPO_ROOT/CASE_TMP/trap boilerplate is kept. Refactoring `case-env.sh` to support a `CASE_ENV_NO_UNIVERSE` opt-out would touch the contract used by all 13 other host-local cases, for the marginal benefit of ~20 fewer duplicated lines in the one case whose synthetic-tree needs are wildly different (6474 sharded files vs. ~63 hand-listed). The v1.1.4-regression case is the safety contract for the release; isolating its open-coded boilerplate is the lower-risk choice. - Hardcoded dates in manpage and rpm spec: `__DATE__` substitution not plumbed. The rpm spec changelog inherently needs a manual per-release edit (new top changelog block; prior entries must NOT change), so `__DATE__` saves nothing there. The manpage `.TH` line could use `__DATE__` cleanly but it saves no release-checklist step (the human still has to bump VERSION and write CHANGELOG.md). Recorded as a release-checklist item: on every release bump `man/modulejail.8.in:7` `.TH` date and add a new `packaging/rpm/modulejail.spec.in` changelog block. ## [1.2.0] - 2026-05-18 ### Added - New `--whitelist-file PATH` flag (closes [#2](https://github.com/jnuyens/modulejail/issues/2)). Reads a site-local whitelist file (one module name per line, `#` comments, blank lines ignored), validates each line against `[a-zA-Z0-9_-]+`, refuses group- or world-writable files, and appends valid names to the in-script `WHITELIST`. Operators no longer lose site-local additions on `.deb` / `.rpm` / `curl | sh` reinstalls. - **Default path** `/etc/modulejail/whitelist.conf`. When the flag is not passed and this file exists, ModuleJail auto-detects it with the same strict mode and content gates and prints an `info:` line on stderr so the choice is never silent. Addresses the silent-error-on-forgotten-flag concern raised by @bpmartin20 and @james-rimu in [#2](https://github.com/jnuyens/modulejail/issues/2). - New `--no-whitelist-file` flag to skip the default file for a single run. Mutually exclusive with `--whitelist-file PATH` (combining exits `64 EX_USAGE` with a clear error). - New `--no-syslog-logging` flag. Forces the v1.1.4-style `install /bin/true` install-line body, for operators who require byte-identical output across versions or run on hosts without `/usr/bin/logger`. - New `MODULEJAIL_LOGGER_PATH` env-var override (test-only plumbing, parallel to `MODULEJAIL_PROC_MODULES` / `MODULEJAIL_KVER` / `MODULEJAIL_MODULES_ROOT`). - New `MODULEJAIL_MODULES_ROOT` env-var override (test-only plumbing) — lets host-local test cases on non-Linux dev boxes exercise the full pipeline against a synthetic `/lib/modules` tree. - New `MODULEJAIL_DEFAULT_WHITELIST_FILE` env-var override (test-only plumbing) for the default-path auto-detection. - New header annotation `# install-line: ...` documents which install-line form is in the generated file. - New regression fixture under `tests/fixtures/v1.1.4-regression/` pinning v1.1.4 output as a permanent baseline (`tests/cases/v1.1.4-regression.sh`). - Twelve new acceptance cases under `tests/cases/`: nine for `--whitelist-file` (happy path, missing file, bad permissions, malformed module name, comments-and-blanks, default-path used, default-path opt-out via `--no-whitelist-file`, dash-form normalisation regression, `--whitelist-file PATH` + `--no-whitelist-file` mutual exclusion), three for the logger install-line forms (default-on, opt-out, absent-fallback). ### Fixed - Whitelist-file entries written in dash form (`nft-compat`) are now normalised to underscore form before joining the keep-set, matching the documented behaviour and the normalisation already applied by `list_baseline` / `list_whitelist` / `list_universe`. Before this fix, dash-form entries silently failed to match `/proc/modules`'s underscore form and the module was blacklisted anyway. Caught in code review before release. ### Changed - **Default behaviour change:** when `/usr/bin/logger` is executable on the host running modulejail (and `--no-syslog-logging` is not set), generated install lines now call `logger -t modulejail "blocked: "` so blocked module load attempts produce a syslog entry tagged `modulejail`. View via: - `journalctl -t modulejail --since '1 hour ago'` on systemd hosts - `grep modulejail /var/log/syslog` on syslog hosts Set `--no-syslog-logging` to restore the exact v1.1.4 install-line body. The generated file's header annotation (`# install-line: ...`) records which form was emitted. ### Security - Whitelist file is rejected if its mode allows group-write or world-write (`mode & 022 != 0`), exiting `EX_NOPERM=77` with a `chmod go-w PATH` hint. Same hardening sshd applies to `authorized_keys` and sudo applies to `sudoers`. Each non-comment line is strictly validated against `[a-zA-Z0-9_-]+` to prevent command injection into the generated `modprobe.d` file. Rejection exits `EX_DATAERR=65` with a stderr message citing the file path, line number, and offending content. ### Internal - New `EX_DATAERR=65` constant in the sysexits.h block (numeric order between `EX_USAGE=64` and `EX_NOINPUT=66`). Documented exit code in `--help`. - POSIX-portable octal mode parsing (no bashism `$((8#$x))`); shellcheck `--shell=sh` clean. - Pre-existing latent bug fixed: the `cleanup()` EXIT trap's `[ -n "$tmp" ] && rm -f "$tmp"` last command silently clobbered explicit `exit $EX_*` codes under dash/POSIX `/bin/sh` whenever `$tmp` was still empty. Rewritten as an `if`/`then` block with an explicit trailing `return 0`. Surfaced by the new whitelist-file rejection paths. - `tests/run-fixtures.sh` gained `--filter PATTERN` mode for host-local case scripts under `tests/cases/`; the default no-flag mode (full distro fixture matrix) is unchanged. - Header annotation does NOT enter the fingerprint computation (fingerprint is a function of canonical inputs — kernel, profile, loaded, baseline, whitelist — not render-time decisions). Two runs on identical inputs with different `--no-syslog-logging` states therefore produce different install-line bodies but the same `# fingerprint:` line, preserving the v1.0.0 fleet-correlation contract. ### Drivers - GitHub [Issue #2](https://github.com/jnuyens/modulejail/issues/2) (bpmartin20) — external whitelist persistence ask. - Vincent Homans (email feedback, 2026-05-13) — syslog visibility ask and modprobe-override-scope clarification ask. ## [1.1.4] - 2026-05-13 ### Added - Project logo on the README. ### Changed - Container fixture is version-agnostic (no longer hardcoded to `1.0.0` strings) and gains four new assertions covering the v1.1.x update-check surface, including a static regression guard against the v1.1.2 busybox-wget bug. ## [1.1.3] - 2026-05-13 ### Fixed - Update check now works on Alpine / busybox wget. The wget invocation used GNU long-form flags (`--quiet`, `--max-redirect=5`, `--output-document=-`) that busybox wget rejects, causing the check to silently exit non-zero on every Alpine host. Switched to the universal short-flag subset (`-q`, `-T 10`, `-O -`) and dropped `--max-redirect` (the GitHub tags API does not redirect). ## [1.1.2] - 2026-05-12 ### Added - `modulejail(8)` manpage, installed at `/usr/share/man/man8/modulejail.8.gz`. ## [1.1.1] - 2026-05-12 ### Changed - Swap the order of `Why?` and `What ModuleJail is` in the README so the motivation leads. - Drop the per-distro `%dist` suffix from the RPM filename (was `modulejail-X.Y.Z-1.el9.noarch.rpm`, now `modulejail-X.Y.Z-1.noarch.rpm`). ModuleJail is a noarch shell script with no per-major-RHEL semantics. ## [1.1.0] - 2026-05-12 ### Added - `.deb` and `.rpm` packaging under `packaging/` with `packaging/build.sh` driver. - Optional post-run check for a newer release on GitHub: silent on any failure mode, 10-second hard timeout, only complains when reachable and a newer tag exists. Honours `MODULEJAIL_NO_UPDATE_CHECK=` to disable. ## [1.0.1] - 2026-05-12 ### Changed - Documentation cleanup release. ## [1.0.0] - 2026-05-12 ### Added - Initial release. Single POSIX shell script that snapshots `/proc/modules`, walks `/lib/modules/$(uname -r)`, computes the complement against a built-in baseline plus the sysadmin `WHITELIST`, and writes a `modprobe.d` blacklist file. - Three baseline profiles (`minimal`, `conservative`, `desktop`). - SemVer `VERSION` constant; sysexits.h-aligned exit codes (`64`, `66`, `70`, `71`, `73`, `77`). - Deterministic SHA-256 fingerprint header — byte-identical idempotency on identical inputs. - Cross-distro support (Debian/Ubuntu, RHEL/Rocky/Fedora, Arch, Alpine, openSUSE) with no per-distro code branches. - Container fixture harness (`tests/run-fixtures.sh`) and SSH-host acceptance harness (`tests/run-ssh-hosts.sh`). - GPL-3.0-only license. [1.2.0]: https://github.com/jnuyens/modulejail/releases/tag/v1.2.0 [1.1.4]: https://github.com/jnuyens/modulejail/releases/tag/v1.1.4 [1.1.3]: https://github.com/jnuyens/modulejail/releases/tag/v1.1.3 [1.1.2]: https://github.com/jnuyens/modulejail/releases/tag/v1.1.2 [1.1.1]: https://github.com/jnuyens/modulejail/releases/tag/v1.1.1 [1.1.0]: https://github.com/jnuyens/modulejail/releases/tag/v1.1.0 [1.0.1]: https://github.com/jnuyens/modulejail/releases/tag/v1.0.1 [1.0.0]: https://github.com/jnuyens/modulejail/releases/tag/v1.0.0 jnuyens-modulejail-06d8d74/LICENSE000066400000000000000000001045151520651617500167150ustar00rootroot00000000000000 GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007 Copyright (C) 2007 Free Software Foundation, Inc. Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The GNU General Public License is a free, copyleft license for software and other kinds of works. The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. We, the Free Software Foundation, use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things. To protect your rights, we need to prevent others from denying you these rights or asking you to surrender the rights. Therefore, you have certain responsibilities if you distribute copies of the software, or if you modify it: responsibilities to respect the freedom of others. For example, if you distribute copies of such a program, whether gratis or for a fee, you must pass on to the recipients the same freedoms that you received. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. Developers that use the GNU GPL protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License giving you legal permission to copy, distribute and/or modify it. For the developers' and authors' protection, the GPL clearly explains that there is no warranty for this free software. For both users' and authors' sake, the GPL requires that modified versions be marked as changed, so that their problems will not be attributed erroneously to authors of previous versions. Some devices are designed to deny users access to install or run modified versions of the software inside them, although the manufacturer can do so. This is fundamentally incompatible with the aim of protecting users' freedom to change the software. The systematic pattern of such abuse occurs in the area of products for individuals to use, which is precisely where it is most unacceptable. Therefore, we have designed this version of the GPL to prohibit the practice for those products. If such problems arise substantially in other domains, we stand ready to extend this provision to those domains in future versions of the GPL, as needed to protect the freedom of users. Finally, every program is threatened constantly by software patents. States should not allow patents to restrict development and use of software on general-purpose computers, but in those that do, we wish to avoid the special danger that patents applied to a free program could make it effectively proprietary. To prevent this, the GPL assures that patents cannot be used to render the program non-free. The precise terms and conditions for copying, distribution and modification follow. TERMS AND CONDITIONS 0. Definitions. "This License" refers to version 3 of the GNU General Public License. "Copyright" also means copyright-like laws that apply to other kinds of works, such as semiconductor masks. "The Program" refers to any copyrightable work licensed under this License. Each licensee is addressed as "you". "Licensees" and "recipients" may be individuals or organizations. To "modify" a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a "modified version" of the earlier work or a work "based on" the earlier work. A "covered work" means either the unmodified Program or a work based on the Program. To "propagate" a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well. To "convey" a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying. An interactive user interface displays "Appropriate Legal Notices" to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion. 1. Source Code. The "source code" for a work means the preferred form of the work for making modifications to it. "Object code" means any non-source form of a work. A "Standard Interface" means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language. The "System Libraries" of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A "Major Component", in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it. The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work. The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source. The Corresponding Source for a work in source code form is that same work. 2. Basic Permissions. All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law. You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you. Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary. 3. Protecting Users' Legal Rights From Anti-Circumvention Law. No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures. When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures. 4. Conveying Verbatim Copies. You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program. You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee. 5. Conveying Modified Source Versions. You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions: a) The work must carry prominent notices stating that you modified it, and giving a relevant date. b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to "keep intact all notices". c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it. d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so. A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an "aggregate" if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate. 6. Conveying Non-Source Forms. You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways: a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange. b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge. c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b. d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements. e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d. A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work. A "User Product" is either (1) a "consumer product", which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, "normally used" refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product. "Installation Information" for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made. If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM). The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network. Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying. 7. Additional Terms. "Additional permissions" are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions. When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission. Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms: a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or d) Limiting the use for publicity purposes of names of licensors or authors of the material; or e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors. All other non-permissive additional terms are considered "further restrictions" within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying. If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms. Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way. 8. Termination. You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11). However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation. Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice. Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10. 9. Acceptance Not Required for Having Copies. You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so. 10. Automatic Licensing of Downstream Recipients. Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License. An "entity transaction" is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts. You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it. 11. Patents. A "contributor" is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's "contributor version". A contributor's "essential patent claims" are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, "control" includes the right to grant patent sublicenses in a manner consistent with the requirements of this License. Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version. In the following three paragraphs, a "patent license" is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To "grant" such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party. If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent license to downstream recipients. "Knowingly relying" means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid. If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it. A patent license is "discriminatory" if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007. Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law. 12. No Surrender of Others' Freedom. If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program. 13. Use with the GNU Affero General Public License. Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU Affero General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the special requirements of the GNU Affero General Public License, section 13, concerning interaction through a network will apply to the combination as such. 14. Revised Versions of this License. The Free Software Foundation may publish revised and/or new versions of the GNU General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU General Public License "or any later version" applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU General Public License, you may choose any version ever published by the Free Software Foundation. If the Program specifies that a proxy can decide which future versions of the GNU General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program. Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version. 15. Disclaimer of Warranty. THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 16. Limitation of Liability. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. 17. Interpretation of Sections 15 and 16. If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . Also add information on how to contact you by electronic and paper mail. If the program does terminal interaction, make it output a short notice like this when it starts in an interactive mode: Copyright (C) This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, your program's commands might be different; for a GUI interface, you would use an "about box". You should also get your employer (if you work as a programmer) or school, if any, to sign a "copyright disclaimer" for the program, if necessary. For more information on this, and how to apply and follow the GNU GPL, see . The GNU General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. But first, please read . jnuyens-modulejail-06d8d74/README.md000066400000000000000000001074501520651617500171700ustar00rootroot00000000000000

ModuleJail: lock down unused kernel modules. Reduce risk. Stay secure.

A single POSIX shell script that shrinks a Linux host's kernel-module attack surface by writing a `modprobe.d` blacklist for every kernel module not currently in use, minus a built-in baseline and an optional sysadmin whitelist. No daemons, no initramfs changes, no AI inside the tool. One script, one run, one blacklist file. ## Why? AI-assisted security scanning is about to do to the Linux kernel what large-scale fuzzing did to userspace code a decade ago, only faster and at a much larger scale. Many years of latent privilege-escalation bugs in kernel modules are about to surface in quick succession over the coming weeks and months. Long term, this is a major win for kernel security: every disclosure closes a door that an attacker could otherwise have walked through unseen. Short term, it is a nightmare for sysadmins. Every public release brings another race against patch cycles, vendor backports, and reboots across thousands of hosts. ModuleJail does not try to fix kernel bugs, and it cannot. It does the one thing a sysadmin can do today, on any host, in seconds: shrink the attack surface so that the next disclosed bug is more likely to land on a module the host is not even loading. A typical Linux host ships with several thousand kernel modules and uses a few hundred. ModuleJail blacklists the rest. The next CVE in the unused 90% becomes a non-event on that host, and the fleet operator buys time to schedule the patch on their own terms instead of emergency-paging at 03:00. This is intentionally a boring tool. No AI inside it, no daemon, no continuous monitoring, no risk scoring, no CVE database lookups. Just one shell script, run once on a steady-state host, that writes `/etc/modprobe.d/modulejail-blacklist.conf` to blacklist the thousands of unused modules, specific to your system. ## Threat model ModuleJail defends against one thing: **unprivileged-user → root privilege escalation via vulnerable kernel modules**. The threat actor is a local user (or a compromised non-root service) who would otherwise trigger automatic loading of a vulnerable module via an ordinary syscall - `socket(AF_VSOCK, ...)`, `socket(AF_ALG, ...)`, `execve()` of a binary with an obscure binfmt magic, opening a device node, and so on. The recent "Copy Fail" CVE (CVE-2026-31431, April 2026, root via `algif_aead`) is exactly this pattern, and the upstream mitigation every advisory recommends - `install algif_aead /bin/false` in `/etc/modprobe.d/` - is one line of what ModuleJail generates automatically, applied to the entire class of unused modules. ModuleJail does **not** defend against attackers who already have root. Root can `insmod /path/to/module.ko` directly, bypassing `modprobe` entirely and never consulting `modprobe.d/`. Root can also `modprobe --ignore-install ` to skip the install-line indirection. Both are intentional kernel escape hatches for root. If your threat model includes a malicious root user, you need different tools: Secure Boot + kernel lockdown mode, module signature enforcement, IMA/EVM, or `kernel.modules_disabled=1` after boot settles. For the full taxonomy of what unprivileged users can trigger, and recipes for stacking other kernel hardening on top, see **[docs/DEFENSE-IN-DEPTH.md](docs/DEFENSE-IN-DEPTH.md)**. Treat ModuleJail as the "lock the front door" tool. It is the cheapest, broadest, lowest-blast-radius layer in a kernel-hardening stack - deploy it first; the deeper recipes compose on top. ## Quickstart ```sh curl -fsSL https://raw.githubusercontent.com/jnuyens/modulejail/v1.3.6/modulejail | sudo sh ``` > **WARNING: convenient, not safe.** This pipes unverified bytes from the > network to a root shell. The safer alternative below is the recommended path. > [!TIP] > **On a laptop or workstation? Add `-p desktop`.** > > The default profile is `conservative` (servers and VMs). It does NOT > include WiFi, Bluetooth, audio, or video drivers in the baseline, so > if any of those happen not to be loaded at run time (WiFi disconnected, > Bluetooth off, headset unplugged, etc.), they may end up blacklisted > and unavailable on the next boot. The `desktop` profile keeps them in > the keep-list unconditionally. > > ```sh > curl -fsSL https://raw.githubusercontent.com/jnuyens/modulejail/v1.3.6/modulejail | sudo sh -s -- -p desktop > ``` > > See [Profiles](#profiles) below for the full list. The script writes its blacklist to `/etc/modprobe.d/modulejail-blacklist.conf` by default. To use a different path: ```sh curl -fsSL https://raw.githubusercontent.com/jnuyens/modulejail/v1.3.6/modulejail | sudo sh -s -- -o /etc/modprobe.d/site-blacklist.conf ``` ## The safer alternative Download, inspect, then run: ```sh curl -fsSL https://raw.githubusercontent.com/jnuyens/modulejail/v1.3.6/modulejail -o /tmp/modulejail less /tmp/modulejail sudo sh /tmp/modulejail ``` This is the recommended path for any production deployment. The script is plain POSIX shell and inspection takes under ten minutes. ## Native packages (.deb / .rpm / AUR) For Debian/Ubuntu and RHEL/Fedora/Rocky hosts, prebuilt packages are attached to the GitHub release page: ```sh # Debian / Ubuntu: curl -fsSLO https://github.com/jnuyens/modulejail/releases/download/v1.3.6/modulejail_1.3.6_all.deb sudo dpkg -i modulejail_1.3.6_all.deb # RHEL / Fedora / Rocky: curl -fsSLO https://github.com/jnuyens/modulejail/releases/download/v1.3.6/modulejail-1.3.6-1.noarch.rpm sudo rpm -i modulejail-1.3.6-1.noarch.rpm ``` For Arch Linux and derivatives (Manjaro, EndeavourOS, ...), modulejail is in the AUR: ```sh # With any AUR helper (yay shown; paru, pikaur, etc. work identically): yay -S modulejail # Or manually: git clone https://aur.archlinux.org/modulejail.git cd modulejail makepkg -si ``` AUR package: All three packages install `/usr/bin/modulejail`, the `modulejail(8)` manpage under `/usr/share/man/man8/`, and the README and LICENSE under `/usr/share/doc/modulejail/`. They depend on `coreutils`, `findutils`, and `awk`/`gawk` (all standard) and recommend `curl` or `wget` so the optional post-run update check can reach GitHub. The AUR package additionally lists `kmod` as a hard dependency (it ships `lsmod` and `modprobe`; on Debian and RHEL families that package is pulled in by `base`/`@core` and so does not need to be declared explicitly). After install, `man 8 modulejail` shows the full reference: options, profiles, safety model, idempotency, exit codes, environment, and examples. To rebuild the packages locally from a checkout: ```sh ./packaging/build.sh # builds whatever this host's tooling supports ./packaging/build.sh --deb # .deb only (requires dpkg-deb) ./packaging/build.sh --rpm # .rpm only (requires rpmbuild) ``` Output goes to `packaging/dist/`. The script skips gracefully on hosts without the matching tooling. ## Verifying releases Starting with `v1.3.0`, ModuleJail's release tags are GPG-signed by the maintainer (Jasper Nuyens, `jnuyens@linuxbe.com`) using a dedicated release-signing key (UID `ModuleJail Releases `). Fleet operators who deploy via `curl | sh` or pin a specific tag in configuration management can verify the signature against the published fingerprint to confirm the tarball or script they are about to install is the exact artifact the maintainer cut. Earlier tags (`v1.0.0` through `v1.2.4`) are NOT signed, and they will not be signed retroactively: the existing tag SHAs are immutable references that downstream packagers and AUR consumers already trust, and force-pushing rewritten history would break those references. The release-signing key fingerprint: ``` 095F 5C8B 39AF 010E 7B61 5CD4 487B C00D 69C2 A955 ``` (rsa4096, primary signing key, generated 2026-05-24 for the v1.3.0 release ceremony. Formatted in canonical gpg style: 10 hex groups of 4 characters, with a double-space between groups 5 and 6, matching `gpg --fingerprint` output.) Two ways to import the key: ```sh # 1. From GitHub (recommended; GitHub auto-serves the maintainer's # uploaded public keys, no external keyserver required): curl https://github.com/jnuyens.gpg | gpg --import # 2. From a public keyserver (uses gpg's default keyserver pool): gpg --recv-keys 095F5C8B39AF010E7B615CD4487BC00D69C2A955 ``` Then verify the tag: ```sh git tag -v v1.3.0 ``` Expected output (literal, adapted from the Pro Git Book reference): ``` object type commit tag v1.3.0 tagger Jasper Nuyens + v1.3.0 - Operator Flexibility & Release Hardening gpg: Signature made using RSA key 095F5C8B39AF010E7B615CD4487BC00D69C2A955 gpg: Good signature from "ModuleJail Releases (dedicated release signing key) " Primary key fingerprint: 095F 5C8B 39AF 010E 7B61 5CD4 487B C00D 69C2 A955 ``` Compare the `Primary key fingerprint:` line against the value documented above. A mismatch (or `gpg: BAD signature` / `gpg: no signature found`) means the tag must not be trusted: do not install the corresponding release on production hosts, and report the discrepancy upstream. > [!TIP] > **Maintainer-only:** to avoid forgetting the `-s` flag at tag-cut > time, the project's local `.git/config` should have `tag.gpgsign` > set to `true` and `user.signingkey` set to the maintainer's key ID. > One-time setup on the maintainer's checkout: > > ```sh > git config tag.gpgsign true > git config user.signingkey > ``` > > From then on, `git tag -a v1.3.6 -m "..."` auto-signs without the > explicit `-s` flag. Replace `` locally on the > maintainer's machine; do NOT commit a real key ID into this README > (the placeholder is the published form). ## What ModuleJail is ModuleJail snapshots the set of currently loaded modules (`/proc/modules`) and computes the complement against the full module tree (`/lib/modules/$(uname -r)`). Every module in the complement, minus a built-in baseline of essential modules and an optional sysadmin-supplied whitelist, is emitted as an `install ` directive in a `modprobe.d`-compatible blacklist file. Since v1.2, the directive body is either `/bin/sh -c 'logger -t modulejail "blocked: " ...; exit 0'` (default when `/usr/bin/logger` is available, so blocked attempts produce a syslog trail) or `/bin/true` (under `--no-syslog-logging`, silent fallback, or when logger is absent). See the *Viewing blocked module attempts* section below. The invocation used to create the blacklist file is noted in the header line that starts with `invocation:`, and can be copied & pasted for reproducible results. The tool is aimed at Linux fleet operators who need to harden many servers against the wave of AI-assisted kernel privilege-escalation discoveries. Every additional loaded module is additional latent attack surface for the next disclosed CVE. ModuleJail's model is simple: if it is not loaded today on a steady-state host, blacklist it. The script is portable across Debian/Ubuntu, RHEL/Rocky, Arch, Alpine, and SUSE families. It has no runtime dependencies beyond `awk`, `comm`, `find`, `sha256sum`, and standard coreutils, all present in every base Linux install including busybox. ## The safety model The invariant is: **whatever is currently loaded is assumed necessary for the host to function, and is preserved.** ModuleJail does not guess; it reads `/proc/modules` at run time and treats that exact set as the keep-list. This means the operator's responsibility is to run ModuleJail when the host is in a known-good, steady-state configuration: after all services are started, all kernel drivers are loaded, all filesystems are mounted. Running it on a partial or in-flux system risks blacklisting a module that is occasionally needed. The generated file is placed under `/etc/modprobe.d/`. To revert, remove the file (no reboot needed - see the Reverting section). The built-in baseline ensures that core filesystems, storage controllers, and essential networking modules are never blacklisted regardless of the running profile. ## Explicit limitations - **No initramfs handling.** Modules baked into initramfs are out of scope. The loaded-module surface is the target; baked-in modules are not the relevant attack vector. - **No revert tooling.** The revert path is "remove the generated file" (no reboot needed; the blacklist is consulted by `modprobe` at load time, so removing the file takes effect immediately). Sysadmin discipline replaces tool guardrails. - **No daemon or continuous monitoring.** One-shot script by design. - **No AI inside the tool.** AI is the threat-model backdrop, not a feature. - **No per-distro packaging in v1.** The curl one-liner and a cloned repo are the distribution channels. - **No module risk scoring.** The model is "unused implies blacklist," not "vulnerable implies blacklist." - **No kernel rebuild.** Runtime blacklist only. ## Profiles ModuleJail ships three built-in baseline profiles. The selected profile determines which modules are always preserved regardless of loaded state. ```sh # Profile selection via -p (default: conservative) sudo sh modulejail -p conservative sudo sh modulejail -p minimal sudo sh modulejail -p desktop ``` Profile descriptions (from `--help`): ``` minimal Core filesystems + essential kernel modules only conservative Minimal + common server/VM drivers (default) desktop Conservative + WiFi, Bluetooth, audio, video drivers ``` `conservative` is the right choice for virtualised or bare-metal server Linux. `desktop` is for laptops and workstations where WiFi, Bluetooth, audio, and video drivers must be preserved. `minimal` is for environments where you have full control over which drivers are loaded and want the smallest possible baseline. ### Categories deliberately NOT in any baseline The full list lives as a comment block inside the script itself, just below the `BASELINE_DESKTOP` definition. Notable categories that **all three profiles** treat as blacklisted-by-default on hosts that are not actively using them: - **Network filesystems** — `cifs`, `nfs`, `nfsv3`, `nfsv4`, `ceph`, `fuse`, `9p`. Reachable via `mount(2)` with the matching fstype. CIFS additionally carries the `cifs.upcall` trust chain that CIFSwitch (May 2026) exploits via `request_key("cifs.spnego", ...)` — which fails with `-ENOKEY` when `cifs.ko` is not loaded. Operators who mount SMB shares as CIFS clients should add `cifs` to their `WHITELIST=`. Samba (`smbd`) and `ksmbd` SERVERS do not need `cifs.ko` and should leave it blacklisted. - **Legacy / niche socket families** — `sctp`, `dccp`, `tipc`, `rds`, `nfc`, `vsock`, `can`, `qrtr`, `smc`, `x25`, `ax25`, `decnet`, `ipx`, `appletalk`, `netrom`, `rose`, `llc2`. Reachable via `socket(AF_X, ...)` by any unprivileged user. Many distros already ship `blacklist net-pf-N` for the worst legacy ones; ModuleJail extends that to the whole class on hosts not using them. - **Crypto algorithm glue** — `algif_aead`, `algif_skcipher`, `algif_hash`, `algif_rng` (Copy Fail / CVE-2026-31431 is exactly this class) and the long tail of exotic algorithms (`aria`, `chacha20poly1305` standalone, `sm4`, `streebog`, `serpent`, `twofish`, `camellia`, etc.). The primitive ciphers in `BASELINE_CONSERVATIVE` (`aes_generic`, `aesni_intel`, `xts`, `cbc`, `sha256_generic`) are kept because dm-crypt / WireGuard / kTLS use them. - **Other recent-CVE modules an operator is unlikely to need** — `rxe` (Soft-RoCE; CVE-2026-46133), `binfmt_aout`, `binfmt_em86`, `binfmt_flat`, niche `xt_*` netfilter helpers. See [`docs/DEFENSE-IN-DEPTH.md`](docs/DEFENSE-IN-DEPTH.md) for the 7-tier autoload taxonomy and the threat-model framing. If your host genuinely needs any of the above (e.g. a CIFS-client host needs `cifs`, an NFS-client host needs `nfs`), add the specific module names to the `WHITELIST=` line near the top of the script. ## The sysadmin whitelist A site-local `WHITELIST` variable near the top of the script holds space-separated module names that are always preserved, beyond the selected baseline. It ships empty. To use it, open the script and find the `=== SYSADMIN WHITELIST ===` section: ```sh # === SYSADMIN WHITELIST === # Site-local additions to the keep-set, in addition to the selected baseline # profile. Modules listed here will never appear in the generated blacklist. # # Format: space-separated module names in canonical underscore form # (the pipeline normalizes - to _, so either form works). # Default: empty. # # Example (uncomment and adapt): # WHITELIST='nft_compat xt_owner' WHITELIST='' # === END SYSADMIN WHITELIST === ``` Edit `WHITELIST=''` to add your site-specific modules. The `===` banner anchors are designed for Ansible template insertion (`lineinfile` or `blockinfile`). ## Site-local whitelist file Since v1.2, ModuleJail reads site-local modules from an external file. This is the preferred path when you do not want to (or cannot) edit the script in place - for instance because you install ModuleJail via `.deb` / `.rpm` / `curl | sh` and your site-local additions would otherwise be lost on the next reinstall. The default path is `/etc/modulejail/whitelist.conf`. If the file exists, ModuleJail auto-detects it and prints an `info:` line on stderr so the choice is not silent: ``` modulejail: info: using default whitelist file /etc/modulejail/whitelist.conf (--no-whitelist-file to opt out) ``` To skip the default for a single run (e.g. during recovery), pass `--no-whitelist-file`. To use a different location, pass `--whitelist-file PATH`. File format: ```sh # /etc/modulejail/whitelist.conf # One module per line. Blank lines and '#' comments are allowed. # Names may be written in either dash or underscore form ("nft-compat" # or "nft_compat") - the pipeline normalises - to _. # The file mode MUST NOT be group-writable or world-writable # (ModuleJail will refuse to run otherwise). nft_compat xt_owner zfs ``` Three ways to invoke: ```sh # 1. Default location (recommended for production deploys): sudo install -d -m 0755 /etc/modulejail sudo install -m 0644 my-whitelist /etc/modulejail/whitelist.conf sudo modulejail # auto-detects /etc/modulejail/whitelist.conf # 2. Explicit non-default path (override or use a site-local NFS mount): sudo modulejail --whitelist-file /etc/default/modulejail-whitelist # 3. Skip the default for one run (force "no site-local additions"): sudo modulejail --no-whitelist-file ``` The file is appended to the in-script `WHITELIST`; the two are additive. Operators who have been editing the in-script `WHITELIST` (the v1.0 path) keep that edit untouched; the file is a no-side-effect overlay on top. ModuleJail enforces two safety gates on the file: 1. **File mode must not be group- or world-writable.** The same hardening sshd applies to `authorized_keys` and sudo applies to `sudoers`. If the file is `g+w` or `o+w`, ModuleJail refuses to run and prints `chmod go-w PATH` as the hint. Exit code is `77` (`EX_NOPERM`). Rationale: the module names from this file land in the generated `modprobe.d` directives, so an attacker with write access to a shared sysadmin group could otherwise inject `install` stanzas the kernel would later run. 2. **Each line must match `[a-zA-Z0-9_-]+`.** Comments (`#`) and blank lines are skipped silently; everything else must be a plain module name. Any malformed line is rejected with a stderr message citing the file path, line number, and offending content. Exit code is `65` (`EX_DATAERR`). ## Viewing blocked module attempts Since v1.2, when `/usr/bin/logger` is executable on the host running ModuleJail (and `--no-syslog-logging` is not set), the generated install lines call `logger -t modulejail "blocked: "` so a later `modprobe ` attempt produces a syslog entry tagged `modulejail`: ```sh # systemd hosts (journald): sudo journalctl -t modulejail --since '1 hour ago' # classic syslog hosts: sudo grep modulejail /var/log/syslog ``` The generated file's header annotates which install-line form is in use. Look for: ``` # install-line: /bin/sh + logger (syslog tag: modulejail) ``` To opt out and restore the exact v1.1.4 `/bin/true` install-line body (useful for byte-identical regression contracts, hosts without `logger`, or minimal/initramfs builds), pass `--no-syslog-logging`: ```sh sudo modulejail --no-syslog-logging ``` The header annotation then reads: ``` # install-line: /bin/true (silent, --no-syslog-logging or logger absent) ``` If `/usr/bin/logger` is absent on the host AND `--no-syslog-logging` was not set, ModuleJail silently falls back to the `/bin/true` form (matching the v1.1.4 behaviour on minimal hosts). No stderr warning is emitted; the header annotation is the only visible cue. ## Failing on blocked module loads (`-f` / `--fail-on-module-load`) By default, blacklisted module loads succeed silently: the generated install lines end with `exit 0` (when logger is present) or `/bin/true` (when it is not), so `modprobe ` returns 0 even though the module was not actually loaded. This is the safe default — it prevents breakage in scripts and services that unconditionally call `modprobe` and check its return code. To make blocked loads fail loudly instead, pass `-f` or `--fail-on-module-load`: ```sh sudo modulejail -f sudo modulejail --fail-on-module-load ``` With this flag, the install-line body uses `/bin/false` instead of `exit 0` or `/bin/true`, so `modprobe ` returns a non-zero exit code for blacklisted modules. This is useful when you want tooling to detect and alert on blocked module attempts rather than silently swallowing them. The header annotation reflects the mode: ``` # install-line: /bin/sh + logger + /bin/false (syslog tag: modulejail, --fail-on-module-load) ``` or, without logger: ``` # install-line: /bin/false (silent, --fail-on-module-load) ``` ## Scope of the blacklist (what it blocks, what it doesn't) A `modprobe.d` blacklist blocks **automatic** module loading: udev events on hardware hotplug, dependency resolution during `modprobe foo`, autoloaded modules through the alias system. It does **not** block, by design: - `insmod /path/to/module.ko` - `insmod` bypasses `modprobe` entirely and never reads `modprobe.d/`. A root user with intent can always insert a module directly. - `modprobe --ignore-install ` - `modprobe`'s explicit escape hatch. The user is opting out of the install-line indirection that ModuleJail relies on. Both are intentional escape hatches in the kernel module loader. ModuleJail is a default-safe policy layer: it removes the auto-loading attack surface (udev hotplug + dependency resolution), which is what an unprivileged or remote attacker has to work with. It does not - and could not - prevent a root user with intent from loading anything they want. See the [Threat model](#threat-model) section above for the full framing, and [docs/DEFENSE-IN-DEPTH.md](docs/DEFENSE-IN-DEPTH.md) for recipes that close the root-with-intent gap (kernel lockdown mode, module signature enforcement, `kernel.modules_disabled=1`). ## Options reference | Option | Description | |--------|-------------| | `-p`, `--profile {minimal\|conservative\|desktop\|none}` | Built-in baseline profile (default: `conservative`). `none` carries no built-in baseline at all - only currently-loaded modules and any `--whitelist-file` entries are preserved. Recommended only when an explicit `--whitelist-file` is supplied (since v1.3) | | `-o`, `--output PATH` | Output path for the generated blacklist file (default: `/etc/modprobe.d/modulejail-blacklist.conf`) | | `--whitelist-file PATH` | Append module names from PATH to the keep-set. One module per line; `#` starts a comment. File must not be group- or world-writable. Default: `/etc/modulejail/whitelist.conf` | | `--no-whitelist-file` | Skip the default whitelist file even if present. Mutually exclusive with `--whitelist-file PATH` | | `--no-syslog-logging` | Force `/bin/true` install lines (v1.1.4 behavior). By default, blocked module loads are logged to syslog with tag `modulejail` | | `-f`, `--fail-on-module-load` | Blocked module loads return a non-zero exit code (`modprobe` fails loudly). Default: blocked loads silently succeed | | `--verbose-logging` | Enrich the per-blocked-load `logger` call with the caller's `ppid`, `loginuid`, `pcomm`, and `pexe` (read from `/proc/$PPID/...`). Requires `/usr/bin/logger`; mutually exclusive with `--no-syslog-logging`. Default `logger` output is the bare `"blocked: "` form (since v1.3.4) | | `--dry-run` | Compute the would-be blacklist and print a summary to stdout; do NOT write the output file or touch `/etc/modprobe.d/`. Header is rerouted to stderr. Exit code is `0` on simulated success (since v1.3) | | `--quiet` | Suppress all non-error stderr output (info lines, summary, header echo). Errors still surface. Mutually exclusive with `--verbose` (since v1.3) | | `--verbose` | Emit per-module decision lines on stderr (which module was kept, which was blacklisted, and why). Mutually exclusive with `--quiet` (since v1.3) | | `--output-format {json\|logfmt}` | Emit a machine-readable run summary to stdout instead of the default human-readable summary. JSON round-trips through `jq`; logfmt round-trips through standard logfmt parsers. 11-field schema v1 (`kernel_version`, `modules_available`, `modules_loaded`, `modules_blacklisted`, `fingerprint`, `output_path`, ...). Survives `--quiet` (since v1.3) | | `-V`, `--version` | Show program version and exit | | `-h`, `--help` | Show help text and exit | Environment variables: | Variable | Description | |----------|-------------| | `MODULEJAIL_NO_UPDATE_CHECK` | Set to any non-empty value to skip the post-run update check | | `MODULEJAIL_LOGGER_PATH` | Path to the logger binary for syslog install-line detection (default: `/usr/bin/logger`) | | `MODULEJAIL_DEFAULT_WHITELIST_FILE` | Override the auto-detected whitelist path (default: `/etc/modulejail/whitelist.conf`) | ## Exit codes Exit codes follow `sysexits.h` conventions (see `man 3 sysexits`). Fleet automation tools can `case $?` cleanly. | Code | Meaning | |------|---------| | 0 | success | | 64 | command-line argument error (bad flag, missing value, unknown profile) | | 65 | invalid data in `--whitelist-file` (malformed module name) | | 66 | required kernel input missing (`/proc/modules` or `/lib/modules/`) | | 70 | sanity guard tripped (empty blacklist or >99% of modules blacklisted) | | 71 | OS-level error (mktemp work dir, or find errors on `/lib/modules`) | | 73 | output path cannot be created (symlink/directory/trailing-slash, or mktemp failure) | | 77 | target directory not writable (try sudo, or use `-o `) | ## Idempotency contract Two consecutive runs on an unchanged host produce byte-identical output files. The generated blacklist header carries a sha256 run fingerprint, not a wall-clock timestamp, computed over the canonical inputs: sorted loaded-module set, sorted baseline set, sorted whitelist, profile name, and kernel version. Because the fingerprint is a deterministic function of inputs, identical inputs produce an identical fingerprint and thus an identical output file. ``` # fingerprint: sha256:e284ee9741eb544adf1af6c0fffc162dedd6029191673237a8155cd497908686 ``` Fleet operators can use the fingerprint to correlate "what was on the host at hardening time" across machines: two hosts with the same fingerprint had identical loaded sets, baseline, whitelist, profile, and kernel version when ModuleJail ran. No wall-clock drift, no spurious diffs in configuration management systems. ## Update check After a successful run, ModuleJail performs a best-effort lookup against the GitHub tags API to see whether a newer release is available. The check has a 10-second hard timeout and is silent on every failure mode (no network, no `curl` or `wget` installed, parse failure, current version equal to or newer than the latest tag). It only prints a stderr notice when the upstream release is strictly newer than the running version. To disable the check entirely (for offline fleets, restricted networks, or pipeline-style automation where any unexpected output is noise), set: ```sh export MODULEJAIL_NO_UPDATE_CHECK=1 ``` The check fires only on a successful run. Error paths (bad arguments, missing `/proc/modules`, sanity-guard trip, etc.) exit before reaching it. ## Cross-distro support ModuleJail has been verified across two confidence tiers. ### Real-kernel tier (live SSH hosts) | Distro | Kernel | Result | |--------|--------|--------| | Ubuntu 24.04.4 LTS (Noble Numbat) | 6.8.0-110-generic | PASS (6363 of 6474 modules blacklisted) | | Debian GNU/Linux 13.4 (trixie) | 6.12.74+deb13+1-amd64 | PASS (4091 of 4227 modules blacklisted) | | Rocky Linux 9.7 (Blue Onyx) | 5.14.0-503.35.1.el9_5.x86_64 | PASS (2253 of 2338 modules blacklisted) | | Arch Linux (rolling, 2026-05-23) | 7.0.9-arch2-1 | PASS (6416 of 6481 modules blacklisted) | Note for Rocky/RHEL hosts: on hosts with strict SELinux enforcement, non-root execution may encounter a `find` permission denial on `/lib/modules/`, causing exit code 71 (`EX_OSERR`). This is expected, documented behaviour. Use `sudo`, or relax the relevant SELinux policy, if this occurs. ### Fixture-container tier (synthetic kernel module trees) | Distro | Base image | Shell | Result | |--------|-----------|-------|--------| | Arch Linux (latest) | `archlinux:latest` | `/bin/sh` (bash) | PASS (10/10 assertions) | | Alpine Linux (latest) | `alpine:latest` | busybox ash | PASS (10/10 assertions) | | openSUSE Tumbleweed | `opensuse/tumbleweed:latest` | `/bin/sh` | PASS (10/10 assertions) | Fixture containers run against a synthetic `/lib/modules/6.99.0-fixture/` tree with representative `.ko`, `.ko.gz`, `.ko.xz`, and `.ko.zst` files to exercise all four suffix variants. The `MODULEJAIL_PROC_MODULES` and `MODULEJAIL_KVER` environment variables are test-only plumbing (analogous to `TMPDIR` or `GIT_DIR`) used by the fixture harness to point the script at synthetic `/proc/modules` and module tree paths. End-user operators leave these unset. ## Reverting Remove the generated file. The blacklist is consulted by `modprobe` at load time, not loaded into the kernel persistently, so removing the file takes effect immediately - no reboot needed. ```sh # Full revert (instant, no reboot needed): sudo rm /etc/modprobe.d/modulejail-blacklist.conf # Selective: bring back a specific module right now, even while the # blacklist file is still in place (`modprobe` is the explicit-load # path that overrides the blacklist): sudo modprobe ``` The generated file uses `install ...` directives (with either a `/bin/sh + logger` body or `/bin/true`, see *Viewing blocked module attempts* above), which block autoloading via udev events and dependency resolution. Explicit `sudo modprobe ` invocations override the blacklist immediately, regardless of whether the file is still present. If the file is still in place, the override applies only to that single explicit load - subsequent autoload attempts (from udev or other modules requiring the named module as a dependency) will be blocked again. To make the unblock permanent, remove the blacklist file. See *Scope of the blacklist* above for the precise list of what `modprobe.d` install directives do and do not intercept. ## Community resources Operator-authored knowledge bases and packaging maintained outside the upstream repo: - **Manjaro forum HOWTO** - community wiki post covering installation via AUR, per-profile usage notes, operator-curated whitelist examples, and a reference database of 20+ kernel modules and the programs that need them. Authored by @andreas85; collaboratively edited (wiki-post format). https://forum.manjaro.org/t/howto-modulejail/187877 - **AUR packages** - Arch Linux User Repository. - [`modulejail`](https://aur.archlinux.org/packages/modulejail) - tagged-release package, maintained by upstream. Tracks the latest `vX.Y.Z` GitHub release. - [`modulejail-git`](https://aur.archlinux.org/packages/modulejail-git) - rolling-from-master package, maintained by @tjmnmk (with upstream as co-maintainer). Rebuilds from `master` HEAD on every `pacman -Syu`. For developers and early adopters; production operators should stay on `modulejail`. Have something to add? Open an issue or PR to extend this list; the project intentionally keeps these pointers in-repo rather than proliferating them across the documentation surface. ## Contributing ### Branching model - **`master`** tracks the latest stable release (currently `v1.3.6`). Every commit on `master` is shippable. Hotfixes to the current stable line and small backward-compatible improvements (docs, packaging, small baseline additions) land here. - **`v1.5-dev`** (and similar `vX.Y-dev` branches in the future) is the integration branch for an in-flight major or minor milestone. Feature PRs that target a future release go here. Prereleases (`vX.Y.0-beta.N`, `vX.Y.0-rc.N`) are cut from this branch. - When the milestone reaches stable, `vX.Y-dev` is merged into `master` and the next milestone's dev branch is created. PRs: - Bug fixes / small docs / packaging-only changes -> base against `master`. - New features / non-trivial behavior changes -> base against the current dev branch (`v1.5-dev` at the time of writing). - Unsure? Open the PR against `master`; we will retarget if needed. The AUR `modulejail-git` package builds from `master` HEAD (= rolling stable), not from the dev branch, so rolling-AUR users always get shippable code. ### Baseline-addition policy (since v1.3.4) Suggestions to add a module to `BASELINE_CONSERVATIVE` or `BASELINE_DESKTOP` are evaluated against a single rule: > Modules join a baseline only when there is observed operator pain in > that profile's target audience. CONSERVATIVE target = > bare-metal/VM Linux servers (hands-on admins, post-steady-state > runs). DESKTOP target = laptops/workstations (set-and-forget UX, > ModuleJail may run at any time including before all udev/late-load > events have settled). *"Defensive add because the kernel sometimes > loads it late"* is insufficient justification - a real operator- > reported breakage in the relevant profile's target audience is the > bar. The implication for issue / PR authors: when proposing a baseline addition, link the operator-side breakage report or describe the concrete workflow that breaks. Module names that don't have a real-world breakage report are better placed in your local `WHITELIST=` variable (or community-curated lists like the Manjaro forum HOWTO linked in *Community resources* below). `acpi_cpufreq` in `BASELINE_CONSERVATIVE` predates this policy (added in v1.3.2 with the same speculative reasoning the policy now disallows). It is retained for backward compatibility; no future additions follow the same pattern. ### Tests The test matrix lives in `tests/`. Both harnesses are POSIX shell scripts runnable by anyone with the prerequisites: ```sh # Container fixture suite (Arch/Alpine/openSUSE): # Requires: docker or podman; exits 77 if neither is found (graceful skip). ./tests/run-fixtures.sh # Real-SSH-host acceptance suite: # Requires: SSH key access to the hosts configured in the harness. ./tests/run-ssh-hosts.sh ``` `./tests/run-fixtures.sh` exits 77 on any host without a container runtime; that is the documented graceful degradation (autoconf/TAP skip convention). Run it on a Linux host with Docker or Podman. Both harnesses are shellcheck-clean (`shellcheck --shell=sh`). ## Star History Star History Chart ## License Copyright (C) 2026 Jasper Nuyens GPL-3.0-only. See the [LICENSE](LICENSE) file for the full text. jnuyens-modulejail-06d8d74/docs/000077500000000000000000000000001520651617500166325ustar00rootroot00000000000000jnuyens-modulejail-06d8d74/docs/DEFENSE-IN-DEPTH.md000066400000000000000000000510711520651617500213770ustar00rootroot00000000000000# Defense-in-depth recipes for ModuleJail ModuleJail is one layer in a larger kernel-hardening stack. This document covers two things: 1. The **threat surface ModuleJail is built to address** - kernel modules that unprivileged users can cause to load via ordinary syscalls, and which therefore become latent attack surface for the next privilege- escalation CVE in those modules. 2. **Recipes for stacking other kernel hardening on top of ModuleJail**, so a single defense gap does not become a chain to root. If you want the one-page summary, see the [Threat model](../README.md#threat-model) section in the README. This document is the long version. --- ## Part 1 - Who can load which kinds of kernel modules The Linux kernel autoloads modules in response to a wide set of triggers. For ModuleJail's purposes the interesting question is: **which of these triggers can an unprivileged local user reach, without already holding root or any administrator capability?** There are seven distinct trigger tiers. The first three are the practically-important ones; the rest are narrower but worth understanding. ### Tier 1 - Socket family and protocol autoload **Kernel mechanism:** `__sock_create()` calls `request_module("net-pf-%d", family)` if no handler is registered for the requested address family. After the family loads, `inet_create()` and siblings may further call `request_module("net-pf-%d-proto-%d-type-%d", ...)` for SOCK_RAW / SOCK_DGRAM / SOCK_SEQPACKET with a non-default `protocol` value. **Trigger:** a single `socket(2)` call. **Capability required:** none for the autoload itself. Some families do check a capability *after* loading (`AF_PACKET` checks `CAP_NET_RAW`; `AF_BLUETOOTH` HCI socket checks `CAP_NET_ADMIN`) but **the module is in memory and its `init()` code has already run** by then. The autoload happens before the capability check. Modules reachable this way, with recent CVE examples: | Family / proto | Module(s) autoloaded | Recent CVE | |---|---|---| | `AF_VSOCK` | `vsock`, `vmw_vsock_*`, `virtio_transport` | CVE-2025-21756 UAF, CVE-2025-40248 disconnect race | | `AF_INET / SOCK_RAW / IPPROTO_SCTP` | `sctp`, `sctp_diag` | CVE-2025-40331 TOCTOU in diag path | | `AF_INET / SOCK_DCCP` | `dccp_ipv4`, `dccp_ipv6` | Recurring UAFs; DCCP is deprecated upstream but still shipped | | `AF_TIPC` | `tipc` | CVE-2021-43267 remote RCE | | `AF_RDS` | `rds`, `rds_tcp`, `rds_rdma` | Multiple historical UAFs | | `AF_CAN` | `can`, `can_raw`, `can_bcm`, `can_gw`, `j1939` | Recurring `can_bcm` UAFs | | `AF_NFC` | `nfc`, `nci`, `nci_core` | CVE-2024-26581 OOB | | `AF_X25 / AX25 / NETROM / ROSE / DECNET / IPX / APPLETALK` | namesake modules | Legacy. Many distros ship `blacklist net-pf-N` for these out of the box. | | `AF_LLC` (proto 2) | `llc2` | Dead infrastructure; trivial trigger | | `AF_MCTP` | `mctp` | Newer (5.15+); thin audit | | `AF_QIPCRTR` | `qrtr`, `qrtr_*` | Qualcomm IPC; CVE-2024 UAFs | | `AF_SMC` | `smc`, `smc_diag` | RDMA over IP; CVE-2024 series | | `AF_BLUETOOTH` | `bluetooth`, then `l2cap`, `rfcomm`, `bnep`, `hidp`, `cmtp` | RCE history (BlueBorne family) | A complete demonstration that an unprivileged user can drive five different module loads from one program, with no capabilities at all: ```c int s = socket(AF_VSOCK, SOCK_STREAM, 0); /* autoloads vsock + transport */ int t = socket(AF_INET, SOCK_RAW, IPPROTO_SCTP); /* autoloads sctp */ int u = socket(AF_TIPC, SOCK_SEQPACKET, 0); /* autoloads tipc */ int v = socket(AF_CAN, SOCK_RAW, CAN_RAW); /* autoloads can + can_raw */ int w = socket(AF_X25, SOCK_SEQPACKET, 0); /* autoloads x25 */ ``` Each `socket()` may return `-EPERM`. That does not undo the load. **ModuleJail coverage:** strong. The `conservative` baseline holds none of these. On any host where `lsmod` does not currently show one of these, ModuleJail blacklists it; the next `socket()` call returns `-EAFNOSUPPORT` or `-EPROTONOSUPPORT` and no module is loaded. ### Tier 2 - AF_ALG crypto autoload **Kernel mechanism:** `socket(AF_ALG, SOCK_SEQPACKET, 0)` returns a socket; `bind()` with a `struct sockaddr_alg` containing an algorithm name calls `request_module("algif-type-X")` AND `request_module("crypto-X")` to pull in both the algif glue and the algorithm implementation. **Trigger:** `socket()` + `bind()`. **Capability required:** none. | Module class | Examples | Notable CVE | |---|---|---| | `algif_*` glue | `algif_skcipher`, `algif_hash`, `algif_aead`, `algif_rng` | **CVE-2026-31431 "Copy Fail"** — splice + AF_ALG → 4-byte arbitrary write to page-cache → setuid binary corruption → root | | Cipher implementations | `aria`, `aegis128`, `chacha20poly1305`, `sm4`, `streebog`, `serpent`, `twofish`, `camellia`, `cast5/6`, `tea`, `tgr192`, `wp512` | Several OOB-read CVEs across the family | | Mode implementations | `cts`, `lrw`, `xcbc`, `vmac`, `pcrypt` | `pcrypt` parallel crypto; historical races | Trigger code: ```c int s = socket(AF_ALG, SOCK_SEQPACKET, 0); struct sockaddr_alg sa = { .salg_family = AF_ALG }; strcpy((char*)sa.salg_type, "aead"); strcpy((char*)sa.salg_name, "rfc4106(gcm(aria))"); /* autoloads aria + gcm + algif_aead */ bind(s, (struct sockaddr*)&sa, sizeof(sa)); ``` **The Copy Fail (CVE-2026-31431) connection:** the mitigation every upstream advisory recommends - `install algif_aead /bin/false` in `/etc/modprobe.d/disable-algif-aead.conf` - is one line of what ModuleJail generates automatically, applied to the entire class of unused crypto glue modules. This is the most direct fit between ModuleJail's design and the May 2026 marquee CVE. **ModuleJail coverage:** excellent for `algif_*` (not in any baseline → blacklisted on every host that is not actively using AF_ALG via `cryptsetup`, kTLS over QUIC, or similar). Correct for the primitives (`aes_generic`, `aesni_intel`, `sha256_generic`, `xts`, `cbc` are kept because dm-crypt, WireGuard, kTLS all need them at runtime). ### Tier 3 - Filesystem autoload via setuid mount helpers **Kernel mechanism:** `mount(2)` calls `request_module("fs-%s", fstype)`. The bare syscall needs `CAP_SYS_ADMIN`, but setuid helpers can do the load on the user's behalf. | Helper | Module(s) loaded | Notes | |---|---|---| | `/usr/bin/fusermount3` | `fuse` | Any user; sshfs, snap, AppImage all go through this | | `/usr/bin/ntfs-3g` (when setuid) | `fuse` | Same indirection | | `/usr/sbin/mount.cifs` | `cifs`, `nls_*` | Common on hosts with SMB shares | | `/usr/sbin/mount.ecryptfs_private` | `ecryptfs` | Has had its own CVEs; some distros dropped the setuid | **Plus a non-mount autoload path for the same modules:** some filesystem modules also register kernel key types and request-key upcalls. The kernel `cifs.ko` module registers the `cifs.spnego` key type at module-init time; once loaded, an unprivileged user can call `request_key("cifs.spnego", attacker_controlled_description, ...)`, which the kernel routes to the userspace `cifs.upcall` helper running as root. The helper trusts the attacker-supplied description fields as if they came from the kernel CIFS client - the basis of the **CIFSwitch** disclosure (May 2026). On a host where `cifs.ko` is not loaded, `request_key()` returns `-ENOKEY` and the chain breaks at step one; on a host where `cifs.ko` IS loaded (CIFS-client host that mounts SMB shares), modulejail's blacklist alone does not protect, and the host needs the upstream kernel patch. **ModuleJail coverage:** aggressive. `fuse`, `cifs`, `nfs`, `nfsv3`, `nfsv4`, `ceph`, `ecryptfs` are not in any baseline, so they get blacklisted by default on hosts that are not actively using those filesystems. **If your operators use sshfs, snap mounts, AppImages, or `ntfs-3g`, add `fuse` to your sysadmin WHITELIST. If your hosts mount SMB shares as CIFS clients, add `cifs` (and `nls_*` if specific code pages are needed). NFS-mounting clients need `nfs` + the protocol versions in use. Samba SERVERS (running `smbd`) and `ksmbd` SERVERS do not need `cifs.ko` and should leave it blacklisted.** ### Tier 4 - binfmt autoload via execve() **Kernel mechanism:** `execve()` of a file iterates registered binfmt handlers; if none match a magic / extension, `request_module("binfmt-XXXX", magic)` is called. | Module | Triggered by | |---|---| | `binfmt_misc` | Files matching a registered handler (qemu-user, Java jars, Mono) | | `binfmt_aout` | a.out magic - you can craft a 4-byte file and `execve()` it | | `binfmt_em86` | EM86 magic | | `binfmt_flat` | uClinux flat-binary magic | Surface is small but the modules are old and lightly-audited. **ModuleJail coverage:** all four blacklisted by default in every profile. Correct. ### Tier 5 - Character-device autoload via /dev/X open **Kernel mechanism:** opening a character device file with no driver bound to its major:minor calls `request_module("char-major-%d-%d", major, minor)`. Some distros pre-create `/dev/X` nodes via static udev rules even when no module is loaded; the open then triggers the load. Practical examples: `/dev/ppp` → `ppp_generic`, `/dev/net/tun` → `tun`, `/dev/uinput` → `uinput`, `/dev/loop-control` → `loop`. **Reality check:** this tier is mostly defended on a default modern install because the device nodes are themselves created in response to module-init events. The pre-created-node path is largely historical (devfs era). **ModuleJail coverage:** indirect but correct - the modules are not in `lsmod` and so get blacklisted. ### Tier 6 - Netlink subsystem autoload **Kernel mechanism:** `socket(AF_NETLINK, SOCK_RAW, NETLINK_X)` triggers `request_module("net-pf-16-proto-%d", X)`. Some `NETLINK_X` values gate the capability check before, some after. | Family | Module | Notes | |---|---|---| | `NETLINK_NETFILTER` (12) | `nfnetlink`, `nf_tables`, `nfnetlink_log`, `nfnetlink_queue` | **The big one.** Almost every nf_tables LPE chain starts here. | | `NETLINK_GENERIC` (16) | usually built-in; loads per-family `genl` modules (`l2tp`, `gtp`, ...) | GTP CVE-2024 family | | `NETLINK_XFRM` (6) | `xfrm_user`, `xfrm_algo` | IPsec keying | ### Tier 7 - The user-namespace amplifier `unshare(CLONE_NEWUSER | CLONE_NEWNET)` is unprivileged on every mainstream distro that ships unprivileged user namespaces enabled (Debian, Fedora, Arch by default; Ubuntu since 24.04 with AppArmor-gated unprivileged-userns). Inside the new namespace, the caller has **full `CAP_NET_ADMIN`, `CAP_SYS_ADMIN`, `CAP_NET_RAW`** - the bits that gate Tier 1, Tier 5, Tier 6. **Effect:** every autoload trigger that had a "must hold CAP_X" gate becomes reachable by any unprivileged user. This is the mechanism behind: - CVE-2024-1086 (nf_tables UAF) - universal LPE via userns + netlink + tier-6 autoload - CVE-2023-35001 (nf_tables stack OOB) - same path - CVE-2022-34918 (nf_tables) - same path User namespaces are the single biggest amplifier of Tier 1, 5, 6 risk. Without them enabled, many of these LPE chains require root the attacker already has. See [Recipe 2](#recipe-2---disable-unprivileged-user-namespaces) below for the kill-switch. --- ## Part 2 - Defense-in-depth recipes The recipes below are stand-alone hardening steps that ModuleJail does not provide but that compose well with it. Each lists who it protects against, what it costs, and what breaks if you enable it. ### Recipe 1 - kernel.modules_disabled=1 (freeze the loader) **What it does:** sets a one-way kernel switch. Once enabled, **no further kernel modules can be loaded until the next reboot, by anyone, including root**. Even `insmod /path/to/module.ko` fails with `-EPERM`. **Who it protects against:** an attacker who has already achieved root and wants to load a malicious kernel module (rootkit, debugger backdoor, hidden network sniffer) without rebooting. Pairs with ModuleJail: ModuleJail ensures only legitimate modules are auto-loadable while modules can still be loaded; this recipe says "and now we're done, freeze." **How to apply:** ```sh # After the last boot-time module has loaded and the host is in # steady-state, run: sudo sysctl -w kernel.modules_disabled=1 # To persist across reboots, add a one-line systemd oneshot unit that # runs after multi-user.target settled. Example /etc/systemd/system/ # modules-disabled.service: # # [Unit] # After=multi-user.target # RequiresMountsFor=/etc /proc # # [Service] # Type=oneshot # ExecStart=/sbin/sysctl -w kernel.modules_disabled=1 # RemainAfterExit=yes # # [Install] # WantedBy=multi-user.target ``` **What breaks:** any service that loads modules late (some VPN clients, USB hotplug for unusual devices, virtualization helpers that pull in modules on first guest start). Test on one host before deploying. **Trade-off:** one-way; the only way to load another module is to reboot. Most production servers reach steady state within 30 seconds of boot; this is the right time to flip the switch. ### Recipe 2 - Disable unprivileged user namespaces **What it does:** prevents unprivileged users from creating new user namespaces with `unshare(CLONE_NEWUSER)`. This closes Tier 7 (the amplifier) above. **Who it protects against:** every LPE chain that starts with `unshare()` to gain in-namespace `CAP_NET_ADMIN` / `CAP_SYS_ADMIN`. The entire nf_tables CVE family (CVE-2024-1086, CVE-2023-35001, CVE-2022-34918, ...) is mitigated by this single switch. **How to apply:** - **Debian, Fedora, Arch:** ```sh echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-no-userns.conf sudo sysctl --system ``` - **Ubuntu (24.04+):** the corresponding control is an AppArmor profile. Edit `/etc/apparmor.d/abstractions/userns` or remove the `userns,` capability from the profiles that grant it. The simpler equivalent: ```sh echo 'kernel.apparmor_restrict_unprivileged_userns=1' | sudo tee /etc/sysctl.d/99-no-userns.conf sudo sysctl --system ``` **What breaks:** container runtimes that use unprivileged user namespaces (rootless Podman, rootless Docker, BubbleWrap-based sandboxes including Flatpak, some browsers' sandboxing). On servers without containerised workloads, this is usually free. On developer workstations, expect breakage. **Trade-off:** Edera's 2024 study found enabling unprivileged userns expands the unprivileged kernel attack surface by **262%**. If your host does not run unprivileged containers, the disable is almost pure win. ### Recipe 3 - Secure Boot + kernel lockdown mode **What it does:** when Secure Boot is enabled and the kernel boots in `lockdown=integrity` (or `lockdown=confidentiality`) mode, root loses the ability to load unsigned modules, write `/dev/mem`, use `kexec` to boot unsigned images, attach `kprobes` / `kgdb`, and several other privileged channels. **Who it protects against:** the strongest layer in this stack against a malicious root user. A compromised root can no longer just `insmod rootkit.ko` even with a valid module file - the kernel will refuse unsigned modules outright. **How to apply:** distro-specific, but the high-level path is: 1. Enable Secure Boot in firmware. Enroll the distro's Microsoft-signed shim or your own MOK. 2. Boot a distro kernel that supports lockdown. All mainstream distros (Debian, Fedora, Ubuntu, openSUSE) ship lockdown-aware kernels. 3. Verify with `cat /sys/kernel/security/lockdown` - should show `[integrity]` or `[confidentiality]`. **What breaks:** out-of-tree modules that are not signed (the NVIDIA proprietary driver, ZFS, VirtualBox modules, custom kernel modules built by the operator). These need to be signed against an MOK enrolled in the firmware. The DKMS framework on modern distros handles MOK signing if the operator follows the prompts at install time. **Trade-off:** the highest assurance available short of fully measured boot, but the firmware-enrollment dance is a one-time effort per host. ### Recipe 4 - Module signature enforcement **What it does:** the in-kernel `CONFIG_MODULE_SIG_FORCE=y` (or the runtime equivalent `module.sig_enforce=1` on the kernel command line) makes the kernel refuse any module that is not signed with a key in its trusted keyring. Lighter-weight than full lockdown. **Who it protects against:** a root user (or a process that has achieved arbitrary kernel writes via a CVE) that wants to load a custom module. The module file would have to be signed; without the signing key, it cannot. **How to apply:** ```sh # Most distros ship modules signed already; the runtime enforcement # switch can be flipped via kernel command line. Add to GRUB config: echo 'GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT module.sig_enforce=1"' \ | sudo tee -a /etc/default/grub sudo update-grub # or grub2-mkconfig -o /boot/grub2/grub.cfg # Verify after reboot: cat /sys/module/module/parameters/sig_enforce # should be Y ``` **What breaks:** same as Recipe 3 - unsigned out-of-tree modules. The DKMS sign-with-MOK workflow handles this; manual `insmod`'ing a built module won't. **Trade-off:** strictly weaker than lockdown but doesn't require Secure Boot. Useful on hosts where the firmware path is not available (rented VMs, older hardware). ### Recipe 5 - Seccomp-bpf at the application layer **What it does:** application-level filter that lists allowed syscalls; everything else returns `EPERM`. A web server that never needs to talk to the kernel via `socket(AF_VSOCK, ...)` should never be able to. **Who it protects against:** a partial compromise of a single service (SSRF, deserialisation bug, unsafe upload handler) where the attacker has the service's execution context but not arbitrary syscall ability. A seccomp filter that denies `socket()` for unusual families closes the Tier 1 autoload path for that service. **How to apply:** ```sh # systemd service hardening (one line per restriction): [Service] RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX # whitelist; deny everything else SystemCallFilter=@system-service SystemCallFilter=~@privileged LockPersonality=yes NoNewPrivileges=yes ProtectKernelModules=yes ProtectKernelTunables=yes ``` **What breaks:** depends entirely on the service. Test under load. Tools like `strace -c` and `systemd-analyze syscall-filter` help build the allowlist. **Trade-off:** scales per-service rather than per-host. Pair with ModuleJail for hosts that run many services with different syscall needs; ModuleJail closes the auto-load surface globally, seccomp closes specific syscalls per service. --- ## How the recipes stack A reasonable production stack, in order of operational cost: 1. **ModuleJail at install time** - removes the auto-load surface for every unused module. Cost: one shell-script run per host. 2. **`kernel.unprivileged_userns_clone=0`** (Recipe 2) on servers - kills Tier 7 amplification. Cost: one sysctl line. Free on hosts without unprivileged containers. 3. **Module signature enforcement** (Recipe 4) - kernel command line addition. Cost: one reboot, requires MOK for any out-of-tree modules. 4. **`kernel.modules_disabled=1` after boot settles** (Recipe 1) - freezes the loader. Cost: one systemd unit, requires verification that no service loads modules late. 5. **Secure Boot + lockdown** (Recipe 3) - the highest layer. Cost: one- time firmware-enrollment effort per host. 6. **Seccomp per service** (Recipe 5) - depth on the most exposed services. Cost: per-service profile authoring. ModuleJail is Step 1 because it has the lowest deployment cost, defends the largest class of CVEs (every "unprivileged-user autoloads vulnerable module → LPE" chain), and does not require a reboot. The other recipes each add one more layer that an attacker has to bypass. --- ## Sources - [Copy Fail (CVE-2026-31431) — Wiz](https://www.wiz.io/blog/copyfail-cve-2026-31431-linux-privilege-escalation-vulnerability) - [CVE-2026-31431 Sysdig analysis (mitigation = install algif_aead /bin/false)](https://www.sysdig.com/blog/cve-2026-31431-copy-fail-linux-kernel-flaw-lets-local-users-gain-root-in-seconds) - [CIFSwitch - 19-year-old Linux CIFS trust-boundary bug (CIQ, May 2026)](https://ciq.com/blog/cifswitch-ai-19-year-bug) - [CVE-2025-21756 vsock UAF — SentinelOne](https://www.sentinelone.com/vulnerability-database/cve-2025-21756/) - [CVE-2025-40331 SCTP TOCTOU (NVD)](https://nvd.nist.gov/vuln/detail/CVE-2025-40331) - [TIPC remote RCE (CVE-2021-43267)](https://www.sentinelone.com/labs/tipc-remote-linux-kernel-heap-overflow-allows-arbitrary-code-execution/) - [User namespaces add 262% kernel attack surface — Edera](https://edera.dev/stories/user-namespaces-are-not-a-security-boundary) - [Linux kernel module autoloading — duasynt](https://duasynt.com/blog/linux-kernel-module-autoloading) - [Restricting automatic kernel-module loading — LWN](https://lwn.net/Articles/740455/) - [Hardening Linux against netlink socket privesc](https://www.systemshardening.com/articles/linux/linux-netlink-socket-hardening/) - [xairy/linux-kernel-exploitation (curated index)](https://github.com/xairy/linux-kernel-exploitation) jnuyens-modulejail-06d8d74/examples/000077500000000000000000000000001520651617500175205ustar00rootroot00000000000000jnuyens-modulejail-06d8d74/examples/blocked-module-popup.sh000077500000000000000000000031551520651617500241120ustar00rootroot00000000000000#!/usr/bin/env bash # blocked-module-popup.sh - desktop popup on every blocked module load. # # Source: contributed by @teou1 (GitHub issue #12, 2026-05-24). # Cherry-picked into the modulejail repo with the author's explicit # permission. See: https://github.com/jnuyens/modulejail/issues/12 # # What it does: tails `journalctl -t modulejail` and fires a `notify-send` # popup for each line. modulejail emits one such line per blocked module- # load attempt when syslog visibility is enabled (the v1.2.0 default; see # `man 8 modulejail` -> SYSLOG VISIBILITY). # # Why it's an example, not a modulejail feature: a popup means a longer- # running thing watching the journal, which would cross the v1 "no # daemons" line in CLAUDE.md / PROJECT.md. The popup itself is on the # v2.0-alpha "Managed Mode" roadmap. This script side-steps the contract # by being separately operator-launched (typically as a user-session # unit or a desktop autostart entry), not started by modulejail itself. # # Requirements: bash, journalctl, libnotify (notify-send). All standard # on systemd + desktop-environment hosts. # # Usage: # ./blocked-module-popup.sh & # one-shot foreground/background # systemctl --user enable --now \ # persistent user-session unit # modulejail-popup.service # (operator writes the unit) # # initial sleep so that a bunch of blocked modules at boot are not showed sleep 37 journalctl -f -t modulejail --since "1 sec ago" -o cat | while read -r LINE; do # if echo "$LINE" | grep -E "blocked" --ignore-case; then notify-send "Modulejail" "$LINE" --icon=dialog-warning # fi done jnuyens-modulejail-06d8d74/man/000077500000000000000000000000001520651617500164555ustar00rootroot00000000000000jnuyens-modulejail-06d8d74/man/modulejail.8.in000066400000000000000000000564071520651617500213140ustar00rootroot00000000000000.\" Manpage for modulejail. .\" Source: man/modulejail.8.in (templated; build.sh substitutes __VERSION__ and __DATE__). .\" View installed: man 8 modulejail .\" v1.2 flags documented below: --whitelist-file PATH, --no-syslog-logging .\" (the OPTIONS section uses roff hyphen escapes \-\- so these strings appear .\" with literal ASCII dashes only in this comment, for grep-based contract checks.) .TH MODULEJAIL 8 "__DATE__" "modulejail __VERSION__" "System Administration" .SH NAME modulejail \- shrink a Linux host's kernel-module attack surface .SH SYNOPSIS .B modulejail .RB [ \-p .IR profile ] .RB [ \-o .IR output ] .RB [ \-\-whitelist\-file .IR path ] .RB [ \-\-no\-syslog\-logging ] .RB [ \-\-verbose\-logging ] .RB [ \-\-dry\-run ] .RB [ \-\-quiet | \-\-verbose ] .RB [ \-f ] .RB [ \-\-output\-format .IR format ] .br .B modulejail .RB { \-h | \-\-help | \-V | \-\-version } .SH DESCRIPTION .B modulejail shrinks the kernel-module attack surface of a Linux host by writing a .BR modprobe.d (5) blacklist file that disables every kernel module not currently in use. .PP On invocation, the script snapshots the set of currently loaded modules from .I /proc/modules and computes the complement against the full module tree under .IR /lib/modules/$(uname\ -r) . Every module in the complement, minus a built-in baseline of essential modules and an optional sysadmin-supplied whitelist, is emitted as an .B install .I mod .I directive in .I /etc/modprobe.d/modulejail-blacklist.conf (or the path passed to .BR \-o ). Since v1.2, when .I /usr/bin/logger is executable on the host and .B \-\-no\-syslog\-logging is not set, .I is a small shell invocation that calls .BR logger (1) with tag .B modulejail so blocked module load attempts produce a syslog entry; otherwise .I is .BR /bin/true , matching the silent v1.1.4 behaviour. See .B VIEWING BLOCKED ATTEMPTS below. .PP The script is a POSIX-friendly .B /bin/sh program with no runtime dependencies beyond .BR awk , .BR comm , .BR find , .BR sha256sum , and standard coreutils. It is aimed at Linux fleet operators who need to harden many servers against the wave of AI-assisted kernel privilege-escalation discoveries: every additional loaded module is additional latent attack surface for the next disclosed CVE. .SH OPTIONS .TP .BR \-p ", " \-\-profile " " {minimal|conservative|desktop|none} Select the built-in baseline profile of always-preserved modules (default: .BR conservative ). See .B PROFILES below. .PP The special value .B none zeroes the built-in baseline; the keep-set becomes the union of currently loaded modules, the in-script .BR WHITELIST , and any .B \-\-whitelist\-file additions. The .B >99% blacklist sanity guard is disabled under .B \-p\ none (the loaded-keep invariant remains the boot-safety contract). recommended only when .B \-\-whitelist\-file is supplied, so that essential modules not currently loaded are still preserved. Available since v1.3. .TP .BR \-o ", " \-\-output " " \fIpath\fR Write the generated blacklist to .IR path (default: .IR /etc/modprobe.d/modulejail-blacklist.conf ). The target directory must be writable; non-root invocations are supported when the chosen path lies outside .IR /etc/modprobe.d/ . .TP .BR \-\-whitelist\-file " " \fIpath\fR Read site-local module names from .I path and append them to the in-script .B WHITELIST (additive). The file is in the format described under .B SITE-LOCAL WHITELIST FILE below: one module name per line, with .B # introducing a comment and blank lines ignored. Each non-comment line must match .B [a-zA-Z0-9_-]+ exactly; malformed lines exit .B 65 .RB ( EX_DATAERR ) with a line-numbered stderr diagnostic. The file mode must not be group- or world-writable; if it is, .B modulejail exits .B 77 .RB ( EX_NOPERM ) and prints a .B chmod go-w hint. When this flag is not given, .B modulejail auto-detects .I /etc/modulejail/whitelist.conf and uses it if present (and prints an .B info: line on stderr noting the choice). Pass .B \-\-no\-whitelist\-file to skip the default for one run. Available since v1.2. .TP .BR \-\-no\-whitelist\-file Skip the default whitelist file even if .I /etc/modulejail/whitelist.conf is present. mutually exclusive with .B \-\-whitelist\-file .IR path ; combining them exits .B 64 .RB ( EX_USAGE ). Use during recovery, or when you want a guaranteed-empty external whitelist contribution for a single run. Available since v1.2. .TP .BR \-\-no\-syslog\-logging Force the v1.1.4-style .B "install /bin/true" install-line body, suppressing the default-on syslog emission added in v1.2. Use this on hosts without .IR /usr/bin/logger , in minimal or initramfs builds, or when a byte-identical regression contract across versions is required. Available since v1.2. .TP .BR \-\-dry\-run Simulate the full pipeline without writing any file. Prints a one-line .B DRY-RUN: would blacklist summary to stdout (or a JSON/logfmt object when .B \-\-output\-format is set). Prints the would-be 8-line header block plus the full set of would-be .B install directives to stderr (unless .B \-\-quiet is also set). Writes nothing under .IR /etc/modprobe.d/ or the path passed to .BR \-o . Exits .B 0 on simulated success. Useful for previewing what would be blacklisted before committing a profile change or whitelist edit; redirect stderr to a file to capture the preview output. Available since v1.3. .TP .BR \-\-quiet Suppress all non-error stderr output: the default-whitelist .B info: line, the .B \-p\ none .B info: line, the dry-run would-be header block, and the update-check .B notice: line. Also suppresses the stdout summary line. Severity-prefixed .B error: messages on stderr are never suppressed, so .BR EX_USAGE , .BR EX_NOPERM , and .B EX_SOFTWARE failures remain visible. mutually exclusive with .BR \-\-verbose ; combining them exits .B 64 .RB ( EX_USAGE ). Available since v1.3. .TP .BR \-\-verbose Emit one decision line per module to stderr, in the form .B "keep: NAME (loaded|whitelist|baseline)" or .BR "blacklist: NAME" . Reasons are shown only for .B keep lines. Precedence among keep-sources: loaded > whitelist > baseline. These lines carry no severity prefix (they are operator-requested telemetry, not script-status diagnostics). mutually exclusive with .BR \-\-quiet ; combining them exits .B 64 .RB ( EX_USAGE ). Available since v1.3. .TP .BR \-\-output\-format " " {json|logfmt} Emit a single-line machine-readable run summary on stdout .I instead of the human-readable summary line. Valid formats are .B json and .BR logfmt . See .B OUTPUT FORMATS below for the full 11-field schema v1. The machine-readable output is not silenced by .BR \-\-quiet ; it is the parser surface. Combinable with .B \-\-dry\-run (the JSON/logfmt .B dry_run field becomes .B true and .B output_path is the would-be path; no file is written). Available since v1.3. .TP .BR \-f ", " \-\-fail\-on\-module\-load Make blocked module loads return a non-zero exit code so that .B modprobe fails loudly for blacklisted modules. By default, blocked loads silently succeed .RB ( modprobe returns 0 even though the module was not loaded). With this flag, the install-line body uses .B /bin/false instead of .B "exit 0" or .BR /bin/true , so .B modprobe returns non-zero for any blacklisted module. Use this when blocked loads should produce a visible error rather than silently succeeding. .TP .B \-\-verbose\-logging Enrich the per-blocked-load .B logger call with the caller context, read from .IR /proc/$PPID/ ":" the parent PID .RB ( ppid ), the audit .B loginuid (persists across .BR su / sudo ), the parent's short command name .RB ( pcomm ), and .B argv[0] .RB ( pexe , truncated at the first NUL by command substitution; full .B cmdline is one .B "ps -fp " away). Default .B logger output is the bare .IR "blocked: " form. Requires .I /usr/bin/logger to be executable (modulejail exits .B 66 .RB ( EX_NOINPUT ) otherwise); mutually exclusive with .BR \-\-no\-syslog\-logging . Available since v1.3.4. .TP .BR \-V ", " \-\-version Print version, repository URL, and license, then exit .BR 0 . .TP .BR \-h ", " \-\-help Print a usage summary including exit codes and environment, then exit .BR 0 . .SH PROFILES .TP .B minimal Core filesystems plus essential kernel modules only. .TP .B conservative Minimal plus common server and VM drivers. The default; appropriate for virtualised or bare-metal Linux servers across the mainstream hardware matrix. .TP .B desktop Conservative plus WiFi, Bluetooth, audio, and video drivers. For laptops and workstations. .SH SYSADMIN WHITELIST A site-local .B WHITELIST variable near the top of the script holds space-separated module names that are always preserved, beyond the selected baseline. It ships empty. Edit the script in place and look for the .B "=== SYSADMIN WHITELIST ===" banner. The .B === anchors are designed for Ansible template insertion .RB ( lineinfile " or " blockinfile ). .PP Since v1.2, an external file is also supported via .BR \-\-whitelist\-file ; see .B SITE-LOCAL WHITELIST FILE below. The two mechanisms are additive: the in-script value remains the sysadmin's editable default, the file appends to it. .SH SITE-LOCAL WHITELIST FILE The .B \-\-whitelist\-file flag reads modules to keep from an operator-chosen file. This is the preferred path when modulejail is installed via .BR .deb / .rpm / .B "curl | sh" and editing the script in place would lose site-local additions on the next reinstall. .PP If the flag is not passed, .B modulejail auto-detects .I /etc/modulejail/whitelist.conf and uses it when present, with the same strict mode and content gates as an explicitly-passed path. An .B info: line is printed on stderr so the choice is never silent. Pass .B \-\-no\-whitelist\-file to opt out for one run. .PP File format: .RS 4 .EX # Comments start with # and run to end of line. # Blank lines are ignored. # Each non-comment line is one module name, matching [a-zA-Z0-9_-]+. # Trailing whitespace and CR (CRLF endings) are stripped silently. # Module names are accepted in both dash and underscore form; # the pipeline normalises - to _ internally. nft_compat xt_owner zfs .EE .RE .PP File mode must not be group-writable or world-writable (the same hardening that .BR sshd (8) applies to .I authorized_keys and that .BR sudo (8) applies to .IR sudoers ). .B modulejail calls .BR stat (1) with the GNU .B \-c '%a' form, falling back to the BSD .B \-f '%Lp' form for cross-distro portability; if either group- or world-write bits are set, it refuses to run with exit code .B 77 .RB ( EX_NOPERM ) and prints .B chmod go-w PATH as the remediation hint. .SH OUTPUT FORMATS When .B \-\-output\-format\ json or .B \-\-output\-format\ logfmt is passed, .B modulejail emits a single-line machine-readable run summary to stdout instead of the human-readable line. The schema is small, versioned, and additive-only across future schema versions. .SS "Schema version 1 fields" .RS 4 .EX schema_version integer (always 1) tool object {name, version} kernel_version string (host uname -r output) profile string (minimal|conservative|desktop|none) dry_run boolean (true when --dry-run was passed) whitelist_file string or null (null when no --whitelist-file) modules_available integer (total .ko* files under /lib/modules/KVER) modules_loaded integer (lines in /proc/modules at snapshot time) modules_blacklisted integer (entries written to the output file) fingerprint string (64-char lowercase hex, no "sha256:" prefix) output_path string (target path; under --dry-run, the would-be path) .EE .RE .SS "JSON example" .RS 4 .EX {"schema_version":1,"tool":{"name":"modulejail","version":"1.3.0"}, "kernel_version":"6.8.0-31-generic","profile":"conservative", "dry_run":false,"whitelist_file":"/etc/modulejail/whitelist.conf", "modules_available":4912,"modules_loaded":47, "modules_blacklisted":4810,"fingerprint":"a3f5b9c2e1d4...", "output_path":"/etc/modprobe.d/modulejail-blacklist.conf"} .EE .RE .SS "logfmt example" .RS 4 .EX schema_version=1 tool_name=modulejail tool_version=1.3.0 kernel_version=6.8.0-31-generic profile=conservative dry_run=false whitelist_file=/etc/modulejail/whitelist.conf modules_available=4912 modules_loaded=47 modules_blacklisted=4810 fingerprint=a3f5b9c2e1d4... output_path=/etc/modprobe.d/modulejail-blacklist.conf .EE .RE .SS "Fleet automation idiom" Without .BR \-\-quiet , .B modulejail may emit human-readable .B info: lines to stderr (for example, the default-whitelist notice or the .B \-p\ none sanity-guard notice) alongside the machine-readable stdout record. Fleet automation that captures stderr into a unified log .RB ( 2>&1 ) will receive both the structured output and these human-readable lines. To suppress all non-error stderr output while keeping the structured stdout record intact, combine .B \-\-output\-format with .BR \-\-quiet : .PP .RS 4 .EX modulejail \-\-output\-format json \-\-quiet | jq . modulejail \-\-output\-format logfmt \-\-quiet .EE .RE .PP .B \-\-quiet never suppresses the machine-readable stdout record, only the human-targeted stderr diagnostics. .SS "Fingerprint format" The .B fingerprint field in JSON and logfmt output is raw 64-character lowercase hex without the .B sha256: prefix that appears in the generated file header .RB ( "# fingerprint: sha256:HEX" ). Machine consumers parsing via .BR jq (1) or awk do not need string slicing to extract the hash; the file header keeps the algorithm tag for human auditability. .SS "Schema stability contract" .B schema_version=1 is stable. Future schema versions are strictly additive: new fields may be added; renames and removals require .BR schema_version=2 . This mirrors the reproducible-builds.org stability convention: field semantics locked once published. .SS "Known limitation" Operator-supplied paths containing a literal double-quote character .RB ( \[dq] ), a backslash .RB ( \e ), or a newline are not JSON-escaped in the v1 schema. Real-world paths essentially never contain these characters, but operators using exotic paths may receive malformed JSON and a .BR jq (1) parse error. A future .B schema_version may add full path escaping. .SH VIEWING BLOCKED ATTEMPTS Since v1.2, when .I /usr/bin/logger is executable on the host running .B modulejail and .B \-\-no\-syslog\-logging is not set, the generated install lines emit a syslog entry tagged .B modulejail each time a blocked module is targeted by .BR modprobe (8). View the entries via: .PP .RS .EX journalctl \-t modulejail \-\-since '1 hour ago' # systemd / journald grep modulejail /var/log/syslog # classic syslog .EE .RE .PP The generated blacklist file's header annotation records which install-line form is in use: .PP .RS .EX # install-line: /bin/sh + logger (syslog tag: modulejail) # install-line: /bin/true (silent, --no-syslog-logging or logger absent) .EE .RE .PP If .I /usr/bin/logger is absent and .B \-\-no\-syslog\-logging was NOT set, modulejail silently falls back to the .B /bin/true form. No stderr warning is emitted; the header annotation is the only visible cue. Use .B \-\-no\-syslog\-logging explicitly when the v1.1.4 install-line body is a hard requirement. .SH INVOCATION A header line starting with .B # invocation: is added to the blacklist, which registers the invocation that was used to produce the blacklist, and can be copied and pasted into the terminal for reproducible results. .SH HEADER FIELDS The generated blacklist file carries an 8-line .B # -prefixed header documenting the tool version, repository, generation profile, host kernel, fingerprint, install-line form, invocation, and a do-not-edit-by-hand disclaimer. .TP .B "# modulejail VERSION" Tool name and version that produced the file. .TP .B "# https://github.com/jnuyens/modulejail" Repository URL for reproducibility and auditing. .TP .B "# profile: PROFILE" The profile name passed to .B \-p (or .B conservative when the default was used). .TP .B "# kernel: KVER" The host kernel version string from .BR "uname -r" at the time modulejail ran. This is the same value as the .B kernel_version field in the JSON and logfmt output (see .B OUTPUT FORMATS above). .TP .B "# fingerprint: sha256:HEX" A sha256 hash over canonical inputs: sorted loaded-module set, sorted baseline, sorted whitelist, profile name, and kernel version. The .B sha256: prefix identifies the algorithm for human readers; the JSON and logfmt .B fingerprint field strips this prefix and carries raw hex only. .TP .B "# install-line: FORM" Records which install-line body is in use: .B "/bin/sh + logger (syslog tag: modulejail)" or .BR "/bin/true (silent, --no-syslog-logging or logger absent)" . .TP .B "# invocation: ARGV-STRING" The full command line that produced the file, in POSIX-canonical single-quote encoding. See .B INVOCATION above. .TP .B "# Do not edit by hand -- regenerate with modulejail(8)." Disclaimer. Edits are overwritten on the next run. .PP The .B # kernel: line is regression-locked: test suite fixture .I header-kernel-line-locked.sh asserts that this line exists and carries a non-empty kernel-version token in every generated file. See .B OUTPUT FORMATS for the machine-readable schema that parallels these header fields. .SH SCOPE OF THE BLACKLIST A .BR modprobe.d (5) blacklist intercepts .BR modprobe (8)-mediated module loads: udev hotplug events, dependency resolution, autoloaded modules via the alias system. It does .B not intercept, by design: .TP .BR insmod (8) .B insmod bypasses .BR modprobe (8) entirely; it never reads .IR /etc/modprobe.d/ . A root user can always insert a .B .ko directly. .TP .B "modprobe --ignore-install" .BR modprobe (8)'s explicit escape hatch from install-line indirection. Treating it as suspicious is a higher-layer concern (auditd, eBPF) outside the .B modprobe.d contract. .PP .B modulejail is a default-safe policy on .BR modprobe (8). It removes the auto-loading attack surface that unprivileged code or remote attackers can reach, and it does not pretend to block a root user with intent. .SH SAFETY MODEL The invariant is: whatever is currently loaded is assumed necessary for the host to function, and is preserved. .B modulejail does not guess; it reads .I /proc/modules at run time and treats that exact set as the keep-list. The operator's responsibility is to run .B modulejail when the host is in a known-good, steady-state configuration: after all services are started, all kernel drivers loaded, all filesystems mounted. Running it on a partial or in-flux system risks blacklisting a module that is occasionally needed. .PP The built-in baseline ensures that core filesystems, storage controllers, and essential networking modules are never blacklisted regardless of the running profile. .SH IDEMPOTENCY Two consecutive runs on an unchanged host produce byte-identical output files. The generated blacklist header carries a .B sha256 fingerprint over canonical inputs (sorted loaded-module set, sorted baseline, sorted whitelist, profile name, and kernel version) rather than a wall-clock timestamp. Identical inputs therefore produce an identical fingerprint, and an identical output file. Fleet operators can use the fingerprint to correlate hardening state across machines: two hosts with the same fingerprint had identical loaded sets, baseline, whitelist, profile, and kernel version when .B modulejail ran. .SH EXIT CODES Exit codes follow .BR sysexits (3) conventions. .TP .B 0 Success. .TP .B 64 Command-line argument error: bad flag, missing value, or unknown profile. .TP .B 65 Invalid data in .B \-\-whitelist\-file .RI ( EX_DATAERR ): malformed module name on at least one non-comment, non-blank line. .TP .B 66 Required kernel input missing .RI ( /proc/modules or .IR /lib/modules/ ). .TP .B 70 Sanity guard tripped: the computed blacklist is empty, or covers more than 99% of the module universe. Aborting to avoid an unbootable host. .TP .B 71 OS-level error: cannot create the temporary work directory, or .B find reported errors walking .IR /lib/modules . .TP .B 73 Output path cannot be created: symlinked target, existing directory, trailing slash, or .B mktemp failure in the target directory. .TP .B 77 Target directory not writable. Try .BR sudo , or use .B \-o .IR other-path . .SH ENVIRONMENT .TP .B MODULEJAIL_NO_UPDATE_CHECK Set to any non-empty value to skip the post-run check for a newer release on GitHub. The check has a 10-second hard timeout and is silent on every failure mode; this variable disables it entirely for offline fleets, restricted networks, or pipeline-style automation where any unexpected output is noise. .TP .B MODULEJAIL_LOGGER_PATH Path to the .BR logger (1) binary used for the v1.2 syslog install-line detection (default: .IR /usr/bin/logger ). .B Test-only plumbing that lets acceptance tests exercise the absent-fallback path without a chroot or namespace; end-user operators leave this unset. .TP .B MODULEJAIL_MODULES_ROOT Root of the kernel modules tree to walk (default: .IR /lib/modules ). .B Test-only plumbing parallel to .B MODULEJAIL_PROC_MODULES and .BR MODULEJAIL_KVER ; lets host-local cases on non-Linux dev boxes point modulejail at a synthetic tree under .IR $TMPDIR . End-user operators leave this unset. .TP .B MODULEJAIL_PROC_MODULES Path to read the loaded-module list from (default: .IR /proc/modules ). .B Test-only plumbing. .TP .B MODULEJAIL_KVER Kernel version string used to locate the module tree (default: .BR uname \ -r ). .B Test-only plumbing. .SH FILES .TP .I /etc/modprobe.d/modulejail-blacklist.conf Default output path. Overridable with .BR \-o . .TP .I /proc/modules Read at run time as the keep-list. .TP .IR /lib/modules/$(uname\ -r) Walked to enumerate the full module universe (including DKMS and weak-updates modules). .SH EXAMPLES Hardening a server with the default profile and default output path: .PP .RS .EX sudo modulejail .EE .RE .PP Workstation hardening, preserving WiFi, Bluetooth, audio, and video drivers: .PP .RS .EX sudo modulejail \-p desktop .EE .RE .PP Writing to a custom path (does not require root if the directory is writable): .PP .RS .EX modulejail \-o /tmp/site-blacklist.conf .EE .RE .PP Fleet-automation context: disable the update check to keep output deterministic. .PP .RS .EX MODULEJAIL_NO_UPDATE_CHECK=1 sudo modulejail .EE .RE .PP Site-local whitelist via an operator-owned file (preferred when modulejail is installed via package manager): .PP .RS .EX # /etc/modulejail/whitelist.conf — chmod 0644 (or stricter) # # nft_compat # xt_owner # zfs sudo modulejail \-\-whitelist\-file /etc/modulejail/whitelist.conf .EE .RE .PP View syslog entries for blocked module load attempts (since v1.2): .PP .RS .EX journalctl \-t modulejail \-\-since '1 hour ago' grep modulejail /var/log/syslog .EE .RE .PP Suppress syslog emission to restore the v1.1.4 install-line body byte-for-byte (useful on hosts without .BR logger , or for byte-identical regression contracts): .PP .RS .EX sudo modulejail \-\-no\-syslog\-logging .EE .RE .SH REVERTING Remove the generated file and reboot: .PP .RS .EX sudo rm /etc/modprobe.d/modulejail-blacklist.conf sudo reboot .EE .RE .PP To bring back a specific module without rebooting (the restriction re-applies after the next reboot unless the file has been removed): .PP .RS .EX sudo modprobe .EE .RE .SH SEE ALSO .BR modprobe (8), .BR modprobe.d (5), .BR sysexits (3), .BR lsmod (8) .SH AUTHOR Jasper Nuyens .SH COPYRIGHT Copyright \(co 2026 Jasper Nuyens. License GPL-3.0-only. .PP This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. .SH HOMEPAGE https://github.com/jnuyens/modulejail jnuyens-modulejail-06d8d74/modulejail000077500000000000000000001620151520651617500177620ustar00rootroot00000000000000#!/bin/sh # SPDX-License-Identifier: GPL-3.0-only # Copyright (C) 2026 Jasper Nuyens # ModuleJail: shrink a Linux host's kernel-module attack surface. set -eu # Force C locale for the whole pipeline. comm -23 requires its inputs to be # sorted byte-identically; under a non-C locale (e.g. en_US.UTF-8 or # tr_TR.UTF-8) sort uses locale-aware collation, which can silently desync # the universe/keep ordering and produce wrong set arithmetic. Also # stabilises awk regex matching. LC_ALL=C export LC_ALL # --- Tool version + sysexits.h exit code constants --- # VERSION is the single source of truth for both --version and the # generated blacklist header. Bump on every release per SemVer. VERSION='1.3.6' EX_OK=0 # sysexits.h conventional codes (see man 3 sysexits): # 64=usage 65=dataerr 66=noinput 70=software 71=oserr 73=cantcreat 77=noperm EX_USAGE=64 EX_DATAERR=65 EX_NOINPUT=66 EX_SOFTWARE=70 EX_OSERR=71 EX_CANTCREAT=73 EX_NOPERM=77 # --- Defaults (set before arg parsing) --- profile=conservative output=/etc/modprobe.d/modulejail-blacklist.conf WHITELIST_FILE='' NO_WHITELIST_FILE='' NO_SYSLOG_LOGGING='' USE_LOGGER='' FAIL_ON_MODULE_LOAD=0 VERBOSE_LOGGING=0 DRY_RUN=0 QUIET=0 VERBOSE=0 OUTPUT_FORMAT='' # Path checked for a site-local whitelist when --whitelist-file is not given. # When the file exists, it is loaded automatically with the same strict # validation as --whitelist-file. When absent, no error (mirrors v1.1.4 # behavior for hosts that don't ship one). Operators opt out with # --no-whitelist-file or by removing the file. # # Overridable via MODULEJAIL_DEFAULT_WHITELIST_FILE for test fixtures (test-only # plumbing, cf. MODULEJAIL_PROC_MODULES / MODULEJAIL_KVER / MODULEJAIL_LOGGER_PATH). DEFAULT_WHITELIST_FILE="${MODULEJAIL_DEFAULT_WHITELIST_FILE:-/etc/modulejail/whitelist.conf}" # --- Built-in baseline module lists (space-separated strings, not bash arrays) --- # Each profile inherits from the one above via variable interpolation (DRY). # Module names are in canonical underscore form; the pipeline normalizes both forms. # BASELINE_MINIMAL (16 entries): # Core filesystems, NLS deps for vfat/ESP, loop/overlay/autofs, crc32c/crc16. # Intent: "Won't break a box that's already booted" — safety net for hosts # where most drivers are compiled in but a few modular essentials remain. BASELINE_MINIMAL='ext4 xfs btrfs vfat fat nls_cp437 nls_iso8859_1 nls_utf8 tmpfs loop overlay autofs4 crc32c_generic crc32c_intel libcrc32c crc16' # BASELINE_CONSERVATIVE (MINIMAL + 44 entries ≈ 60 total): # Virtio/KVM, common storage controllers, common ethernet NICs, HID/input, # dm-crypt/LVM, crypto primitives, socket diagnostics (ss/system-monitor), # CPU governor, kernel TLS. Default profile. # Intent: "Bare-metal or VM Linux server across the mainstream hardware matrix." BASELINE_CONSERVATIVE="$BASELINE_MINIMAL virtio virtio_ring virtio_pci virtio_blk virtio_net virtio_scsi virtio_balloon virtio_rng nvme nvme_core ahci libahci libata sd_mod sr_mod scsi_mod usb_storage uas e1000 e1000e igb igc ixgbe r8169 tg3 bnxt_en bnx2 hid hid_generic usbhid i8042 dm_mod dm_crypt dm_mirror aes_generic aesni_intel sha256_generic xts cbc inet_diag tcp_diag udp_diag acpi_cpufreq tls" # BASELINE_DESKTOP (CONSERVATIVE + ~65 entries ≈ 125 total): # Graphics/DRM, WiFi, Bluetooth, audio (ALSA/HDA), USB host controllers, # misc desktop peripherals, webcam/video4linux, removable-media # filesystems (exfat/f2fs/ntfs3/isofs), CPU EDAC, CPU power management # (intel_pstate/intel_cstate/amd_pstate), and TUN/TAP for VPN clients # and VMs. # Intent: "Laptop or workstation — won't break WiFi, BT, audio, video, # CPU governors, or VPN/VM session setup." # shellcheck disable=SC2034 # referenced indirectly via the profile case statement BASELINE_DESKTOP="$BASELINE_CONSERVATIVE drm drm_kms_helper i915 amdgpu radeon nouveau nvidia ttm video backlight cfg80211 mac80211 iwlwifi iwlmvm iwldvm ath9k ath10k_core ath10k_pci ath11k brcmfmac brcmsmac rtw88_core rtw89_core rtl8xxxu bluetooth btusb btintel btrtl btbcm hci_uart snd snd_pcm snd_timer snd_hda_intel snd_hda_codec snd_hda_codec_realtek snd_hda_codec_hdmi snd_hda_codec_generic snd_usb_audio snd_seq xhci_hcd xhci_pci ehci_hcd ehci_pci uhci_hcd usblp cdc_acm joydev evdev videodev uvcvideo media exfat f2fs ntfs3 isofs cdrom amd64_edac i7core_edac ie31200_edac intel_pstate intel_cstate amd_pstate tun tap" # --- Baseline-addition policy (in effect since v1.3.4) --- # # Modules join a baseline only when there is observed operator pain in # that profile's target audience. # CONSERVATIVE target = bare-metal/VM Linux servers (hands-on admins, # post-steady-state runs). # DESKTOP target = laptops/workstations (set-and-forget UX, # modulejail may run at any time including # before all udev/late-load events have settled). # "Defensive add because the kernel sometimes loads it late" is # insufficient justification - a real operator-reported breakage in # the relevant profile's target audience is the bar. `acpi_cpufreq` # in CONSERVATIVE (added v1.3.2) predates this policy and is retained # for backward compatibility; it would not pass the policy as worded. # # Deliberately NOT in any baseline (= blacklisted by default on hosts # where they are not currently loaded). These categories have been the # source of most unprivileged-user → root LPE chains in recent Linux # kernel CVEs, and operators who genuinely need them are expected to add # the specific names to the WHITELIST= below. # # Network filesystems (CIFS / NFS / Ceph / GlusterFS / 9P): # cifs, nfs, nfsv3, nfsv4, ceph, fuse, 9p # Reachable via mount(2) with the matching fstype. CIFS in particular # carries cifs.upcall trust chains (see CIFSwitch, May 2026) that # chain to root via request_key("cifs.spnego", ...) - which fails # with -ENOKEY when cifs.ko is not loaded. NFS/Ceph/GlusterFS get # the same treatment: keep them out of the keep-set on hosts that # are not actively mounting those filesystems. # # Legacy / niche socket families (PF_X25, PF_AX25, PF_DECNET, PF_IPX, # PF_APPLETALK, PF_NETROM, PF_ROSE, PF_LLC, AF_RDS, AF_TIPC, AF_NFC, # AF_VSOCK, AF_CAN, AF_QIPCRTR, AF_SMC): # sctp, dccp, tipc, rds, nfc, vsock, can, qrtr, smc, x25, ax25, # decnet, ipx, appletalk, netrom, rose, llc2 # Reachable via socket(AF_X, ...) by any unprivileged user. Many # distros already ship `blacklist net-pf-N` for the worst legacy # ones; ModuleJail extends that to the whole class on hosts that # are not using them. # # Crypto algorithm glue (AF_ALG handlers): # algif_aead, algif_skcipher, algif_hash, algif_rng # The Copy Fail CVE (CVE-2026-31431) is exactly this class. The # primitive ciphers in BASELINE_CONSERVATIVE (aes_generic, xts, cbc) # are kept because dm-crypt / WireGuard / kTLS use them; the algif_* # glue is not used by anything on a typical server. # # Exotic crypto algorithms: # aria, aegis128, chacha20poly1305 (standalone), sm4, streebog, # serpent, twofish, camellia, cast5, cast6, tea, tgr192, wp512 # Reachable via the same AF_ALG path; less load-bearing than the # AES family. # # Misc kernel-attack-surface modules an operator is unlikely to need: # rxe (Soft-RoCE: CVE-2026-46133), binfmt_aout, binfmt_em86, # binfmt_flat, nf_tables sub-modules a non-firewall host does not # reference. # # See docs/DEFENSE-IN-DEPTH.md for the full 7-tier autoload taxonomy # and the threat-model framing. Operators who genuinely need any of # the above should add the specific module names to the WHITELIST= # variable below. # === SYSADMIN WHITELIST === # Site-local additions to the keep-set, in addition to the selected baseline # profile. Modules listed here will never appear in the generated blacklist. # # Format: space-separated module names in canonical underscore form # (the pipeline normalizes - to _, so either form works). # Default: empty. # # Example (uncomment and adapt — `nft_compat` is the iptables-nft # compatibility shim, a plausible netfilter module a sysadmin running # iptables on a modern host might want to keep beyond the baseline): # WHITELIST='nft_compat xt_owner' WHITELIST='' # === END SYSADMIN WHITELIST === # --- usage(): print help text; caller decides exit code --- usage() { printf 'modulejail — shrink a Linux host'\''s kernel-module attack surface\n' printf '\n' printf 'Usage: modulejail [OPTIONS]\n' printf '\n' printf 'Options:\n' printf ' -p, --profile {minimal|conservative|desktop|none}\n' printf ' Built-in baseline profile (default: conservative)\n' printf ' -o, --output PATH Output path for the generated blacklist file\n' printf ' (default: /etc/modprobe.d/modulejail-blacklist.conf)\n' printf ' --whitelist-file PATH\n' printf ' Append module names from PATH to the keep-set.\n' printf ' One module per line; '\''#'\'' starts a comment.\n' printf ' File must not be group- or world-writable.\n' printf ' Default (auto-detected if present and no flag passed):\n' printf ' /etc/modulejail/whitelist.conf\n' printf ' --no-whitelist-file\n' printf ' Skip the default whitelist file even if present.\n' printf ' Mutually exclusive with --whitelist-file PATH.\n' printf ' --no-syslog-logging\n' printf ' Force '\''/bin/true'\'' install lines (v1.1.4 behavior).\n' printf ' By default, when /usr/bin/logger is present, blocked\n' printf ' module loads are logged to syslog with tag '\''modulejail'\''.\n' printf ' -f, --fail-on-module-load\n' printf ' Blocked module loads return a non-zero exit code\n' printf ' (modprobe fails loudly). Default: blocked loads\n' printf ' silently succeed (modprobe returns 0).\n' # shellcheck disable=SC2016 # $PPID is intentional literal in --help docs printf ' --verbose-logging Enrich the syslog "blocked" line with the\n' # shellcheck disable=SC2016 printf ' caller'\''s PPID, loginuid, parent comm, and\n' # shellcheck disable=SC2016 printf ' argv[0] (read from /proc/$PPID/...). Requires\n' printf ' /usr/bin/logger (mutually exclusive with\n' printf ' --no-syslog-logging).\n' printf ' --dry-run Compute the would-be blacklist and print a summary to\n' printf ' stdout; do NOT write the output file or touch\n' printf ' /etc/modprobe.d/. Header is rerouted to stderr.\n' printf ' --quiet Suppress all non-error stderr (info lines, summary,\n' printf ' header). Mutually exclusive with --verbose.\n' printf ' --verbose Emit per-module decision lines on stderr. Mutually\n' printf ' exclusive with --quiet.\n' printf ' --output-format {json|logfmt}\n' printf ' Emit a machine-readable run summary to stdout instead\n' printf ' of the default human-readable form. JSON round-trips\n' printf ' through jq; logfmt round-trips through standard\n' printf ' logfmt parsers. Survives --quiet.\n' printf ' -V, --version Show program version and exit\n' printf ' -h, --help Show this help text and exit\n' printf '\n' printf 'Profiles:\n' printf ' minimal Core filesystems + essential kernel modules only\n' printf ' conservative Minimal + common server/VM drivers (default)\n' printf ' desktop Conservative + WiFi, Bluetooth, audio, video drivers\n' printf ' none No built-in baseline; only currently-loaded modules\n' printf ' and any --whitelist-file entries are preserved.\n' printf ' Recommended only with an explicit --whitelist-file.\n' printf '\n' printf 'Defaults:\n' printf ' profile: conservative\n' printf ' output: /etc/modprobe.d/modulejail-blacklist.conf\n' printf ' whitelist file: /etc/modulejail/whitelist.conf (auto-detected if present)\n' printf '\n' printf 'Exit codes:\n' printf ' 0 success\n' printf ' 64 command-line argument error (bad flag, missing value, unknown profile)\n' printf ' 65 invalid data in whitelist file (malformed module name)\n' printf ' 66 required kernel input missing (/proc/modules or /lib/modules/)\n' printf ' 70 sanity guard tripped (empty blacklist or >99%% of modules blacklisted)\n' printf ' 71 OS-level error (mktemp work dir, or find errors on /lib/modules)\n' printf ' 73 output path cannot be created (symlink/directory/trailing-slash, or mktemp failure)\n' printf ' 77 target directory not writable (try sudo, or use -o )\n' printf '\n' printf 'Environment:\n' printf ' MODULEJAIL_NO_UPDATE_CHECK Set to any non-empty value to skip the post-run\n' printf ' check for a newer release on GitHub.\n' printf ' MODULEJAIL_LOGGER_PATH Path to the logger binary used for the syslog\n' printf ' install-line detection (default: /usr/bin/logger).\n' printf ' Test-only plumbing; end-user operators leave unset.\n' printf ' MODULEJAIL_DEFAULT_WHITELIST_FILE\n' printf ' Override the auto-detected whitelist path\n' printf ' (default: /etc/modulejail/whitelist.conf).\n' printf ' Test-only plumbing; end-user operators leave unset.\n' } quote_arg() { case "$1" in ""|*[!a-zA-Z0-9._/=-]*) printf "'%s'" "$(printf '%s' "$1" | sed "s/'/'\\\\''/g")" ;; *) printf '%s' "$1" ;; esac } # --- Reproducible invocation string --- # When the script is piped into sh (like: `curl ... | sh`) $0 is 'sh' and $@ empty. # In other cases (even `sh -c '...'`) $invocation is script + arguments, properly quoted. invocation=$(quote_arg "$0") for arg in "$@"; do invocation="$invocation $(quote_arg "$arg")" done # --- Argument parser (manual case loop — POSIX, supports long options) --- while [ $# -gt 0 ]; do case "$1" in -p|--profile) [ $# -ge 2 ] || { printf 'modulejail: error: %s requires an argument\n' "$1" >&2; exit $EX_USAGE; } profile=$2 shift 2 ;; --profile=*) profile=${1#--profile=} shift ;; -o|--output) [ $# -ge 2 ] || { printf 'modulejail: error: %s requires an argument\n' "$1" >&2; exit $EX_USAGE; } output=$2 shift 2 ;; --output=*) output=${1#--output=} shift ;; --whitelist-file) [ $# -ge 2 ] || { printf 'modulejail: error: --whitelist-file requires PATH argument\n' >&2; exit $EX_USAGE; } WHITELIST_FILE="$2" shift 2 ;; --whitelist-file=*) WHITELIST_FILE="${1#*=}" [ -n "$WHITELIST_FILE" ] || { printf 'modulejail: error: --whitelist-file= requires non-empty PATH\n' >&2; exit $EX_USAGE; } shift ;; --no-whitelist-file) NO_WHITELIST_FILE=1 shift ;; --no-syslog-logging) NO_SYSLOG_LOGGING=1 shift ;; -f|--fail-on-module-load) FAIL_ON_MODULE_LOAD=1 shift ;; --verbose-logging) VERBOSE_LOGGING=1 shift ;; --dry-run) # shellcheck disable=SC2034 DRY_RUN=1 shift ;; --quiet) QUIET=1 shift ;; --verbose) VERBOSE=1 shift ;; --output-format) [ $# -ge 2 ] || { printf 'modulejail: error: --output-format requires json or logfmt argument\n' >&2; exit $EX_USAGE; } OUTPUT_FORMAT="$2" shift 2 ;; --output-format=*) OUTPUT_FORMAT="${1#*=}" [ -n "$OUTPUT_FORMAT" ] || { printf 'modulejail: error: --output-format= requires non-empty argument (expected json or logfmt)\n' >&2; exit $EX_USAGE; } shift ;; -h|--help) usage exit $EX_OK ;; -V|--version) printf 'modulejail %s\n' "$VERSION" printf 'https://github.com/jnuyens/modulejail\n' printf 'License: GPL-3.0-only (https://spdx.org/licenses/GPL-3.0-only.html)\n' exit $EX_OK ;; --) shift break ;; -*) printf 'modulejail: error: unknown option: %s\n' "$1" >&2 exit $EX_USAGE ;; *) printf 'modulejail: error: unexpected positional argument: %s\n' "$1" >&2 exit $EX_USAGE ;; esac done # --- Validate profile --- case "$profile" in minimal|conservative|desktop|none) ;; *) printf 'modulejail: error: unknown profile: %s (expected minimal, conservative, desktop, none)\n' "$profile" >&2; exit $EX_USAGE ;; esac # --- Reject contradictory whitelist-file flags --- # Explicit-path-plus-opt-out is ambiguous; refuse rather than silently # letting one win. if [ -n "$WHITELIST_FILE" ] && [ -n "$NO_WHITELIST_FILE" ]; then printf 'modulejail: error: --whitelist-file PATH and --no-whitelist-file are mutually exclusive\n' >&2 exit $EX_USAGE fi # --- Reject --quiet + --verbose (mutually exclusive) --- if [ "$QUIET" -eq 1 ] && [ "$VERBOSE" -eq 1 ]; then printf 'modulejail: error: --quiet and --verbose are mutually exclusive\n' >&2 exit $EX_USAGE fi # --- Reject --no-syslog-logging + --verbose-logging (mutually exclusive) --- # --verbose-logging enriches the per-line `logger` call with the caller's # PID/loginuid/exe; --no-syslog-logging forces the v1.1.4-style /bin/true # install lines that have no logger call to enrich. Combining the two is # self-contradictory. if [ -n "$NO_SYSLOG_LOGGING" ] && [ "$VERBOSE_LOGGING" -eq 1 ]; then printf 'modulejail: error: --no-syslog-logging and --verbose-logging are mutually exclusive\n' >&2 exit $EX_USAGE fi # --- Validate --output-format closed set --- if [ -n "$OUTPUT_FORMAT" ]; then case "$OUTPUT_FORMAT" in json|logfmt) ;; *) printf 'modulejail: error: unknown --output-format: %s (expected json or logfmt)\n' "$OUTPUT_FORMAT" >&2; exit $EX_USAGE ;; esac fi # --- Default whitelist file auto-detection --- # Per Issue #2 followup (bpmartin20, james-rimu, 2026-05): a default path # under /etc/modulejail/ catches the "forgot the flag" silent-error case. # Only kick in when: # - user did not pass --whitelist-file PATH, AND # - user did not pass --no-whitelist-file, AND # - the default file exists. # Validation/permission gate inside parse_whitelist_file runs the same way # as for an explicit path — an existing but malformed/unsafe default file # is a loud error, never a silent skip. if [ -z "$WHITELIST_FILE" ] && [ -z "$NO_WHITELIST_FILE" ] && [ -e "$DEFAULT_WHITELIST_FILE" ]; then WHITELIST_FILE="$DEFAULT_WHITELIST_FILE" if [ "$QUIET" -eq 0 ]; then printf 'modulejail: info: using default whitelist file %s (--no-whitelist-file to opt out)\n' "$DEFAULT_WHITELIST_FILE" >&2 fi fi # --- -p none sanity-guard-disabled notice --- # The >99% blacklist threshold guard is skipped under -p none (D-Phase5-02). # Emit an info: line so fleet log scrapers have a parseable breadcrumb. if [ "$profile" = "none" ] && [ "$QUIET" -eq 0 ]; then printf 'modulejail: info: -p none selected; the >99%% blacklist sanity guard is disabled (the loaded-keep invariant remains the boot-safety contract).\n' >&2 fi # --- Logger detection (generation-time, one-shot per run) --- # The opt-out flag NO_SYSLOG_LOGGING wins. Otherwise, emit the logger # install-line iff the running host has an executable logger binary. # This is a one-shot check at generation time (not a per-modprobe # eval). The emitted install line itself uses `; exit 0` for # heterogeneous-fleet robustness (so a missing logger at modprobe # time still returns 0). # # Path is overridable via MODULEJAIL_LOGGER_PATH for test fixtures # (test-only plumbing, cf. MODULEJAIL_PROC_MODULES / MODULEJAIL_KVER / # MODULEJAIL_MODULES_ROOT). End-user operators leave it unset; the # default is /usr/bin/logger. if [ -z "$NO_SYSLOG_LOGGING" ] && [ -x "${MODULEJAIL_LOGGER_PATH:-/usr/bin/logger}" ]; then USE_LOGGER=1 fi # --verbose-logging requires the logger binary to be present (the # enriched install-line invokes logger). If logger is absent, fail # loudly rather than silently falling back to the v1.1.4 /bin/true # form (nothing to enrich). if [ "$VERBOSE_LOGGING" -eq 1 ] && [ -z "$USE_LOGGER" ]; then printf 'modulejail: error: --verbose-logging requires the logger binary at %s (install util-linux or override via MODULEJAIL_LOGGER_PATH)\n' \ "${MODULEJAIL_LOGGER_PATH:-/usr/bin/logger}" >&2 exit $EX_NOINPUT fi # --verbose-logging also requires `tr` (coreutils) - the enriched # install-line pipes /proc/$PPID/cmdline through tr to convert NULs # to spaces and strip control bytes. Without tr the install-line would # emit `tr: command not found` into syslog, mangling the log entry. # Test override: MODULEJAIL_TR_PATH (analogous to MODULEJAIL_LOGGER_PATH). TR_PATH=${MODULEJAIL_TR_PATH:-/usr/bin/tr} if [ "$VERBOSE_LOGGING" -eq 1 ] && [ ! -x "$TR_PATH" ]; then printf 'modulejail: error: --verbose-logging requires tr at %s (install coreutils or override via MODULEJAIL_TR_PATH)\n' \ "$TR_PATH" >&2 exit $EX_NOINPUT fi # --- Pre-flight: verify this is a Linux host with the required kernel --- # interfaces. Run this BEFORE the writability gate so non-Linux operators # get an accurate "not a Linux host" diagnostic instead of a misleading # "cannot write to /etc/modprobe.d" message. # /proc/modules path is overridable via MODULEJAIL_PROC_MODULES for # test fixtures that cannot expose a synthetic /proc (test-only plumbing, # cf. TMPDIR, GIT_DIR). End-user operators leave it unset. if [ ! -e "${MODULEJAIL_PROC_MODULES:-/proc/modules}" ]; then printf 'modulejail: error: %s not found (is this a Linux host?)\n' \ "${MODULEJAIL_PROC_MODULES:-/proc/modules}" >&2 exit $EX_NOINPUT fi # Kernel version overridable via MODULEJAIL_KVER for test fixtures # (test-only plumbing; containers share the host kernel via uname -r, # so synthetic module trees need a pinned version). _kver="${MODULEJAIL_KVER:-$(uname -r)}" # Modules-tree root overridable via MODULEJAIL_MODULES_ROOT for test # fixtures (test-only plumbing, cf. MODULEJAIL_PROC_MODULES / MODULEJAIL_KVER). # End-user operators leave it unset (defaults to /lib/modules). This lets # host-local case scripts on a non-Linux dev box build a synthetic tree under # $TMPDIR and exercise the full pipeline without requiring root or a writable # /lib/modules. _modules_root="${MODULEJAIL_MODULES_ROOT:-/lib/modules}" if [ ! -d "$_modules_root/$_kver" ]; then printf 'modulejail: error: %s/%s does not exist (kernel module tree missing)\n' "$_modules_root" "$_kver" >&2 exit $EX_NOINPUT fi # --- Pre-flight: reject $output that is (or could become) a directory. --- # Without this, `-o /etc/modprobe.d` (or any existing directory — easy slip # with shell completion or a copy-paste from docs) would pass dirname, pass # the writability gate, and have `mv` quietly drop the temp file *inside* # the directory under its randomized name. modprobe ignores dotfiles, so # the host would silently end up unprotected. Catch both forms here. if [ -d "$output" ]; then printf 'modulejail: error: -o %s is a directory; expected a file path\n' "$output" >&2 exit $EX_CANTCREAT fi case "$output" in */) printf 'modulejail: error: -o %s ends with /, expected a file path\n' "$output" >&2; exit $EX_CANTCREAT ;; esac # --- Pre-flight: refuse a symlinked output target. --- # `mv -- "$tmp" "$output"` would follow the symlink and replace the *target*, # not the link. On a multi-tenant or misconfigured host this can write # outside /etc/modprobe.d/. Honour the atomic-rename safety story by # refusing the symlink up front rather than silently following it. if [ -L "$output" ]; then printf 'modulejail: error: refusing to overwrite symlink at %s\n' "$output" >&2 exit $EX_CANTCREAT fi # --- Pre-flight: writability gate (before any heavy work) --- target_dir=$(dirname "$output") if ! [ -w "$target_dir" ]; then printf 'modulejail: error: cannot write to %s (try sudo, or use -o )\n' "$target_dir" >&2 exit $EX_NOPERM fi # === PIPELINE === # Per-invocation work directory — all intermediate sorted files live here. # Cleaned up on any exit path (success, failure, signal). # Use the explicit-template form rather than `mktemp -t modulejail.XXXXXX`: # the `-t` flag has three incompatible meanings across GNU coreutils, BSD, # and busybox (Alpine). The full-path template form works identically on # all of them and is self-documenting about where the directory lives. workdir=$(mktemp -d "${TMPDIR:-/tmp}/modulejail.XXXXXX") || { printf 'modulejail: error: cannot create temporary work directory\n' >&2 exit $EX_OSERR } # Install the consolidated cleanup trap NOW (before the second mktemp in the # render block), so a signal arriving in the window between creating $tmp and # registering it does not orphan the in-target dotfile under /etc/modprobe.d/. # $tmp is initially empty; rm -f on an empty argument is a no-op, so the trap # is safe to fire before $tmp is assigned. tmp= # shellcheck disable=SC2329 # invoked via trap string, not direct call cleanup() { # shellcheck disable=SC2317 # invoked via trap string, not direct call rm -rf "$workdir" # shellcheck disable=SC2317 # invoked via trap string, not direct call if [ -n "${tmp:-}" ]; then rm -f "$tmp"; fi # Always return 0 from the EXIT trap. Under dash/POSIX /bin/sh, an # EXIT trap whose last command exits non-zero CLOBBERS the script's # original exit status. The previous `[ -n "$tmp" ] && rm -f "$tmp"` # idiom returned 1 whenever $tmp was still empty (every error path # before the render block), masking explicit `exit $EX_*` codes. # Surfaced by the new whitelist-file rejection paths (Plan 03-01). # shellcheck disable=SC2317 # invoked via trap string, not direct call return 0 } trap cleanup EXIT INT HUP TERM # list_universe: walk the FULL modules tree at $_modules_root/$_kver # (default: /lib/modules/$(uname -r), NOT just kernel/) so DKMS and # weak-updates modules are included. # Strip exactly the four known suffixes (.ko, .ko.gz, .ko.xz, .ko.zst); # lines that do not match a known suffix are dropped (precision filter for # the *.ko* glob). Normalize - to _. Output is sorted, deduped. # # POSIX /bin/sh has no `pipefail`, so a `find ... | awk ... | sort -u` # pipeline silently masks find failures (a permission-denied subtree under # weak-updates/, a broken symlink chain, transient I/O) and produces a # partial universe, which then under-blacklists the host invisibly. # Capture find's stderr to a tempfile in $workdir, run find with stdout # to another tempfile, and abort if stderr is non-empty. list_universe() { find_out=$workdir/find.out find_err=$workdir/find.err find "$_modules_root/$_kver" -type f -name '*.ko*' \ >"$find_out" 2>"$find_err" if [ -s "$find_err" ]; then printf 'modulejail: error: find reported errors walking %s/%s:\n' \ "$_modules_root" "$_kver" >&2 cat "$find_err" >&2 printf 'modulejail: error: refusing to produce a partial blacklist.\n' >&2 exit $EX_OSERR fi awk '{ n = $0 # Keep only the basename sub(/.*\//, "", n) # Strip exactly one of the four known compression suffixes; drop others if (!sub(/\.ko\.gz$/, "", n) && \ !sub(/\.ko\.xz$/, "", n) && \ !sub(/\.ko\.zst$/, "", n) && \ !sub(/\.ko$/, "", n)) next # Normalize - to _ (canonical underscore form) gsub(/-/, "_", n) # Defense-in-depth: reject names containing # anything outside canonical kernel-module characters before # they can land in /etc/modprobe.d/ install lines. The strict # regex gate is what the project documentation positions as # the safety guarantee for modprobe.d directives; without # this line that guarantee only held for the --whitelist-file # path (parse_whitelist_file) and not for the filesystem-walk # path. Write access to /lib/modules/$KVER/ is root-equivalent # today, so this is defense-in-depth, not a CVE fix. A legit # kernel module basename always matches this regex post # dash-to-underscore normalization; nothing real is dropped. if (n !~ /^[a-zA-Z0-9_]+$/) next print n }' "$find_out" | sort -u } # list_loaded: read currently-loaded modules from /proc/modules. # Uses /proc/modules directly — no kmod/lsmod runtime dep. # Column 1 of /proc/modules is already in canonical underscore form. list_loaded() { # /proc/modules path overridable via MODULEJAIL_PROC_MODULES # (test-only plumbing; see pre-flight gate above). # # Defense-in-depth: apply the same canonical-name # filter as list_universe for symmetry. Column 1 of /proc/modules # is kernel-owned and trustworthy in practice, but the strict-regex # gate that the project documentation positions as the guarantee # for modprobe.d directives should hold uniformly across every # source that feeds emit_install_line. A real loaded module always # matches this regex; nothing legitimate is dropped. awk '$1 ~ /^[a-zA-Z0-9_]+$/ {print $1}' \ "${MODULEJAIL_PROC_MODULES:-/proc/modules}" | sort -u } # Produce the two canonical input files for set arithmetic. list_universe > "$workdir/universe.txt" list_loaded > "$workdir/loaded.txt" # list_baseline: expand the selected baseline profile ($profile) into a sorted, # deduplicated list of canonical underscore module names. # BASELINE_* variables are POSIX space-separated strings (NOT bash arrays). # We expand them via intentional word-splitting. list_baseline() { list='' case "$profile" in none) ;; minimal) list=$BASELINE_MINIMAL ;; conservative) list=$BASELINE_CONSERVATIVE ;; desktop) list=$BASELINE_DESKTOP ;; esac # intentional word-splitting — BASELINE_* are POSIX space-separated lists, not bash arrays # shellcheck disable=SC2086 for x in $list; do printf '%s\n' "$x" done \ | tr '-' '_' \ | sort -u } # list_whitelist: expand $WHITELIST into a sorted, deduplicated list of # canonical underscore module names. Parallel to list_baseline above. list_whitelist() { # intentional word-splitting — WHITELIST is a POSIX space-separated list, not bash array # shellcheck disable=SC2086 for x in $WHITELIST; do printf '%s\n' "$x" done \ | tr '-' '_' \ | sort -u } # parse_whitelist_file: validate and parse the optional --whitelist-file. # Stdin: none. Stdout: zero or more module names, one per line (unsorted). # Side effects: errors to stderr and exits non-zero on any rejection. # Tolerates leading and trailing whitespace per line: the awk # program strips both before validating against the canonical regex, so # an indented entry copy-pasted from a YAML or other indented source # parses cleanly rather than tripping EX_DATAERR. Blank lines and lines # whose first non-blank char is `#` are skipped. # Exit codes: # 65 (EX_DATAERR) - malformed module name on any non-comment line # (awk's `END { if (!ok) exit 65 }` data-error path) # 66 (EX_NOINPUT) - file does not exist or is unreadable # 71 (EX_OSERR) - awk failed for a non-data reason (OOM, signal, future # program-edit syntax error); distinguished from EX_DATAERR # so fleet automation that case-splits on sysexits codes # reads correctly. (Previously this branch was dead # code under set -eu because awk's non-zero exit # aborted the shell at the awk line before we could remap.) # 77 (EX_NOPERM) - file is group- or world-writable parse_whitelist_file() { _wf="$1" [ -n "$_wf" ] || return 0 # no file passed; no-op if [ ! -r "$_wf" ]; then printf 'modulejail: error: whitelist file %s does not exist or is not readable\n' "$_wf" >&2 exit $EX_NOINPUT fi # Permission check: refuse if group- or world-writable. Use stat with # GNU-form first, BSD-form fallback (macOS, *BSD). The result is an # octal mode string like "644", "664", "666", or "0644" (some stats # include the setuid/setgid/sticky leading digit). _mode=$(stat -c '%a' "$_wf" 2>/dev/null || stat -f '%Lp' "$_wf" 2>/dev/null || echo '') if [ -z "$_mode" ]; then printf 'modulejail: error: could not stat whitelist file %s\n' "$_wf" >&2 exit $EX_OSERR fi # POSIX shell has no portable octal arithmetic (bash's $((8#$x)) is # SC3052: non-POSIX). Inspect the group and world octal digits as # strings instead. A digit with the 2-bit set (i.e. write bit) is one # of 2,3,6,7. _last3=$(printf '%s' "$_mode" | awk '{ n=length($0); print substr($0, n-2, 3) }') _group_digit=$(printf '%s' "$_last3" | cut -c2) _other_digit=$(printf '%s' "$_last3" | cut -c3) case "$_group_digit$_other_digit" in *[2367]*) printf 'modulejail: error: whitelist file %s must not be group- or world-writable; run '\''chmod go-w %s'\'' and retry\n' "$_wf" "$_wf" >&2 exit $EX_NOPERM ;; esac # Parse the file. Use awk for line-numbered validation - we want the # line number in error messages so operators can find the bad entry. # # Bracket the awk invocation with `set +e` / `set -e` so we can # capture the real return code and route it to a typed sysexits exit. # Without this, `set -eu` at line 5 aborts the shell at the awk line on # any non-zero awk exit, making the dispatch below dead code. Inside # the awk program, the only # documented non-zero exit is `END { if (!ok) exit 65 }`, which maps # to EX_DATAERR (65). Any other non-zero exit indicates an awk-internal # failure (OOM, killed by signal, future program-edit syntax error), # routed to EX_OSERR (71). Two distinct codes; fleet automation case- # splitting on `$?` reads correctly. set +e awk -v file="$_wf" ' BEGIN { ok = 1 } # Strip CR (handle CRLF line endings gracefully). { sub(/\r$/, "") } # Strip trailing whitespace. { sub(/[[:space:]]+$/, "") } # Strip leading whitespace symmetric with the trailing # strip above, so a naturally-indented module name (e.g. # " vfio_pci" copy-pasted from a YAML or other indented # source) is accepted rather than rejected as EX_DATAERR. # Blank-line and comment-line skips below already tolerated # leading whitespace via their own ^[[:space:]]* patterns; this # extends that tolerance to module-name lines for symmetry. { sub(/^[[:space:]]+/, "") } # Skip blank lines. /^[[:space:]]*$/ { next } # Skip comment lines. /^[[:space:]]*#/ { next } # Validate. $0 !~ /^[a-zA-Z0-9_-]+$/ { printf "modulejail: error: whitelist file %s line %d: invalid module name %s (must match [a-zA-Z0-9_-]+)\n", file, NR, $0 > "/dev/stderr" ok = 0 next } { print } END { if (!ok) exit 65 } ' "$_wf" _awk_status=$? set -e case "$_awk_status" in 0) ;; # clean parse 65) exit $EX_DATAERR ;; # documented data-error path *) printf 'modulejail: error: awk failed parsing whitelist file %s (rc=%d)\n' \ "$_wf" "$_awk_status" >&2 exit $EX_OSERR ;; esac } # emit_install_line: read sorted module names from $1 (one per line) and # print one modprobe.d-format install line per module. Branches on # USE_LOGGER (set by the generation-time logger detection above). # # When USE_LOGGER is set: emit the logger form # install /bin/sh -c '/usr/bin/logger -t modulejail "blocked: " 2>/dev/null; exit 0' # When USE_LOGGER is empty: emit the v1.1.4 form # install /bin/true # When FAIL_ON_MODULE_LOAD is set, the trailing `exit 0` becomes `/bin/false` # and the bare `/bin/true` becomes `/bin/false`, so modprobe returns # non-zero for blacklisted modules. The default-off (`FAIL_ON_MODULE_LOAD=0`) # install-line bytes are unchanged from v1.2.2 by construction. # # awk-quoting note: the outer single-quotes around the awk program are # closed and reopened around each literal single-quote that has to land # in the install-line output ('"'"'"'"' is the canonical sh idiom). The # inner double-quotes around "blocked: %s" are part of the install-line # string sh will eval at modprobe time. printf's %s is interpolated at # generation time by awk, so the emitted line carries a literal module # name, not a $name reference. emit_install_line() { if [ -n "$USE_LOGGER" ]; then if [ "$VERBOSE_LOGGING" -eq 1 ]; then # Verbose form (v1.3.4+, fixed in v1.3.5 and v1.3.6 per # @retry-the-user in #18): enrich the logger call with the # caller's PID, loginuid, parent comm, and argv[0] read # from /proc/$PPID/. # # Three key properties: # # 1. NO `/bin/sh -c '...'` wrapper. modprobe invokes install # commands via system() = sh -c "", so wrapping # the logger call in `/bin/sh -c '...'` would create a # second shell layer, making $PPID point at the wrapper # sh (not at modprobe). Without the wrapper, modprobe's # own sh -c is the only shell layer and $PPID resolves # to modprobe. # # 2. cmdline is piped through tr twice: first to strip # control bytes (\\x01-\\x08 \\x0b-\\x1f \\x7f), then to # convert NUL to space so the argv elements show as # space-separated. Why tr-then-tr instead of cat: shell # command substitution strips NULs from captured output, # which would concatenate argv elements ("modprobecpuid"). # Why strip control bytes: defense-in-depth against log # injection via attacker-controlled cmdline content # (newlines, terminal-control sequences). Shell command # substitution treats the substituted text as data (no # second expansion pass), so command injection through # cmdline content is not possible; this hardens against # log injection only. # # 3. Backslash escapes in the install-line text are DOUBLED # (`\\\\001` etc. emitted, modprobe collapses to `\\001` # in the file, sh reads it as `\\001`, tr parses as # octal NUL-byte-1). modprobe's libkmod config parser # processes `\\\\` → `\\` itself before the install # command reaches sh. v1.3.5 emitted single-backslash # `\\001` which modprobe collapsed to bare `001`, giving # tr the digit string `001-010013-037177` whose # "1-0" substring tr correctly rejected as a reverse # range. Verified on Ubuntu 24.04 with kmod 31. if [ "$FAIL_ON_MODULE_LOAD" -eq 0 ]; then awk -v tr="$TR_PATH" '{ printf "install %s /usr/bin/logger -t modulejail \"blocked: %s ppid=$PPID pcomm=$(cat /proc/$PPID/comm 2>/dev/null) loginuid=$(cat /proc/$PPID/loginuid 2>/dev/null) pexe=$(%s -d '\''\\\\001-\\\\010\\\\013-\\\\037\\\\177'\'' < /proc/$PPID/cmdline 2>/dev/null | %s '\''\\\\0'\'' '\'' '\'' 2>/dev/null)\" 2>/dev/null; exit 0\n", $1, $1, tr, tr }' "$1" else awk -v tr="$TR_PATH" '{ printf "install %s /usr/bin/logger -t modulejail \"blocked: %s ppid=$PPID pcomm=$(cat /proc/$PPID/comm 2>/dev/null) loginuid=$(cat /proc/$PPID/loginuid 2>/dev/null) pexe=$(%s -d '\''\\\\001-\\\\010\\\\013-\\\\037\\\\177'\'' < /proc/$PPID/cmdline 2>/dev/null | %s '\''\\\\0'\'' '\'' '\'' 2>/dev/null)\" 2>/dev/null; /bin/false\n", $1, $1, tr, tr }' "$1" fi elif [ "$FAIL_ON_MODULE_LOAD" -eq 0 ]; then # Default: byte-identical to v1.2.2 (trailing `; exit 0`). awk '{ printf "install %s /bin/sh -c '\''/usr/bin/logger -t modulejail \"blocked: %s\" 2>/dev/null; exit 0'\''\n", $1, $1 }' "$1" else # Fail mode: `; /bin/false` instead of `; exit 0`, so the # whole install command returns non-zero and modprobe fails. awk '{ printf "install %s /bin/sh -c '\''/usr/bin/logger -t modulejail \"blocked: %s\" 2>/dev/null; /bin/false'\''\n", $1, $1 }' "$1" fi else if [ "$FAIL_ON_MODULE_LOAD" -eq 0 ]; then # Default: byte-identical to v1.1.4 / v1.2.2 silent form. awk '{print "install " $1 " /bin/true"}' "$1" else # Fail mode: /bin/false makes modprobe fail loudly. awk '{print "install " $1 " /bin/false"}' "$1" fi fi } # render_blacklist_file: write the 8-line header block followed by all # install directives to stdout. Callers redirect stdout to the desired # destination (a tempfile for the real-write path, stderr for dry-run). # Using a single function for both paths removes the duplication that # previously made drift between the two branches a silent regression risk. # All referenced variables (VERSION, profile, _kver, fingerprint, # USE_LOGGER, FAIL_ON_MODULE_LOAD, invocation, blacklist) are resolved at # call time from the enclosing shell scope. render_blacklist_file() { printf '# modulejail %s\n' "$VERSION" printf '# https://github.com/jnuyens/modulejail\n' printf '# profile: %s\n' "$profile" printf '# kernel: %s\n' "$_kver" printf '# fingerprint: sha256:%s\n' "$fingerprint" if [ -n "$USE_LOGGER" ]; then if [ "$VERBOSE_LOGGING" -eq 1 ]; then if [ "$FAIL_ON_MODULE_LOAD" -eq 0 ]; then printf '# install-line: /bin/sh + logger + ppid/loginuid/pcomm/pexe context (syslog tag: modulejail, --verbose-logging)\n' else printf '# install-line: /bin/sh + logger + ppid/loginuid/pcomm/pexe context + /bin/false (syslog tag: modulejail, --verbose-logging --fail-on-module-load)\n' fi elif [ "$FAIL_ON_MODULE_LOAD" -eq 0 ]; then printf '# install-line: /bin/sh + logger (syslog tag: modulejail)\n' else printf '# install-line: /bin/sh + logger + /bin/false (syslog tag: modulejail, --fail-on-module-load)\n' fi else if [ "$FAIL_ON_MODULE_LOAD" -eq 0 ]; then printf '# install-line: /bin/true (silent, --no-syslog-logging or logger absent)\n' else printf '# install-line: /bin/false (silent, --fail-on-module-load)\n' fi fi printf '# invocation: %s\n' "$invocation" printf '# Do not edit by hand — regenerate with modulejail(8).\n' emit_install_line "$blacklist" } # _json_escape: escape a string for safe embedding inside a JSON double-quoted # value. Handles \, ", and ASCII control characters (U+0000–U+001F). Output is # the escaped form of $1 on stdout (no surrounding quotes added by this helper; # the caller wraps in "…"). POSIX-portable: awk only. The ord[] table is # built in BEGIN by iterating the first 128 ASCII code points. _json_escape() { printf '%s' "$1" | awk 'BEGIN { for (i = 0; i < 128; i++) ord[sprintf("%c", i)] = i } { out = "" n = length($0) for (i = 1; i <= n; i++) { c = substr($0, i, 1) v = (c in ord) ? ord[c] : -1 if (c == "\\") { out = out "\\\\" } else if (c == "\"") { out = out "\\\"" } else if (v >= 0 && v < 32) { out = out sprintf("\\u%04x", v) } else { out = out c } } printf "%s", out }' } # Machine-readable one-line summary (--output-format json|logfmt, OPT-04). # Called by the three-way stdout branch when --output-format is set; # bypasses --quiet per D-Phase5-09. Schema v1 locked (D-Phase5-10): # 11 fields, additive-only in future versions. emit_machine_summary() { _fmt=$1 _modules_loaded=$(wc -l < "$workdir/loaded.txt" | awk '{print $1}') if [ -n "$WHITELIST_FILE" ]; then _wl_json="\"$(_json_escape "$WHITELIST_FILE")\"" _wl_lf="$WHITELIST_FILE" else _wl_json='null' _wl_lf='' fi if [ "$DRY_RUN" -eq 1 ]; then _dry='true' else _dry='false' fi case "$_fmt" in json) printf '{"schema_version":1,"tool":{"name":"modulejail","version":"%s"},"kernel_version":"%s","profile":"%s","dry_run":%s,"whitelist_file":%s,"modules_available":%d,"modules_loaded":%d,"modules_blacklisted":%d,"fingerprint":"%s","output_path":"%s"}\n' \ "$(_json_escape "$VERSION")" "$(_json_escape "$_kver")" \ "$(_json_escape "$profile")" "$_dry" "$_wl_json" \ "$universe_count" "$_modules_loaded" "$blacklist_count" \ "$(_json_escape "$fingerprint")" "$(_json_escape "$output")" ;; logfmt) printf 'schema_version=1 tool_name=modulejail tool_version=%s kernel_version=%s profile=%s dry_run=%s whitelist_file=%s modules_available=%d modules_loaded=%d modules_blacklisted=%d fingerprint=%s output_path=%s\n' \ "$VERSION" "$_kver" "$profile" "$_dry" "$_wl_lf" \ "$universe_count" "$_modules_loaded" "$blacklist_count" \ "$fingerprint" "$output" ;; esac } list_baseline > "$workdir/baseline.txt" # parse_whitelist_file may exit non-zero (EX_NOINPUT / EX_NOPERM / # EX_DATAERR / EX_OSERR). POSIX /bin/sh has no `pipefail`, so the helper # must run OUTSIDE any pipeline for its exits to propagate to the # top-level script. Capture its output to a tempfile, then merge with # list_whitelist via sort -u. parse_whitelist_file "$WHITELIST_FILE" > "$workdir/whitelist-file.txt" # Normalize dash to underscore, parallel to list_whitelist / list_baseline / # list_universe. The manpage and README document that whitelist entries may # be written in either form ("nft-compat" or "nft_compat"); /proc/modules # and the universe walker always report the underscore form, so without # this normalization a dash-form entry never joined the keep-set and the # module was silently blacklisted. (Caught by the v1.2 code-review gate.) { list_whitelist tr '-' '_' < "$workdir/whitelist-file.txt" } | sort -u > "$workdir/whitelist.txt" # Compose total keep-list: loaded modules union baseline union whitelist (sorted, deduped). cat "$workdir/loaded.txt" "$workdir/baseline.txt" "$workdir/whitelist.txt" | sort -u > "$workdir/keep.txt" # Set difference: blacklist = universe − keep. # comm -23 requires both inputs to be sorted; both universe.txt and keep.txt are. comm -23 "$workdir/universe.txt" "$workdir/keep.txt" > "$workdir/blacklist.txt" # Per-module decision lines for --verbose (D-Phase5-07, OPT-03). # Single awk pass over the four sorted files: first-write-wins precedence # (loaded > whitelist > baseline). One fork, O(n). Decision lines go to stderr; # no severity prefix (operator-requested telemetry, not script-status diagnostics). # This block sits outside any QUIET guard: --quiet and --verbose are mutually # exclusive (Plan 05-01 mutex guard fires before we reach this point). if [ "$VERBOSE" -eq 1 ]; then awk ' FILENAME ~ /loaded\.txt$/ { src[$1] = "loaded"; seen_universe[$1]=0; next } FILENAME ~ /whitelist\.txt$/ { if (!($1 in src)) src[$1] = "whitelist"; next } FILENAME ~ /baseline\.txt$/ { if (!($1 in src)) src[$1] = "baseline"; next } { if ($1 in src) { seen_universe[$1]=1; printf "keep: %s (%s)\n", $1, src[$1] } else printf "blacklist: %s\n", $1 } END { for (m in src) if (!(m in seen_universe) || seen_universe[m] == 0) printf "keep: %s (%s, out-of-tree)\n", m, src[m] } ' "$workdir/loaded.txt" "$workdir/whitelist.txt" "$workdir/baseline.txt" \ "$workdir/universe.txt" >&2 fi # Expose result path for the renderer below. # shellcheck disable=SC2034 # consumed by the render block via $blacklist blacklist="$workdir/blacklist.txt" # Sanity guard: abort on degenerate output to avoid bricking a host with # an empty or near-total blacklist. universe_count=$(wc -l < "$workdir/universe.txt") blacklist_count=$(wc -l < "$workdir/blacklist.txt") if [ "$blacklist_count" -eq 0 ]; then printf 'modulejail: error: computed blacklist is empty; nothing to write.\n' >&2 printf 'modulejail: error: check that /proc/modules is readable and the baseline list is correct.\n' >&2 exit $EX_SOFTWARE fi if [ "$profile" != "none" ] && [ "$((blacklist_count * 100))" -gt "$((universe_count * 99))" ]; then printf 'modulejail: error: computed blacklist covers %d of %d modules (>99%% of universe).\n' \ "$blacklist_count" "$universe_count" >&2 printf 'modulejail: error: This usually means /proc/modules was unreadable or the baseline list is wrong.\n' >&2 printf 'modulejail: error: Aborting to avoid an unbootable host.\n' >&2 exit $EX_SOFTWARE fi # === FINGERPRINT === # Hash a canonical serialization of (sorted loaded, sorted baseline, # sorted whitelist, profile, kernel) so two runs with byte-identical # inputs produce byte-identical headers. NO wall-clock anywhere: the # header is a deterministic function of inputs, so idempotency is by # construction. # Use plain `sha256sum` (no flags); busybox lacks `--tag`. { printf 'modulejail-fingerprint:v1\n' printf 'profile:%s\n' "$profile" printf 'kernel:%s\n' "$_kver" printf 'loaded:\n' cat "$workdir/loaded.txt" printf 'baseline:\n' cat "$workdir/baseline.txt" printf 'whitelist:\n' cat "$workdir/whitelist.txt" } > "$workdir/fingerprint.input" fingerprint=$(sha256sum < "$workdir/fingerprint.input" | awk '{print $1}') # === RENDER === # Render $blacklist into install /bin/true directives and write atomically to $output. # Atomic write: mktemp in same dir as $output → chmod 0644 → mv (single rename(2)). # This guarantees readers see either the pre-run file or the post-run file, never a # partial write. # target_dir already computed above (writability gate); reuse it. The # consolidated cleanup trap was installed earlier (right after $workdir) # and already knows about $tmp (initially empty), so the post-mktemp # assignment is atomic from the trap's point of view — no signal window # can orphan this dotfile in $target_dir. if [ "$DRY_RUN" -eq 1 ]; then # --dry-run: skip mktemp/chmod/mv entirely. Nothing touches $target_dir. # render_blacklist_file output is rerouted to stderr so operators can # inspect the header and install directives that would have been written # without persisting them. Under --quiet, output is silenced entirely # (--quiet --dry-run produces zero output; exit code is the only signal). if [ "$QUIET" -eq 0 ]; then render_blacklist_file >&2 fi else tmp=$(mktemp "${target_dir}/.modulejail-blacklist.conf.XXXXXX") || { printf 'modulejail: error: cannot create temp file in %s\n' "$target_dir" >&2 exit $EX_CANTCREAT } # Write 8-line header + one install line per blacklisted module via # render_blacklist_file, which uses the same code path as --dry-run. # The install line takes one of two forms depending on the generation-time # logger detection (see USE_LOGGER above); emit_install_line picks the right # form and the header documents which one was chosen. # NO wall-clock; header is a deterministic function of inputs. # Fingerprint is computed above the render block. render_blacklist_file > "$tmp" # Set world-readable permissions before rename (umask may be too restrictive; # modprobe.d files must be readable by all). chmod 0644 "$tmp" # Atomic rename: single rename(2) syscall; same filesystem guaranteed because # $tmp is in $(dirname "$output"). mv -- "$tmp" "$output" fi # Stdout summary: three-way branch (D-Phase5-09, D-Phase5-12). # D-Phase5-12: --output-format REPLACES the human-readable summary. # D-Phase5-09: JSON/logfmt IS the parser surface; --quiet does NOT silence it. if [ -n "$OUTPUT_FORMAT" ]; then # Machine-readable: emits regardless of --quiet (D-Phase5-09). emit_machine_summary "$OUTPUT_FORMAT" elif [ "$QUIET" -eq 0 ]; then if [ "$DRY_RUN" -eq 1 ]; then printf 'modulejail: DRY-RUN: would blacklist %d of %d modules (profile=%s) -> %s\n' \ "$blacklist_count" "$universe_count" "$profile" "$output" else printf 'modulejail: blacklisted %d of %d modules (profile=%s) -> %s\n' \ "$blacklist_count" "$universe_count" "$profile" "$output" fi fi # === UPDATE CHECK === # Best-effort, silent on any failure. Fetches the GitHub "latest release" # redirect target with a 10-second hard timeout and prints a stderr notice # only when the discovered tag is strictly newer than VERSION. # Honours MODULEJAIL_NO_UPDATE_CHECK= to skip. # ver_cmp: pure-shell SemVer X.Y.Z comparator. # Prints 1 if $1 > $2, -1 if $1 < $2, 0 otherwise. Missing or non-numeric # components are treated as 0 (defensive: garbage in, 0 out, never error). ver_cmp() { a=$1; b=$2 a1=${a%%.*}; a_rest=${a#*.} case "$a_rest" in "$a") a_rest=0.0 ;; esac a2=${a_rest%%.*}; a_rest=${a_rest#*.} case "$a_rest" in "$a2") a_rest=0 ;; esac a3=${a_rest%%.*} b1=${b%%.*}; b_rest=${b#*.} case "$b_rest" in "$b") b_rest=0.0 ;; esac b2=${b_rest%%.*}; b_rest=${b_rest#*.} case "$b_rest" in "$b2") b_rest=0 ;; esac b3=${b_rest%%.*} case "$a1" in ''|*[!0-9]*) a1=0 ;; esac case "$a2" in ''|*[!0-9]*) a2=0 ;; esac case "$a3" in ''|*[!0-9]*) a3=0 ;; esac case "$b1" in ''|*[!0-9]*) b1=0 ;; esac case "$b2" in ''|*[!0-9]*) b2=0 ;; esac case "$b3" in ''|*[!0-9]*) b3=0 ;; esac if [ "$a1" -gt "$b1" ]; then echo 1; return; fi if [ "$a1" -lt "$b1" ]; then echo -1; return; fi if [ "$a2" -gt "$b2" ]; then echo 1; return; fi if [ "$a2" -lt "$b2" ]; then echo -1; return; fi if [ "$a3" -gt "$b3" ]; then echo 1; return; fi if [ "$a3" -lt "$b3" ]; then echo -1; return; fi echo 0 } # check_for_updates: best-effort latest-tag lookup against the GitHub # tags API. Always returns 0; the only externally visible effect is a # possible stderr notice when a strictly-newer tag is reachable. # URL is overridable via the undocumented MODULEJAIL_UPDATE_URL # (test-only plumbing, cf. MODULEJAIL_PROC_MODULES and MODULEJAIL_KVER # above). The tags API is used rather than the /releases/latest # redirect because it works whether or not GitHub Release objects have # been created for the tags. check_for_updates() { [ -n "${MODULEJAIL_NO_UPDATE_CHECK:-}" ] && return 0 update_url=${MODULEJAIL_UPDATE_URL:-https://api.github.com/repos/jnuyens/modulejail/tags} body= if command -v curl >/dev/null 2>&1; then # -f: fail on HTTP 4xx/5xx. -s: silent. -L: follow redirects. # --max-time 10: hard wall-clock cap. body=$(curl -fsL --max-time 10 "$update_url" 2>/dev/null) || return 0 elif command -v wget >/dev/null 2>&1; then # Use the universal short-flag subset accepted by both GNU wget # and busybox wget (Alpine ships only the latter). busybox wget # rejects --max-redirect / --output-document / --quiet long forms # and exits non-zero, which previously made the update check # silently fail on Alpine. The GitHub tags API serves directly # at api.github.com without redirecting, so -L / --max-redirect # are not needed. body=$(wget -q -T 10 -O - "$update_url" 2>/dev/null) || return 0 else printf 'modulejail: notice: no curl/wget in PATH, cannot check for update\n' >&2 return 0 fi # Extract the first "name": "..." value from the JSON array. # The tags API returns tags newest-first, so the first match is the # latest. Awk on " as the delimiter pulls field 4 from # "name": "vX.Y.Z", # which is "vX.Y.Z" (without quotes). latest_tag=$(printf '%s\n' "$body" \ | awk -F'"' '/^[[:space:]]*"name"[[:space:]]*:/ { print $4; exit }') [ -n "$latest_tag" ] || return 0 latest_ver=${latest_tag#v} case "$latest_ver" in [0-9]*.[0-9]*.[0-9]*) ;; *) return 0 ;; esac if [ "$(ver_cmp "$latest_ver" "$VERSION")" = "1" ]; then printf 'modulejail: notice: a newer release is available: v%s (you have %s)\n' \ "$latest_ver" "$VERSION" >&2 printf 'modulejail: notice: https://github.com/jnuyens/modulejail/releases/latest\n' >&2 printf 'modulejail: notice: set MODULEJAIL_NO_UPDATE_CHECK=1 to disable this check\n' >&2 fi return 0 } if [ "$QUIET" -eq 0 ]; then check_for_updates fi exit $EX_OK jnuyens-modulejail-06d8d74/modulejail.png000066400000000000000000047172011520651617500205510ustar00rootroot00000000000000PNG  IHDRg+caBXg+jumbjumdc2pa8qc2pagjumbGjumdc2ma8qurn:c2pa:17c5daf7-c26e-44c2-bad1-7c27ad839fdajumb)jumdc2as8qc2pa.assertions jumb;jumd@ 2H *Cic2pa.iconc2sh^BQ/%٠bfdbimage/svg+xml wbidb AjumbAjumdcbor8qc2pa.actions.v2c2she0\ qV4NJ£mcborgactionsfactionlc2pa.createddwhent2026-05-12T00:00:00ZmsoftwareAgentdnameigpt-imagegversionc2.0qdigitalSourceTypexFhttp://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMediafactionnc2pa.converteddwhent2026-05-12T00:00:00Z jumbIjumdcbor8qc2pa.certificate-statusc2shXK餱E|9 cborhocspValsy tMIIH0woBAKCCB8wwggfIBgkrBgEFBQcwAQEEgge5MIIHtTCB6aIWBBQ9qqp4jvr2TPpeatFATQ7lVPIfrhgPMjAyNjA1MTIxNzIyMzZaMIGYMIGVMEkwCQYFKw4DAhoFAAQU34I3U15T2DOx4AQ9JDXxdebhChkEFDk9EEfcl4+viHtNcxgdzeXupKUqAhALpfzpDnCM8gWAMe5EHGRzgAAYDzIwMjYwNTEyMTcyMjM2WqARGA8yMDI2MDUxOTE3MjIzNVqhIjAgMB4GCSsGAQUFBzABBgQRGA8yMDE2MDUxNDE3MjIzNlqhIzAhMB8GCSsGAQUFBzABAgQSBBCZF+LL1I5ZvcEgfuU53pACMA0GCSqGSIb3DQEBCwUAA4IBgQCGt+D2jIRCP8mngjjaRR8zGCZnG+6naR2lOx9nERXQ9wOsvSPah6D817vVM/vKeOfv0cjAa/WIj9A5szSkdcttEmRJmnxSwU+OD1QO382XK5d/kthBD7XJOUDB2sfSZZM1pA0zwqxMtjHOTKrgD95bj5O2Gm2nD55vJTCTiC3JJ6HbRf1/jPw78AnkOtCmSX0DEPHWyxCXxKWGsZ0lEA/mvcU8w9VxdtIbc7B9s0bkHFUn8AKqHSLZYFN6vkF+y9Ql2MnMOBSrIUdKqVm2w6rRQ9pEEeJ8dENvTnBId3dbPSkDjIbFGzk0Qt6KNXletkDHJNiQ22yV87JLkxj5xbt2wBvdRzUFEF0fepF6LkJxLxJIt8Sv8aFYRdvwBSn2qtkXHZ/bNqOHJoOifpEris2mbRwClh+jl1zprL9+s1Vtpwvhno7aI0RLNRwGI/CmAbJp8NTMtIHpoW7PkxfeBfOFGZrT2RCwybHR7ejYPjkCA4W8CPcKiZB4Xj4llBc0BQWgggUxMIIFLTCCBSkwggMRoAMCAQICEFpKsj/QKMb+S7M/bj3jJ7owDQYJKoZIhvcNAQELBQAwSjEhMB8GA1UEAwwYU1NMLmNvbSBDMlBBIElDQSBSMSAyMDI1MRgwFgYDVQQKDA9TU0wgQ29ycG9yYXRpb24xCzAJBgNVBAYTAlVTMB4XDTI2MDEwMjIwMTQxNVoXDTI3MDEwMjIwMTQxNFowTTELMAkGA1UEBhMCVVMxETAPBgNVBAoMCFNTTCBDb3JwMSswKQYDVQQDDCJTU0wuY29tIEMyUEEgSUNBIFIxIE9DU1AgUmVzcG9uZGVyMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAolCTQeZKS94Lm6aVdCZYPOxS/LuUHTLNFMPGUN/QvZzGbnCLI5fXjO7MCHxW7me++ZrAkrDruqUz/21pFJCDLwiILRXtsEtdHyybubhlFyRj7hOwJGCNCugF+HkfxtNhNVuMBJdYn7OMXNjkxqbQQ/Czp9NU2WyI9xinuMTYbv0xKN4OCS6QJ/Vz2Xem1VCaINm8yzLFRrn8olUFTe6gm6xoasEbPzgqegbY0126tLMe651VKe7s0jcUn67FNqmcsLfeRCqL6FCnESAIgAt5eyXP2TnynkWbd7oHeAmgpk57QI4x/eoiaIcVgMSCIeRPWvIR84gPpEuJKn5MJAEmqaCaBMmdfAXua2KFIjIB7tbcK9Lf1kY0dqCCKHiOvirdDhTk1moqd9t0ejUnpocWF8G4HvA6U4GqmtYrk6/jH5u3ZdImMEqlHA6+yvGLf1o0Aaah0gEIhXI4WDnE7D4yHR+E3zcUedYw0zcbeObozZLpbisNbuww6zI4Lqk80i3lAgMBAAGjgYcwgYQwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBQ5PRBH3JePr4h7TXMYHc3l7qSlKjAPBgkrBgEFBQcwAQUEAgUAMBMGA1UdJQQMMAoGCCsGAQUFBwMJMB0GA1UdDgQWBBQ9qqp4jvr2TPpeatFATQ7lVPIfrjAOBgNVHQ8BAf8EBAMCB4AwDQYJKoZIhvcNAQELBQADggIBALtzplWEo2hQ6xDxoGzXySmEnT6oL+0Kuw6g66vLwR64AYYFtzAlSG3zDeG9oU0o0itlYETcto2rVT/X3YUe/vCXWyQs7K1LH0v0uwn6nrDgsLD9jkRytI8Mat1j6Ouy1gvUx/Hniw7f32zECaL9PR9zGxFYwSgpomtgaTApO1W0jKmkCJCpEnA+bnLEdhwwaYJPJbRPVc7pSM9fiwd/zfBWa9/cnoYfNvA1jsE3lXO47bYYqES+9pfeSQ+8j6E+cifQPSF8UlxQqccV3Kn7922wKgcmEBSglN8VZIWMpz2KOjEGdJEh4RjsSt+FEWjOYamkazIz02jmyb+z/P+V8RzXwgVlSmxOR/6oYJR3aEHOTihEpcaYh6g18o4GZqokvWrBEq4YIGvedKN3JmWnpcIoHSX9PqnlFEm5B/90aBRyR1D7dJoiaIUajL+DAJzZ420Nojxcx06ldtL/wqrFrrT8KkJsJ6i01jnLF5lYywcLw7H8Nug11MteyRGYmM7ogosS7QtYYbphkdGpesk+WOD8lEhMdObP1HyzAfLoI0voMGgZuyfsufYJtu15k+UKgrXH5y4axoVrk6VBWSmUuljTb5ZNn1EzkT/AuFAbz7W6YIjpNwpMlp8jeNrByo7Flj5s+l8AN1bfCQYhmJJ598C/486SpxSrLFc9QdQSieA/jumb@jumdcbor8qc2pa.hash.datac2shH 5b*Z<~p{cborjexclusionsestart!flengthg7dnamenjumbf manifestcalgfsha256dhashX a6-Uf{+ kV˭*M> i䌨n7T%ef(<3=gdJt!në&;,UGNx7t;GamAr]CSɖN:ߨ.ѯX_r#FbnnԈF/*j_N٣[#~;T:3j5zv/Wi >?T{Fc/p+V$l^${:X;iptn&ëESGF^h5|jeJG/} M2=&4 "z^^g_Q[$VYf ц.}~yDf|6Y00|J*ޱa*݅D0  *H  0O1&0$U SSL.com C2PA RSA Root CA 202510U SSL Corporation1 0 UUS0  251107162713Z20501101162713Z0O1&0$U SSL.com C2PA RSA Root CA 202510U SSL Corporation1 0 UUS0"0  *H 0 ӲN@g3:Oc/QjĮ$Jº6XmN}׮d:7\ ]I"*tx_Ć?)4?c- D1 4X7d= ԍޣf0d0U00U0U*Ju:csW쾓}{0U#0*Ju:csW쾓}{0  *H  @D} D{ME, X#."{9̵rtghy\CgS)&:ժs" 5KUS(zp8P%]a'99Ը%.Vx ph@/\Ga33\Ǜ֨VuvhKf+Fe82e]TsyIU@xW€n0v‰J#L֞$ӓC ۾W% ,VYIZ;ħ20260512222503.018884Z0 ڿm\f00^aF(2J`l?q0  *H  0{1 0 UUS1 0 U CA10U San Francisco10U OpenAI OpCo, LLC1 0 U TSA10U OpenAI TSA Issuing CA0 260408174626Z 370709174626Z0u1 0 UUS1 0 U CA10U San Francisco10U OpenAI OpCo, LLC1 0 U TSA10U OpenAI TSA Leaf00  *H 0ŭ'xa)a*_/=U6ji,D2 w5d[ (5ݧ7" Ms.|PG(i)zY5BiRJ 7h- KF\=KEf8NM'ʕu Njt $_ ~\ <*^ MɄZI,8s`RLj ]\5d#S?be]p+k ERWZF]]v%yhQurUCbig'Aŏj+I-49gEgr_UK,$w>dQ 9K=>=6.cx0v0 U00U0U% 0 +0U'T{=ņ?pƒQx0U#0T=#Csr=0  *H   $OA2  H5OFV~>?#*H>QE@xNPɛ'hMy?Yp͉G~Fؑ朸4Fax}89R_fsr;䨫*7!;{\TLj*KCt`swjn*ΚH 7cQR|ogiB^y<.j%A:RPdU! ߶)'nѺ4FJ"ObwE#a-1)Ĺ~yW\{eIM'@N|ôCv^0c5(tdZ5[/:>N a0MCN.!>:, W0ujdK נg&Amgpv%&V&'KI0~0f N0  *H  0x1 0 UUS1 0 U CA10U San Francisco10U OpenAI OpCo, LLC1 0 U TSA10U OpenAI TSA Root CA0  260408174626Z21260409174626Z0{1 0 UUS1 0 U CA10U San Francisco10U OpenAI OpCo, LLC1 0 U TSA10U OpenAI TSA Issuing CA00  *H 0Թȡ aPjLa@npz800ΠP;l$3,O}0  *H  0x1 0 UUS1 0 U CA10U San Francisco10U OpenAI OpCo, LLC1 0 U TSA10U OpenAI TSA Root CA0  260408174625Z21260409174625Z0x1 0 UUS1 0 U CA10U San Francisco10U OpenAI OpCo, LLC1 0 U TSA10U OpenAI TSA Root CA0"0  *H 0 uVتj_y-$`yl6?,Ps I/x?a,%Q%/A&m55`@Q*؝zkj.c\)ņ"h8P[#C8B|;:Q/%H1Pr|woa?n6k2w^\1LeA(1SCHn}d).:TZrVWj}aeH I2t ݓS# w:F31ffo~!A^͹3]x'1P0rsjϭdNv>,w. ܘ : Ǐ_Z~H +[<,ARh O`)퇍q\(%cE{alFT;\ɰȱ#?[T*Sۦ섉rz@XG[$a9Lƨ"[L,f0d0U00U0UX@/dT6^bE!<ڜJTe[kX~IK_ ;ךYG8ðtdR;{(ki (;'eˠ깽D☱ HhU!`}{ x@.ȁ \b*VypFcd<鯥d^-ӤRp. U+#B+C\졂a?q9 x^>%410-0)0ZJ?(K?n='0  *H  0J1!0U SSL.com C2PA ICA R1 202510U SSL Corporation1 0 UUS0 260102201415Z 270102201414Z0M1 0 UUS10U SSL Corp1+0)U "SSL.com C2PA ICA R1 OCSP Responder00  *H 0PAJK t&X27y07x͒n+ n028.<-00 U00U#09=Gܗ{Ms*0 +00U% 0 + 0U=xL^j@MT0U0  *H  sUhPl)>/ 0%Hm ὡM(+e`DܶU?݅[$,KK రDr jc l =sX()k`i0);Up>nrv0iO%OUH_Vkܞ657sDI>r'=!|R\Pܩm*&d=:1t!J߅hak23hɿeJlNG`whAN(DƘ5f$j ktw&e(%>IthrGPt"hm <\NvªŮ*Bl'9X ñ65^肋 Xaaѩz>XHLt|#K0h' y .ƅkAY)XoMQ3?Pϵ`7 L#xʎŖ>l_7V !yΒ,W=A?cpadY]YSP؃+"|dUe݊Bًxpb:E7J(*Zy2,,:XX.qx^h@Zh=E4{|\k95[>hU!WLzF%Jwp:#Lu6Vgd0ѬBj\ECD[tlk[S>"mA6|XlneZ):CuЇnEP{eA^ ߣedWI͗=7IDATx$Yw̧rKcm۶m۶m۶miJ23"vjz;kկlllE2@` lLF"3 0 ^( 016+$0sL6!y~d 3gB`.3 0F 0~B B @lB` 0χ0/y&L@`@$d% ij @d g6y3+$0B`^0x6c# `  gF\&yxx B2ϟ`Ϗ1 ldxs/b `%0c %30"a`M@™gf,/qx̳ <<L  s0@x y  ♌1gg<'!L !2C" lsAB `<l!1 /2M<s?!E<$ \!I\ay&I؀yL~l\a$!`$\f 6AO`xN l/$q1b E̳<B9H<x<!<ٌF<B!"̳I63 " GYsB żȌylKx&<`0,^I\aH<_E"dEl,lٌy~x>sLFH`ز1Wg2 cc'.3~6<'ce<0晄y^Yͳlgy6eg1xlYl Ƙ+ gK,lg!$lE`x!|1 @ 2`B E<L 0$ ! "@XXg3@!ϏqϏyN2x I"/IH`@"MBx6~♄WHxQg3ƘH晌m!@@\!`@WHH2y0`@ L0|`.3$x&@`# s+̳ yijg&ۘg22x!̳  &@x$<`لaa@ [F 2L3 ex>y.&@\aa!yas2/  # #s710 0  d `B 2 $$/ a0/BBB\ag3 < /, ̳ l&q?K /:$$ I<gy!ijd @l^(/1`$$ !1d HBl 0gJg9a0 EsϏ$I\!@Og2$@s sg$H@B<@<c.3 y $$IYW/AFYxxA |`s2l`^0cU$^Ș `W2s<yqy&&`6K `¼09 e0$x xN$DZB Iy3!`0ؘg$B e`0ϏF̿̀xsxnFs3X؈%W%I Iyg1B`0fd0b d3+2$0`.3x\aF a`!\ll\!x sy^ Hg2XH F 3 g3Xċ` E$L2f5lŘ+xae@<' ۼP_K M<'`2`s2y&#?yN`1s,/@BP$ xL$a#`0x^⹙+ `$%^ s?!E 0 ųIY cIBg2L\!l$?B xјl$'^`my  xEfqL\&x cmI<_@<y6|ټ 0"dƼsY$3 Y̋Ș!^syX\a^y6 `fxNؼ(CBB< %Ig"$`b0\d@9g1Y̳ےxH< K9I``9I1W23ے$ls1J_d9BO@<B9ؼijlKya+ds03Ŷ s3C`@ sm@`2``.3ϗ$0By~lۼy#` I0s0I\aal#^31H M`2 yN66dE⅓3g3`̳$<% Ll yI$!y&q# L0/xs02F ȼH%^"!0xa6/*<$\$'I<7A`< 9 g&`g0x6L@_`. 61  ` $<@X $ $"@pyQ`$@yI\&ϗy.BB$$@<@ ,,!g/sx2syn`'!,`$0W @`2&26 ! eL y~l; WJ3x&y~xB2K_ #AH<Y`d^ q?s& #,6x&!a@663g3ضYY `0 @<' 6ϟHij,sb^ylgbijx6b,g332 @6"Ls2ds$Im g2HO<lij0 cH< l@fL\!$L0l@0x&H<@ y6 !dy!% a +ijˀ%c< -qllyE!3gxc\xn6Bۀ$$6 BL@ ~l'9<e!cxI`y^$q?c̳~B\!s @e0b<y&0d<̀A`d6`@d[0L B<0dF dFH`6 @s/:,6b#,<7g @x6csxs1KlI1$0lIY Efd3 $gyy6 L`" ^ @`s? ecF  E`I̳`-q?ccsm@`.<  0O< |`.2xmx!ccx6s?@B<1Ƽ⹙+m^I66d\$l^ !I0W lEB2ƀx 3 ,@ 3Dͳ0O $$ 6Y!y`HB$$sm `0y ,F\f0blEbg1W¼0`. *2`I6A|Fy01"L$l cx.6fll$F,q HY$Y$.3H$<xNF$`,`,Ill2< ~<$ 0l+$lLB1~ L !c.lsB`0,<!lLyn1`MBmg,@<$`<xlϟy6a "6Yl.y&9$' <'Q1$@y6@3 !c B lKW 0lx ƀPk˼h2Ga7z7[2%+0˼`, ˄$@ .ŀ$H9Iؼ` d^F<q!l`0y3ȼ sg`̳Ys/cy B &^d6y&xqmg2 xN \aI x>`.3 /0fO<I06/xQd$#ij0W3l^ @ ,ƶy6χm܌s3Yx^sm`̳g3`g%@gbc0"1B< E\aH m 0@<$x!l,6ijg3X \f@g1Ϗ`+$l\$q `d q0g6 0I` `c@ mH~6 2&6/kI~gx&l$@m@mH\& @<$. l@6Ie\a@6 l,BHgijH2` ! 6g2 a♌$@26WgWȀ$l<'I湉+l  @ LB`y I\ae6؈ $"qm$6WH< c$cs2!\f@`@0`m0F<! 1$!.3 L⁄y̳g2` X@ d$0@x&$ 2-dK€x& dBB2F F8c{7~l\fiJ?>@ lI``$0Wy B$`[y`gyn631A<$gL6`@A`H\a\$g2 0 H2A`@0A6dx !09I99g3McI6W+0d33Os?b#2慓6̳g3 X\!g x&KO`0H2f eW@`6@`I\&1L~2<7q6d @˄B9 YƼ ⹈gYyy"0ϟ <yN@B1dWH -0`g$y!< ~es&I !M<B Wx&#2!/$'Iχx@Bg$$‰ @dIȀ lYij!@2/g&9 ~x&#  0A $Y$  q?!)6<' B<3 yij0$.dW9I2 ,26 ˘gK\&< x6ˀ `$#.dyW<H$<$\a <yNB6 ! q¼0B1`d !0`$W3I2c$s6M+ 3I63M ـ9 ! ds$^Ic@`@ȘI A!c$cXHY ` l<$L H2<'I6yIcx c:!x. @<X`؀0sAͳ$,60˜y L `Bq? l$ @0ƀ$2gXƈg2x&#dF2 0gd y$0WHrNyWx{K! JKm"[;vov)=NA2 2  ,ec@\&q ؖ @1! <'<$0@gf L02#.l. @LF6Ia`M6Y$a 0 @0@ 0Y̳! xNAH2  lB<x&`He|q$. s Wˌx& $Bwx`@@(vXӟxhig2H@2L\a0 l<'KF@<'LF \! +lH@ۀx6K\aG` `Ix&LI s-L0\f 0H]*!B d Ll @!HL L$lL@O`9I -g2\&<$l K$lfy&晄 \&e 20$.3I@<%@d1L`@e@`I`My6%' lq X<e3 Ka3ij @\&d$ ` !0g 0 0C`+leIY1WHqae˄%`a`.{{>{ oln 5H ƀ"j{mBYd B2@B eCg !@B<@\&x&I@|H0 @@$L H2L l6BHq?!WH0``, `ϟg MO egHqx !~9 , .x.~̳$.00+ '.0`$@sy @<!B<7x6s?I<7qFgYeF<'LxX0$$@q?` q0Bh@ϟ$̳ 0$/LB<_x&sA@x!H$<@<!^dY! B<l2g6 L@YċJO @\&x !@\!qW&% d.3@ #, 06W%002\aH\&6A<7s3 al"y&cs0d0y #Fyx$x <HdI1@@A<1lB+lWH~Ƙ+$@6E` L qBlx&,eW9 ynl$\!q? x HB M<$.3!؈$H<' g" &^8qIx .@t@KR,%4l0g  QqOt`& PH@(tppu݋cֽޓӠ"%I<W$ @IO2 |$`xN2".3Bx I< !+@@ 0Wg̈g3/ų+dIb I G<e @ 0 aBqdB<7 Bx6q,x !@ L$.0KA @H03C I &.x>$ e"`./CˌyN/$gI<@:ZKc7w¸:RTd<BlgAȀy  DAgWH2 eB H<$♌xn2gA\&as0$@ B0ͳI\!lI\! Bge2 ?!HKB~@x H`"d I\f@!s 0$LyL_"!-$B2AH~⹉$^2C<ZB@a9+$^`g !+  c/,BH0`ij  l<$HB @\&9I ,0+$ @<@3 !^!,B\!s$0 d'IBl$` \!aOy.B\f`y&H2c 0~a2q?⫾}4{M/G EUR$Iޅ?ufq2ƀ3mdsVa^{M002♄ d&0H dF@93ǦW~ïZDg]P@fΆүҋbi`d R 4moo-'EBH2$0 x3IxNbFyIl '6`d 3gO92L2W  +BayIy# @" \fg2&͒~晄xI<s1qg2I\aq0l. f.3,ͳ`Bm0~eWO`@~2D ؀ <' yN as?sy9I<1/,cI\&02Hh$l$ `&0χd/!x.x&c3 ̘2b@!dc da@6 lL2d,. a qg0`<Iey6+$@ gl+lOˀy>A~-T$" sM⹙2$BB<2$' Hy+3Kg1IFedqͳg&$B`B<_x!c+ a@ B"q? LB2I$B $  ,$B2L,⁄B@\fE\!  @  &3 B "x!a#\~F\&I0$@!0 /* ij$0M\&B<$6$@ Io>sco.y̨=B[$$hӟtE=si06`C(1eruM7vw!<!@$L~@ 2H~9IzB$g1apQ$z{{˿p_:?g/S'svKE]N2 !lmؙ6]2/;'N," B\c|oۺw_6晄1ABd `#2 .x&sA\f$'lLH@3`3$%!0dI,@LL @`1$q?y xNs 0xN€W+l g`.I`IA@gm~F<l '0A0<'I\fL0`)DY/7=duG6tR- F"۞q8N\w]u8!0B%iG'O>aYygTag2!HL$a+ g1 sA E 2s @v闼Gz @m [__i@20WH%_Q_mrxxqlwmp^:l5)$Y=2;ۿ~->ަ(/gvOO8Gm :5pږ4Nm=N i#9 @6# dgI2[\asBWc2 I` @BFYl@T9Ӷ 6!l% G m_17|׼˜aڢnx~YݤF48A l`; bQ;ɯ+Y$ae'H$R{ԣ5m= Hl @R1޺{YTm̀1gcsXeyN 3 2A<"O2ads? Ƽ H<7c,A@`LF\ad!as? l-3Y0 qe1˜l,1Wa1Wijll$@6`2, bl 6E6$3$F6W@xc$$6@x&s$@y LIm<1H< 6W% sƼ 6!mϗ 9bijHl,ij0$ ly>$ˌ1/y# 0d,B  2` 0F<`@+ll 0H20A\&0AB@B< AL6H*6/ـy x !cBb l2@9IY `̿$,9610l$@ I `ssx6cx.<1"6Wd$.2`Be6󜄸ee6ijY`, 6EX ˌy ``$g1`<Iƀ  m!6WgBƘgdy󜄸Fx Gd`$qm$ s1"`̋L ,6Ϗ1 HyN$yIb/b93,W4E $@! Zw[ͣsmn*c$ac ,0YA\! 66LBH<Wl00`gyNF\&.yWa`d!ij,@e~ y^`\$y. H<+,e2 ! ـyad.`e a F<Kx<,q A2ɀAfd qe2I . x 0湉f@€yN `$0I@<yBl!0慳$E"e\aM<I?em0&@B 9B\w-}ժ !dII"[-Ww^괍 d 6d$. +l$.d qL\a ``sd.A<'d 2[9X m$0`<<$+ 2x&ad! `0L!ٹ&zI`%TP6DLo/%^}G碔n{ܝ|S˼` @ !k0"0  BhӴ1xƏ|SڥT8a d@H $HB8q>q1/S\3aR`#H  0͍xƝ7߅ N`l2I~ lg 0f@\!!E0W6 $lM` 2 AX\!6I9I0 0$,B xly&@CL6"y !lHFYll湉` $ f !c'`+ `@`,q? l$ l'1$`- s`g1 y ,  @O9+yBm@ .&1d$q  6W&A<\f`m !c@2B@0`m'g33X`"ij,Ƽ@ @H\a2 y6I<x&#` ,g3`g2$%H\f\$@LB6A< 0!1!`#d3s`BRl!By  0ϟ$0qcE fWq1$6 6A<L!X2DB`$I RBdT3{䍟%VoʫvzcO'CTkp F!X i=NF@e Vc[>)[P!dS@ B AS躛n~=jskۀmI[=(g`eI\f @ 0 Y$ ɀ ̳Xs9I9g1B9I2<' , % ly !ls3&0 IcH  <7H\&0 yN0BȘ3g%'l'@llBa#ll2 0AY `qij c1L`!+ @@1 m<7| !H &ͳ!d `$0@e!yI\f, 2̀yK\asA @g 2`x&#̳ @2`l9X B\ace6B`@<$gg6a0 L 2Y`s 6I\fcX\f cHBl y6/$@<ij6e @1"yB+ls$6APB Y13I6WH 3l.3♌` l2\a L 1$ <mK`$ de   s`ij!sx60Il,!|g2 !syy&y!M '@2< 'd̋HyIlLlsy&\$s$AeyNx& <I5ǵTbcsx+̳H2`, l <$s?HlF!gIy I6`#q?KO@c@ 6A`lg̀2 B63I2<~` ` d̘g3gH63"d6W 6 H~$<6ɀ$e$a2bg2 0LB-l<al .3b@ @6@\lyn<q?ɀ͋B0aI3`$ l$lI~ H~e/J&NlcgW+$G<=j5& 2HJ[mIvbZax>5R-͈f$ @<_2#ijd & l\!+1@6IslmlI<'cFxN B6`  0H\! 6&ɀ-yY$e<~A\fsyN6WB  lE6W+d`IxmOySVD! ؀ `I"X!LoF[]=$Ŭ+{}O/ή^![Æ4ƀl lIB@H Piwdtuǩ!L2l !<@ ##"$nDxԟ~{]k3m`a1`7N<y= l I@6 3 ]Ww7Ӟg Y؀ @F@<01yyN6IcE@\f2 W09$.30g `@d.e6WH@m$`؀  g6 ``s !.I6$2<7LF<  cHEd @sA,l,6e+$ll6$q?@  H `2W$[x&,E9I  .y gŶ1I`M`I '<0MX@6"1`H`  gB<@\& @O  $aH6ij\& ٙ9~oO|T` `8$LiYj}w| 7^.dNO~owl(}0Ƥm` d[$2"ӸXln?k]?\thI4 ,@H<1$Ew6~<~m-srce$l09G"N`'0Xl `B\agLd.3 `''63<_l l$@9I2<7q3̳ I0#@m+l+$qma#BAs1 I2<'Ic$.sBy&aL2q 26`0I2e6 0 ˄W6 H`xN<1I$yI`˜ !y6afL6l3YxNƘg$0<$6χxNm. sy& g36A,cx!0F<_ByC3לi33"$I WA&rW6=<)Rl x @~Wc  X`0 A0`ɒ `湈6 E\!3$.sse6d g,cˀ,ijd A1dC ؀O`B+1 @\&qA\f$  6exN63<0IO\fs?~y+L<I,, yneWg30H9 L\&,3B€ ♌@s?Im@s3< qijH0ƼPm0@WYHq L !c0Y$a01 <$$@~ qA`Od B Y16Ed F@P` ,BA\fy !0,2FX2` ,IW$H0 0` 03+$.3<1I@y$@g`"d1bW @c3 ̳/ c$@`턌y^6 6 \ $aWB`d3YaL~20 q?c! b+   2b^( d#Llq3 ILlL!6`@e92csBI<< aI0y9 !<$l$ +<sd.`I 2cI09g2/$<g1@bge ay& 00\a@@l$B` /A Ls$8vЇ=A6 aK2lK.Bw~Sݳ( \&,,RXH$i/rOz7}We9Y_tw׭HJ``06ƒ ["I؞ϻk?}|1GVs;Cpip$!! !0`%(v6w vW;lRJv8#S\& L 휹xȩ3giZYJ$l ,NK͍yǝO~.VtFc\!A`  2WI A0`E 9IYgs A0<' @Il< K\&Xd@6@+ `! lX @  2`1 X\fx&,Hl$F0@`HW0F @uGyO{o^ Z;)3cܦ|+:Ԑ!,qBd1d.VLf;s{wr+j)ᴝaeB`pN\sSNm)3 1r&&B{ħ]< 1qA2Ȁy $y3I+$.y$,d ųBW9H0`$ɒY0LB\fql~$,2+ F`` @qm$6&01I yNB  0  6 .F< s$gsL@y`I`Md.dssq?<`̳ Y`Ws20 F lH aOZvh a@eFm484l-xƏ}Yw 7l$ػ~;;KA%@1!l 2+ `,C|'p';∦(}ҩr B\!@ n_Ї?ԙ2# 6dL@b>^t)Oz{iӀ1cf#@c/0@ `$ @\fLZqJr)MvL,W{{VC7+&ˁK` `ld(@&(Ƕp?u/~=n]ZNa!\&. mR9uyȃN:fƖMl[2 93<)i}  y0@s%'0`x  6A\!alx&K$qmx&$Occ,0 '@m. @yN29晄mH2`s2\3Yy&!s Ƙg2♄,g<7q,2H2$`2I6d Blf3gI0x.y [<7$m<qy@@0 I\fx&$y&@ 0+̳g3;qǥ9S E 0H<\f Ϗ3C<dg3A lHc! H<7<'qH6 O!m\f@ e ͳ6xN9g@IyI\f `}8<%Zs xˍ|aS1XX$ɶ̬.fY_;q۰:&:6$Y`g@,q?~s`d<s؀yn6dIa0 lyn6$d0 l` q$l2a09I2 yNB\!s@x IH`M `ggL~ l%q  @`I\&l?!yN♌y&HY湘+l 6@$e؈D\f #0dy.1 <@9Il E`s@湉+x&03HY 0 g2ƀ lgB`2c2c L`!x&0 0ɶ$lOd,$Șe6IA1X0 ql`#@0g10"eL03€A0c I<xIy# @+m@6Hg1yNB`s mE€B2! l⁄B\a$l0π@2`sd.3,s,. !ƘgGd~ <'II $lg$ 2y6`$ ,B`l6Ws0@ˌy `@`$l,@qeƘN1  2c @\f0@dyI\f$ysyB\& eA s0W x&!100$@` [`^HlFOl@ cY&3 7pݍ7?ql@Y`!y Edey.!Hl,<`  s0~2A9" lOF"3 l0`H\as0W gL@`Ie xχY2+ @`<@`{2;y-yЩ3gq#B a,əl``f}{.;U$l0A $Ȑ ZMK^of/1+֗Rj8eZD-l\! ` c g:HH O-omꇿ;Yg>j `X,BD"G$q]O}?~Ӈ,ËLR" 0 ; `F0LFPWPf헾<' 6 @$l;G7|ӱQdP$D6Bv JF?]y]w_8lJasXg` sAO0 ij<~]w Nw2L0Cۀ L ! ƂJmOƹv[(&0 `,0`%B)! }G'#jŐ tt.YH` x& 3 %e6F,oܧ<7E ia $Hds$3X$q!!%@51vdJ)l 66@c !.z9B,f޽~گ]K3qb;m e koʖ8R*P (!I2yf;{gqquB 3 6!e66AeL0dI<qY l`q?l<Iy&$.y$Y`WHH\& l g2`2g3` K6 K01@$\fs?0qdd`@0 g.2 l$̀2+lI6"9$<B~9 dsy s$e6$OdHx&cy6@B2|q6`Bc3@2c q `6A`I6⅓d~ƼP0W,@1F$$\fOdIg1 e%9g2A<d0y esI<g2€FFIF<,y6X\&Y<d$ c! q@2L@18w?uo~o(iL sL0x}ngqiBH*Qx&I`W$$9S`]py߽;.^tRA6@67l;zj y0“;xګl4N` ,HfQw?,`nUOmNlH3˄B! 25(77#`€1晌2 )FX?9/b/{:!S47 `@!d,3I؀ , 6"jTPo/$P"-[ I$B 8'l믹k+QimB`%em 3%jWiX{]<M#J alll0$q$ 30" @6y&B+ 0` @   0 <' `$ 0A 0` LBf6q0$B lg.`\&[O<$ 0s$. <'`.B6E, sd s?Hl$A<ͳg\aIYls2+$F<~yNB c"lHd  !`y&I`e0 l',a 2ijgd^ sdssy&g2``<<'xa$cI6 1 0 l`$.xN`Y 0 #_;q=y&ئiPLm$@`@]-i_8;呝D '0`.3\&H#, GfڄQ꫽#C_6uK n? Z!lƶ۶d.ͳɲms?!Fۋ|߽-wI`;66B U' o??xckcjPD ˵ 6lRc  Hv|#O.MR6",!$ 0"1 a3B"1Ei[''~0PPj)2KZXHH6FRc\{̵[68flKm#~-jYe^ힿx]\paXb + +!y&s$dy.Y 2\a0  ŀed0#A1I\f0` 0As5'Nqi)$$!a<@`NIuwwL"lc0ssRUql4.o6/r+KӥFv8;.>you, d66  aɶ՟秿;1d)@ m`0N0 Aح[7>NBtۿ[/N`a1e$LY$I"luKoA׽=…ը 0F`2 @f3Nծ)';']I6 BHHˌ  Rtcp3'kSNZS A #%e:BﻮpQIH!s? 3$#0 0 0$<7@ `6,6!d `g1b\&-I Xe@6,6<!m,W IƘg `O`I<00`KO`$sƲx̳m^!HyN Hy !dyI<7H9$lL  ͳ @@B~Xx]C.gQz,lIf$ `gd 1X`06Vd /t%L^2`[6 $Bg26 iϮ^ۦ6eB JhIg0`0!@`  3Ǽ|M|+Rl$ 0`d,l`ݲQ\Dvo\l,>zaZJ$d\H0$0 '~uk9ubcè6M $+lĶSDuT^x=_k - @0y <lgy0`$`.3 q1d$@B€y$l1$@X,   Oy~$@sF2iLI@lm6(B]WAz}{iI@2Na#l˖D,QM*#v[K;K}j "[6,l6mK H!$6P]q$0L< @<! s3Wg0l 02 3 .d$ɘeF<a s1@O< 6Mls˘L2 0~6"a&1 `#̳c !c$6/x&0g2u0MMmj, ٖdsBD-jeKw.]t0[ABlg ` 3I sc  Hc# <7y.2!$I\f+lL`d.1W؀Iy Ics3ų+03$` ~ \& 0We2a",0` `0`0+$؀@:f;o~\.3b.pm# l$ g0` 6bo؉c4֤6@m J)OۿGH&@ lHYll2<I2H*Ed;۵/=xKq.cR$ L,,#A!@,Y]RSkjC{G~TEbLaa!DI 2dvJ:}ͩNnnm̜ZLB20HN̳HaȖD(JZk-8..ݽioӰAd0$0A2Fg<1@l$.`̳ yncx F<~Y$@`$H恄9ـAB1@\&,E<'e 6E<fs$y&yN BYA&<7qyNl0I %A6" .2Y  `$ ` e<x ̀$` `#B\!sA6"B6fX3yN g2F⁌1$$q?g !0,sH~Nnnm-6ea2m@Ʋm y&I@ TJD(Mm}w[PE0`c+l &Yr0jSkzG_&o/ؕ>=ڽ]v^*%(J X~ m \a#``# 0d,bsk/y/W,vbe H bk?q0MM l66 F8mSPJy}[I@a$@9c0 0Ϗ$ c3 @9Jc^y?ǼF{h@`$$ H< # `lvT-e1k_2'AUϻ(.OW ԮD  #AF0,lM`Ή'N:=πijm4D ,!DfHmKHa-)"M0 {.]tjy4,vBR)0$0`0@3 IyN$πy y6cLHL6" ,d2ge$`[X 3@!01 @s?!-L`.3s6If`s 2gWH ,0Mm0$@2$g gL2`$qmA0Eπ 0<,.s!f 2@@d<$.-ijg1K晌L1H9cE`@0B9gg <L3 @% # I\f#LyN $L6Ayl$.Dl<$. ly!Ƙg1 ay!F6A`I` HȘg12c<_6H ~$@0@ @@yLY$@\fs2`#0Xۼp6"!.͋@`d!@` @湉  $d0R2s23aX!  ɘ$ٶ- d6D!ZjZ¦h9 ˣ&`'as c<y& 321 g/9I L#@lL0<7%lqx6L2! @`IgH2\&0gg3 lEB dex& le2 d̳0Bl 2 fm yI01$<0  @`s9Y`H`0q1ϟ$y~clg32 @\&1efyn2+x6A6"x92#,q1 g<F, @+dF3   O  B1y \!I`^8l慑dy I\fL6" $Ře9Ic0,ag3 #0Ƙ+ 0<7+$^`!0Y$la<qd `I\!d$ lF<aI6@qm0MB1LB<l$`+ 9 ؀$l@<B<7yN\!6&d!#H0HsLX!~F$q +d+l`2 @$Hds06`H, @$mc.6766v7wE?#bl-ֲ5g"a$!$qm@ 6 m۶% ZJ^/;{nKxA!BdAؒx6A\&$IZh65zWyc^_7\_iWGWwݻGR$mA@ x&q?B,FL"bcvR/z@]_"jYBI+eW  u 8/Zfk (d,$y& $ٖDyHQdY\f$1%@B `@<a0 /6W{SOwW'a6`e6d ؀c6HHmڕ/Y JYWsg׻IsLMe'$1$ s? .Wظ!)|csk{c[ N'BD(  c,Hlm$l$m IRK)ֈPZÃKGr٦)€)ls? ~A<x#  6W@%\aYfM2slWa%~ @B@63`ۙ~cuW_@Q{62a  `e Ήnis{8LyBHH[[) g Y<3I< B&`0# @HHfym6gkv/FEYF`YlF\f$ 0Hؖ0E}W+Jbk}~|MInxƖ-3 `$@H7Cncksgر6f(Zf&@ 2l$e& H2I6c!ˡڕ֐2sq>:)k{_ LhKX6H0 0q(QcǏ?ylcc:Nٙ  6"3Ca D6$qB %"""$)iհ:ZWp& $d) 6`ɀByg3W!0e62g1$E2`s?I[e d+l`6B+e6 K6 'lMAs?L$lbd `'0W+$ e⹈$@eesyN6WeI`#@\a@Il$lg3 l.3$ɒ s?Im .32! s2€y&! !6 'ayIaIc  `1 qI<a . ij@q?!0ٌL9 d `6Hڜol7!L233L&` c!NBmK6B *t]WJV/]i?ǵ\!qͳlW@\fs YJd)vi`~ѽKoo/󒏺F9likW(8~ŧMSԂ$`6lWX]-]/|gY6WDkrb,ɀ l $0$d c}Í7^7of\Te҅{qҝw_]22NP,#0 Hv6:\lnm;~|֮jefkmGH!I6$ d촱c!ےl6B*HRJ!igN qjjja5g3`B\fq$ l,0$6`@g $sgaKs$d̳X~6"ͳIl0 `$l.3 !@y6,6Y$@y& `@<!Ƙ%l` d !l$acx !EF$$@6<$q?`s?  Wg1`/ ^0Im/ eA<l$@%XB$$E`ٶ͆L Z&im3)dd۶4s$6I`"B6¶1FRH Zk^ /]:<8Wk!$2B A9c.3 ˄%Hb˶`Thc̋_ WyǾK>kN"KHt8^8;݆RKزCH!$ @O\!Ʋ!ˌl ;J L69-.?Cg{ "O'6`O<70Iv~v̵pb13%I2$c,dƀm$&DaeH$, Lqrdg3c$.3bY` , 0`Bwy&A4nl 2 2W66$]W~cssk{kرb>jGDklm4X 6A"\aM\&D !$BB )6`[X $PD$ p9֦{RX s A@<7 H$g3bsB eHY$l , s<!E<@<_<!ea\f B232qe@ل0 $l@Ș! `W+lsAKHy2+\ag$1 ^  ^0c!!g12$ @2qLOy I +l$0@1$q? @g a!.A6$ !<$0lRl `gyI\fI@6 '!  1" F⹘+yNB` $ 0` \a$6$ a<` B`+3 !6A\!  `$q?<$ 1`d @$1deB+l.3`H\&l$qm 0<$cH`$yB<0 Bl\f`+6IˌHyxn cH,  `$̳ x&sg2 e@\a 6IcI9I2a$.YeW\&l @0 e ^UQb'ۀmc666! 6 !mij\amiے! c!I\& `GEtaƃK.]th=,m$ , 2@BF@  @`X#Q iԕ?̋|W}zlLG8Nd.s45FT !!$qij ,2Ƥj/9ϸs7~m#RKE©̰AyF\feݢ\k,64)2dF20 gLH L @ -QJqg1 lsa ,IYlfxaLy&"#i"s~}}Ap9f$Y \aIcY6؀060`ac29iŬkWK-UPJ;v9?;:<;E2d!@XB c.3aga d[,EDbQdٌۙm,ӀA$ H2$0`mL6 ؖ$)"!I*ıc~=; `L20+$q?c @z_^|]|Ÿ}&j,%e.@\f# @ l2$@l"JWbcgv]dgl- RPDؖ$I`$\fl6eF X)B BƘt;u]>El@\f$!leyeyn gW<'!.,  09I6q"ag2$.C@dc @q1yIls?d2eB\f."aW2Hllel09s ijHͳx&<_s$.s`lx6!x^cY$@ x y!c@+Ƙg3y&m@m\d# 0<Bl\&@<7c.l #0W |IeFH@2A`$ L\fM$a! X`6I2` .d0`gss0˜0g12!2c H e0Iͳ @e'Lx em$0L`sA\!l$2I \! ̳   d6O1$ " l` cB\!ـBe% +l21fij!0`$qm l'!c 6W0aijI<1 `|H~6,˲~6 @\al6B, c .F 2X2oqI IQK cImۀm(ac@ I66m6 F)"!1mƣpp\r ml~60a0Bl #(A9PoK/ z}c~ּ^/ #wίaFSBNcK20B!!@6 @\&I+|Qrl/[?q?@-%%#ٲ). .1A  ;q+uמ|)B`$H ےlR؉ȴ$ۀ I40 )%7׆ F@Y ! g  L H1,x&d.!AHlx/3{we^t̫j9LS[$F 6`g2 c[Ȉg" 0!Jtn6ͺbIw:͢a{=O/(6v$)Q$F 0LB$$@@("! v?;{l#03˄,2M2Tli v`2L YB$q?+,iO`I*}7olml1Y!ɶӶml#I+lg\a$I2@$I,$ekΜK*8 X6  2@By60&a qg1IyI6`$2$ O`B29I22$lE+ !l/0dIl3<\!Mq?BAff2+8]{~ޏ8HӒllƒlK!dl[#6 6™lKl #lNs? Ŀ6@@(xNƘg3H,<Y <smijH<I6¶x&sKaB}c׾W*"l۶0ƀ 0\acIdI%Hq#EuJ4NiרEWKY =wK O}Oj*Z#`MA@%$ B`B(Jjl>}]ߕZkWJDڙ v:33!I\f,0$B$@ @~̳ L@`#l@3$E  @BƘ%Y$2@Y  8 < 06b '6J/0ɘa,`$0b[ͳH<'l.3ϗ0<1C!@` !2 ˄y&񼌅0` y.6Ex ,X l% 0q 2  Y ,d ҕZ "͸|`۞|_~p@NRfd4 `0 l$Bc@ H؉m @ ծ]]7kfl>g]ծծ9Ac!$e˓O͟]ݮRF-<0`H6`0blB<$FxlF<$.3l$. opM:jutv3e 0HH%c~Y`@` [`Y( as=XI*%f]?ECjo{vf" l@63F ay&Kx lH3g9}ZԦz&%ٖl HrZi 6`b{l !d  XlN)8 HXl ,0 6ϗ$<1Fs2`#Id\fA`@B`ӬRZޞ=g+/Ntl\MiPa#-6m!'l#,c.e$ @2L$i^{)Tu:N1S.=n6!pHa;B)Y ` d0B`2g L6B 8M@66 I+̳ 0`6/B`,g$`/L2@<0d0/y6,y` dxHL̳ ,M`'0 JlB ~q?!x. ` ̳ 0 ijH`g3̳ Y @\ae%|IO1/ l`@<sd!ċJc@<慑x qy#`!d<7I\asA\f l$. @b#0 <I X$a\!l$ijȘ !b,$.6e3c'mHHۼ@l,H  @2Igg2` . ` 6q1Y$@Hϟ "3\!q$^8`g l60`s?1 $/LϏB`HϟxI~̶$I[zQ/v틽7]Ա͊de[/{W."@SLC.vKC4Et!N)HBc.` s ` $Al;>epǟڹ0B]3[y #6g3WH<Adל8y60L `YlsmI%ll;- c,a-0$mR8L^xZb"m;%s? RCRB4v38i-IR@ $NLL2dg2L+ `dx.B 6HY`4 IkM?qݝ/*^N=%6Niy8, 10II 0`x&KaCHX`2< R5 m=6XKRKt]5ˣ/tMl潋{o[wwSnȉ(RC~2W<!  @20%ٖ Agn?5*QsOm)1K^]Z./yʈJUH2M@a l0Ll0d1n6u+?v=OۃvR楖lA dE,B<8qSԦam+B-X gJB$c!ls-0"3A61Pe\]ދ/8P@: I$&۔9BByRm lԦ4N4M E J4Xe@`@ 0<,Ŀ#9+ @0` ՅauO]_}cR{!/}Vi-E"l1" ,,H` `K ,.KMCR("j(֢6^;HȾ[=s 7}{88{?{PDDؖLZ 0cH6$@-0@g2~ij  ⁄c@P$@\&@ x62KLAmm@B iI`!#a2`#K21OҦvw9RaladLӀ:-K˿]wݵOQSkzl8NVs{efk-3[ͷ'KUaX^ܽ{}g{[o?:kӀIؖecx& | @\as0a 0F`$H08M6 El7~ɇ/ڧ_Uu6 G냃F!$Db@d@`$  H2H:@@PEHTB .36 l I aKB"BQ 2`y q,y 63 0`1~2b'b xn $lB\fyxn`  g Hy 1\ո?U*R)V!@B`$0[ l2- X lm-*Y7wvGw/t#INiccdF`l€%!l۩(;'N8~ZJ˜ -  d66sؖ$)31d!E.^xwC( H\!!Im2GK˽=A7/tWj}pMiZ)"`t\&QJxWnli=uKl 0Ha@``@`! @l6`` 061F 1eGDH*%"TkPSQHi7zZ85öi<v/.v:<-~NNgL;}[^̙'O͏_lmlm,6糪"a,aOӘmcϯA1Y ܔ4 \PN 6N3 #000 Al6e.e eeF6 @Z)6ZtpOݻAvL%  ,F`ddAnl;uV]˶H0W؎ mI1FLEm0%- smI Ž۟~yMoooV}\{=Ni3_,ņMvwԧ4Wq#a88\ lnm˾ԋq۝Oxܓy{6 [e@ևzhe0`KB "  cـ l  6&c !B264M6 ,I躮Jו/Q$!&PBeg(]JD8[#q7~0  $@`F`I0&a@g" \a̋Dq؉;ۡ HrZ!I!ٖH0ےmۖddHm[mImK ]Ouw%, ݦ57>?8<ؽtqfN۳<9/a'[NeN L6Ka[1$1!!F!d@@ 4 1p;n}zN04.O]]=̩ӗ={_&)Ĵf]Ujw߽ٟͽw6JEQQgac-"6 HIp[_x? N_M7r񺹱^ˣ498< kqt74`I<' y.2 Hp00C`@6-Im'0χe32@B<c@ @" ^D1`#^ yx!<_Yl0H 2¼  x6#ɘI9<l<¶1&0FH `#a,y Bgy>L`ym$a?a0ϏH\! <_6$ "^$̳gċ ^x6؀>C>;wnQ5OӱcǺnw_女vti; VB@X6`lTLd A$m(: Oۿ?u ~#nFrtx4R,j-_íO|ۨRF`!s$`B<'\fI00H\al.`Iay6q 0 l$ i,Y5DM/r/B9'>{W<~УvNa\8dDLK vZ @"a `l~ƀ`.2`  m1 6Ƥm(.`2[k6c!@ ؀`x&`! @<؀$Y\fͳɀ$sl<_ A\fy& "gI\! ,Be< x By&xax& dF1qA\!mH@9>ꖇ>dG-f+?HUa2 F\&c@~Wݵ>b4Ie0@ d6 s-0 ؉ǎ>8Ʋ@lKJqiII%I-@@a[ȶ$ے `[!ےllK`aLZWOSJQ 6V<++]wmψZj9swsg~ԏ8DF-6I"&BJl1li6M4N4f[lKU*Qd䨝yc^yCJQZ2LӅN Q)\"VV>??dwUWKy|g}W7ݢ[wN,YR6Mxrbo8}͵g=scǎRa2[66lZa}txtxppg?5I8mcDG=qO~ɗ}[z4aW~W8u_џq(6 IO`^0`.3H @hsԬciiJ %K$ !'@@$s d@dsA, !IBRHH$ !@؀{9ypnŋz;;ۿ[?* 4!a ~2A<26$Iؖm ,e2K$s0q` a0avږH%E]Îi/?n^N<[=8Q4CdFB`m6 l$! ,,l#@ 0d l, DBX,--lK83m2"00``0\a#6  3 ^ Y$!0FxNx&sɘ+ ij` a|$$6`A0@<7~B< eW @\&@o7O-DZbNQf c`g2da lL|cssf23(@ۀ$l C$e$.mmI` aR #b䧵aKXM 7=;[^%_;nam}~w|ӷa7Ldk#֦aYŃxyk&8M3&HӶ vf2`%f<~Óv;nO}i[v lJr;~=%Ԧa"K;Ƕ^~wSQ+l zn]wssljmX42 ٜia! `q$I +d @LƘgllFgTPQ0` 26HA\&dvwݱ|_= g! "qsـH@,a+$0 !0`d s-0b$@`;:onmnmoonoZ$c m ls?Iơ-N[m`'H lKK II Kʴ^=/m}Ziy5v@IcHy$! 1 I-P%I$HIӒԧƯr:<<ݿ$)cL5BT;qXp\-0 Z "BD-֦RJz 7\w={>lI6 @0@Dv~7^_ꑏ~S\}^^O6g#!.`B\f\&0ij0g2 dg2 A@`Ec0a`$6$tRtvǜYn:uz}t [4e< 964XHA  H\&62 F\&ȶH`!# FO! 1Wx FY,ex6y LLA\a2$6ƀ1 0<::wŋ/?wizΖ)c'ϦI% """JURu}mlm+]ϸiO~Z#,2Ddܽ+\r(+U_'@3x lIeqdy H2 A%ll0Hqd c 6 01L 0]J…%X}s!sM8qjs覑6 ar:q:P!mA `@g13 $`0f'm1~F30Bd@\f@ A\!ٶ H 6 c$ـ@~Bs,.x&y! Wg\aIF 6b#g2Y$ q?sx&L",0 cs30W $y6\aϟl@sel<Fl@1Isls$ l@lKl 0`yndI~l `s? `BH\a3 lAg2l\!@22+lـ$e6@\ad?l$20xl$` 0dA<Bg@+, y> a/y6\ X@`./<` l@9I`MyH\aAEe6>ꇉ>TM1!M^˾;ǻ9qJ ƞu} ;ŋGM!AW)5Ӷƀ$@$I` vkckHԹ]WmKĭO} @€$a쮧=7.]zxխa]\^e^O~Ta`y @Ș ,l xNBy qyy&c! ~` ٖ<@ liUu5$0J~KzrM_kycTH&O+Oǵ֚0I13+ !@(%H`6W`*2Hqeij 2cx6<0sϟ ^0IOOlcy&0`B@/ !c$6$ @7gUf8q lbwNNn/R/}>}!dc٬뻍KOO=4M]:ggk4m`c12m%F`rϺ=A `$`*s/꫽?yb Y//5=IAA @`y6$F<LX`.3X $@006H3I<'6Fx\f沰 لMڒdaťJL==v$<]{7 $As3 0!sy6g"g1A ^0`sL\&2q-@B #lȀL` y.2`.x  q?a, A\aY 006@C`<` `$0`< 1 X\!H\a\!a0m3 #ˌ10/ ! d@wv7 M'vJ!)i,ܰ \R6g2 `?ll~¶qT|XlllRv8Ia-ض[` )I`[@H1$@N)d!eXm$$A)AD-pwBE !D>c>]8 mR6]WfEfK@hVǮ?#n{gTjɖ!ƹu\ƯMzsk1j%l ;mB<%ےtFllcgdvb@z]w=vE1`c  e?vxQ֦koүOlH` EX Ͳ8V޸պzknRDq@@ F66 ز ؀̀`HAij L`.2`,6"as?Iy. H2by!01H\&a,s?x&HH@$cXF`'y>`3dL1Kxl@`#@m@m'湙 X``6L9`` YWb>~ǻO;2MG~c?c>sϕ:Pk|/ۿÃyZ) c ic6 6cl[mI؀-N!m L)W5ל0€ &J%_u^l|ۿ d`0$@@HAql'M&$fmI 1K[mm'0ؖ  m \fHJ 5Iұ}F\!0HuZ~u}]P.__{x=*!#c A+,02 #!0X0 s 00syn2# x6`H\a/LOk`-6KχI y60AY x2Fy π#@6fad! l !0W!q€@  0$d.@ !E\f  0mm@3@s l$.@dl+l$<`6`[$FxA6BܘRqclK2_fJ -d@l$aےp3ٖ`$ۀl$c$l<ےlےV` a %a%l6Vù{m l 7??sWǶ?쾻6_lflghkn~s-QBrPf]GO}ZNrZ06E: llƘ$,$LGȶm`}2q$3?8wb7^^/#zm\fB\&0 0gHg6I@` #dy6qA\&l$lqy&q1F g,$ɀ x&q  l,H`LNgW d a )l Vi! ۀM&`l09 ! Hm~Ly.6W<@HO s?@3 ɀLˌ !$ y6@y @\&6 Aلx `Bmg21`$<@<20d! 3<ij\&s20d#q9F`.@!L`KF\&c $@ 6 @Y  `-`$3  2ۀle6 qmB`xl6WH`$j~~X#AA@`E G c$dgij @ \!0fs09H B*¶@d$@6d ` #@`d@@`IK`g1deByN ɀxI@\a$ll -bB\al̳LE ,g2d# IضLϟA  [0$0xnB0` sy&Ig3 mc1  I3 l6c@<0g3  !@c@flژg}ߕRvtzʴlH+F6`gض%% ds aA\f#l%H`ۀ$d  ӒllK HB @`ؖd[tԸx{7daEizoVگqpҔyn>wdegn~k;wvu |IO~oo̺8 @tb2-H' lO|ɗy郃e_ş# L[B< c! Yl`! $ ga#I-@ 0Ȉ$.3!acB<@`2XB@Yl@\!d `# $c,@A`-;]*,ag6 lZ#eB 6$l,9y6I6A1`ͳHH<#@<c 0<01x.6KKT2Tf[-""[S[/O|oi$YBc0b,lB6` I61 A<ѥK lx&y 8{?wn؀WYֳY7lmOxsc&mIBD1 66Hmc$ٖdF 6X6 j(F~–2߼2ٰ~{Pg'We0g$l@2s y& $0a0W % `L dBO `E$`@`0@\& A046؈0 BN`g@F mINc.3@lA`&?!d WH؀+$ <Wg2YI0$2L@B` `dI< !0f1 Ee ټP 6ey m'Bd0H 2B1@ll9 AB\fy& gB<s1$`K`y&q?sF e2ͳ1 m#l3`-< H20̳+ x, ILLFe IyI<gAl BHm 1"!`g1H6*WHvZki3lmےl@x&6X !6 HؖdF$ۀ$ ۡL`,0rr0m$0~A lۀ$@ȆaKH< $lKm(\<Tle=٦)-Q^_~B`$g $aχFX B湉!02@&E"a<c,I l6sHv 0l.33lE@ `H1@X(ey LF B<$0%xI9g2$' `4 @ `  @`$HxN `B\fdq1W! `lg0ؼ̳<3$IlssWm /s g !6q?Y XͳI l`x  @B\&02 /F1 $ `# @g1ˌ!eل@2q?s%'I2~I\!!IBy&sy6ضbl% ♄@<f\!$@ 0&b@XY @ y \f%H L2gbll"d6b0W 9ٶ& M<x&Iلy ^0s\!^$L-$ϗ",e~ 1650@ )Aƛo돝:Uaj^0N2 220Ac@- l##6;%IKI!$ GH I `l; B N6d6`v&$m;3Ӊ6a@m[ R$6 a'6 q@֋v=*Q$wxVCs_?ߍZ C$!/=CSf?! m[q:mؙi'c ض$ m+$eLYm ۶mےllK2B ) @F(@ xnBB$$p}b. "(//$ɒxn``0@<`.M\!@ 6B`$ĿĶm aHHY0@0` ! `dccƶ12KGY@<01 #$,02s @mccx6晌@B2!@<10l۶m,@Na#.3>wn" l l$@, 6@lAaHlx<IO\a 6bIc!2Wl g1xL<dLd0` $qmL10 ,0M0&g0 l# y&A`sc}k?KMvm,ͭz=MS6 [LY̔Hδ lK@ؖd@e6K6!$ 0 @\adzytxgR~1R$MԦi\$c c`,B  `K{]wq獷ŏ}g,I @($I"}i}1ubK>nZn}u0$'.ƀ[ a[`F-0a  A @X-۰ K۾[ԕ?!$`DŽa6 ,6rZmF6\a[@`?x¸:4Hr&lH`$l!#4MiOyʃXfa|ē$lK60 s  3 , 0 YHa~M?斗/^u,Le6@aIRHEjzw_t]WJU`mV8mlDp 16`!cy&cI1Ab~©Nl_sQbGdNil47^wH![$.\f)OxuߌWu들nHL 0l@`FBHHHB^n~vd at]> mhm2&mC_kM]E4aB- 0@AcdE`!6`$  0 y6y>q6HF .E` x@tۖ٬il q3d 0\a#dsB @2`H 0  `$0Em<, yFWd Ƙ+ijH~%lB\!B $$< q`lB<,c qd`$a<#q?62 +$ 0dH  `6 s1 !eY  !B`cL`L +lLy&@ x&LY d b! 9,2\aL ` IIc̳\! 3I "qm@`#021@`0x6 D`x6 lE$$ۼP/y.@<7!c0Ƽ 9 L<7b{D[$ 2 $I l62F` $PF\. ]e^N>}}f7~3 @IVu&l#iccc>_E$FPNO4Lrlggoo\* `#E`#a[0 @\!0,@+ a8tI=8b>3w/^x^FZ"1C /yxfg;ila@-b6~Fy9{iY\&b̶MӰ$HA1CH+FlK6K -ɶm̶Z@`.N?1k]k??-(26$VĖ|1kZwnoXg ff. Hے_kw} BB`h9հ\cN\{fh6d6 1y&Kλ^:@'_@ xN lx& @`  Ƙ0ۃ^r^QK|{ۿbat؀_} :6nk}Ϳy$2`l@ 6#0`I\& dI< `ij4`Q* g1 ضm8 3AI0,gWsL<ijDI`Y?ޜ|>@$gن.w=O>}tb1oF- -ضD$l$lIIBΌZjyu=O{S} #a#R hĉ3לZl-/K62˄ 0$8=`lsktA˥q)IO5sT.BYuBVEloo/,!E'Ȗ'NA'?K/f $IB$1+~`+ a"E"böm6̳g".30b0Ϗ,,3 9b6$!yy!E L<@`A Ial $¶y T l$g2Y`<6dq?HeI cI y.$`3  !ay.$6X@`.3/ $Il0y3 9Y0` !6W\!q?2 yal^ $^I\fs?0 0A<$! e K@qm0# X09g$#yHs3ƒKBy& WHH\f.g2g3,Y$e~F$a@\&!,6 ls?xs<c,!a,B# x& !d `ƒ0ϟͿD/$ 0`$ X9I<`^T 0\& 6`90yl@~!0/<s?q0`.!@`ijؖx>`caE`@`03` #@HH6`$ase~s? $dA$<0 $#ƀ $I`al  N !lR!@md@# 6(/‰A6AB1,Hmlɒ d#2NlFL0`0 Bl1X0 3ـ%Fl)"0(^e_:3[0'`Bf;λJ{B0`  @쟿0iҠ1B`ۀ,XEruxzgwI٤$[`@0S@R@ΦRF$ Bv)BHg)C,AX`xA ~6x& 3 I\&BN[D(Q#j#$ ,rJb d 2YAB`[\&^0!ag0$$ `06 0N@d3 m!qA y#0l @` @`@< 2$ƀxlKd+$l< a @@\!c^@2c@ 0Ϗgx2c _ 0 s @@`@<$6/"cqxn6eA `,$湘gXHOͳ<7g< b. < Yl@6/0 0@ٌA I m$< g2  A6♌ !` ـ E<yg`gI\fg mL!ɀ 6`x&Ax0؀A\a~c `  "qAA\&l6WH\&g2 e6 I6#dq@d,L2sXX@e~s01`L y&slI03Ay l#6@ x&c0 03;%lmX62`  dے%Fdll,,c@)lR`#dq!  -AƶAl 6d@2L$NA`ے[lKNgD.8Ԥ&Hu^3պ{=all}f{wFTH0N$ȒAA`PҭޣgN ccdN  cl@ՙ( aF $lB@XXl;`a$db3`c% $ـ $`d#dHBHB `J&ii%`   f)iL@By&c@#0mq$ A`d0d0`$⁌̳#TL@lB;1mA<!1&'0dX$0X2q `\&`sy X0 6 0meHmMm0L0e6@6 l.3 l`#A2$B\aI!xs?c ls Bs2K@O< mg@Ș+$+ E0 ~ $ly <'IƘg1Y\&!!+ b@yn ?x&  2ϟ!2c̳lKy~sϗ !cI62$l ۀ3f!\!$ 0I<'  .%B lKXl\fs?H<,yNl0$ɶB`!cل\!|@sy c<`6FH0$W<I\f\$lH1`` qgL2B $l@BHX6" B2 y.16bcI Bc#g 09BX`@<g2 `BA m.+ g2 B\!. ,3E2\a @y.6dly B g2`+0`$2g3`%0 @~l ؀@T$A<7!A< l @1 Ŀ Ly0@Ș%!c lc{EY L y؀+x3Gjo 0Țڴq,^-N;V8J)#\Z|,! w29jiBij ! 0 IlŀA\!H ~!0ACH0F%0H $l0@ @ .32F y&L#ly&Y cl x6L22s<'yH\&0gBY<7x62ƒ `0̳|Iͳ `H<1d sL⹉2Y #dl̳`$H lͳHy l# 0A xnXKgA<1d +$E< d  Ax@\!aˆ#s/21Wx♄FȄ `3 e.3$aYl$ \aH\as$00W66@,`3Iπ!d `! 9I0gyN12@cHm`elsA\!  x>d, +s+l<qmy!beycIB@A6`IyF 0dlL6$ ,$2d`xAl@xN d@yˌ l lL@ssl6B 0 !.33I#0cHqx&cI`  `2@ H `@6+$,0ijɀ1!x&Bd$6$K-!6 $a' I$șHBlc$q?!ݷJalh~>^tiδ-Hދҩ[^|QQM9l?*@i c ce6ƀ$lcɶ  @m@$`;A$n\KB3!18K^\]&IHH(SkӺ1}#G?O=)Ou)QYZZr3Pu}ZÀm``[!6$6^(m !$Rdooگ|Î;)ҥݻqҟ{CQYf: yNF2I Y`6B٦ mٙf   laWq?6A`@ d`l d$0DDN=xW߉HV˿'ٿ9!%p Wxkrýv v"bcHsY ۀe6χB` y@<_ƀ%`6lVB`0 gl@`[mۉ 2sWπq ecx&A!03I`$I\a\$lH6K c, a0  @Ay6c-0`q g3dF yIx6" 2$`Fls?Ic0I6Y$0$0 +llq$@0g2L@ c x c.<B0d`I`6χ y,<K Hm. -s cY\!6WH a ` .e y&l  I2l l,@\F5yeؖx ` @d@Lij |gsBiImN c BN#1F`$ـ# @BmI6`0[nAdپ;A'6Nø^]@H c'Oś;;KVL-ۥ?___㶧n3lFHv<1m Id:: Y $Tq,]oN$3$B2cI`l$ 0y&H2< Mg @am0 2F,c!ad \& -< ⹈+$L  Fx. !+ @`@<00g30`q? qA , ,q $\a, L3@0/*leƀ3edۀ~6$0 @s?s?+`$"X2A& ,^5_co{IF}o6iL`sޯo5_MLK,0l@F83;`Ϝl 6A L62y<8ݶwoqQ͒dE|'ůǥN?יǾK!˒lWv1̀a.a0 $ \!0`#@`!AqhN@ ``#LB Px!\l&3#3,$!c  #@\f($)`,i7@A<0 y\&0f `3H<F@ <! Adgx a s$ FI`F9 `0A0 ,,1 #0 !3dgx~$@ L02K d @O gI+  l#3 `+H `01"0y&˄ 2sW! gdssW+恄y& `` 03H`d .3g`+ l B00+,cl.`@  @~ Ts  H@LٌYl#`B`Eh d l&qx< sx x&ldE <s1<$y." @`l%@c̳Hy6#3 B6x~ #@Ag\fͳd E< x&!gC?sZ?NQf~R%6hs17{7|?ߏڗ ̣q+$q$.F &,H+|W}w}gv67YuijGGG.Vw|K}~ð:(0l`y&q`#a.^l`pi$02 2 ,0 0d0 )*^u:3P$:q65f'n{iMGRcžcܘ:ϝShR``?1B~y`BO`,aL+lHg؈ˌA`x #Be I\aq? 0QsFB RE ))c02#M`y6sz:\C(z< 6 @#e2@\a@`1   y 0ض#L`@`@+cLA6`4`g-0ے m$4d`$ `0 nc?w;~ċq`\*Yjx-NL)׫ܛ*UN1Lc_Lc6ؖH[H lYcF lK`%4Jm wpE 0@@Mooxw| /b#a H2ԍNb\;wAzЯϿ{O~.2AjUR$c#I`[^0N$4.o5_իwqSj)@f 9b̩G{xtZ oO]_`@F0  l/??)6ƶel`x.60+ & A`#`,)i_cznh‘ݐ9ʋҬE4pĎTB=hm맿h#F0I`q-10WH0gs?\  0!d~ y5  ccI ^ yyw?m}Ssw-s@](9 yA`s?l0` $Y$.$ @`  ,@3$!  l`x\fa# `< A#lB+,0A2g3`9XB# 10`[bAL  s?ay !0$,,$ 02!1F\!.3$,ijH6Y` c ,66%@$ cs-b$|  ` HO<lH`E6ϗij++6K`0$aH<'c23,Ӧ$Cd6d[AhֵO-1Lp< $@`#-[ȶ=_7^|;~¥Q" )u#!BnBHbN;p~nx`#q @<gyN!c\fdAHų HN@`,@̳ aP`0$ $@ B$ 0W ` ! PLmǾʵ/ǯnK:;w_>s??sNJ,R$0mаZWn@*eF晄 $`#q? a$0+,0B`,c4WotK)` $)F´ul7~=y# +lyn +FȀa`# Yq?,NLxN 0 0ˌ 0CB6`̿H 9s0g2`sm0 $+$$g` @<ij L#IB $`0 MBO ld, ۶<_ @mlg2+y~s  gIO<$`yy&@ ``'@@f0ض-y&Am۶~ `L2`0EBl1l`B b2EL/N~~locc 6 ͤču΢ۿg;Av  m @ M<@g2&'@<_` 2 !%d\!gl Y ˜+@B$6 IRH!0 J!rvbz}|^eÃnLr`a^^.ݽu?m<4md x6x m۶FB0M 1 Hyضm0Mgqe [+`@Xx>el`2bd 0`lo!ij@ W$!66d< @ 0+l @\! /@xAsB lL#W,$<7@9`E2@`6`geċJ L|\f6KBl!I`Wlll.30O`۶ $ aal0E2ƶ1l0l$qem@ ۀ$IBBH $cc!I$ B@<$IBBdIHHHF2`0aIB @H$ y<`006jr<[Mm066m۶ma[ "$et7^{mgwyǧ|'zTBMJd qeFD&i\3k-V `0llcl$#Kde\f  d :O_g/_Xln:MZnriZsB[;}_,O``s !a06 a6 I$Il۶mll0lI@ijiY `l 6&.'3+0l0 g2g2d ` CV og.ƀZ 2<)[dS6Ml&RuuknG›j>)ij`1 '$$IBB$I$66eBBsƶ1@ l۶m$I sf!!!`~Iw(sؙ2 ``0Y0 L l x6l9#  6X<`00`q@0 ,``0'Nɒiv*?^_=6m& B!EDHd2=Nu<.}—=etN"ZD*1`0&`b0/ !,@\!IW0g10`l,<ij e3 dm `@ q$@<'! 3€g`lllB eB I~6blyyx0ϏWOySt0LQE26 3@ 0ec@d}ų:U2,QDQYK12^4lgbCQyG? .[[+;mt"c Iv@Ԝ 2JDpMyzON 0- αS'{\=G~ć|G}TR3 L i Dl1ǀHFc#q,$~l$lF`A`@ ɒ K7%M6Y7~gQ[87 Eс!3AK]5؜w?19miTD}Ǐz~s@`[`0 HHly.l< <1A0`!̿Hdc`@d0 l€  g0  `f<$|\!6`y&$0s6xNcIR8jGW|fn؀ijXWTXy a#I`PHL9[ٛ>ƭO+:l6sfgfQȶ}仼;l6C66m6` `lK M[;[g/\hD{/up&i \&e¦KVHE9 `G y@`XBx&i4TZn}eR:1tF6 Ll#`@ # A\aA2l$F$.3; ̳ˌ0gY!   `0Xrhz~d jm^Ox}p]clxwUzh\EDK;l躺wtrǍ5 ) `,2`Fsl^xd+ij s\!<0I cqd$\&<_~♌L< @gdg`/ "qLgWx1B<!0Wm 03g10A`q6 g x Y <a6Ϗ\a,A6ij x&` ! a$0JH0A<ijH< y,ll۶-, 0 $IB$IijH\&6lI +ly,$II< "!l'$IƖ mll$ @B3 s0$$KHH+  Yg۶m۶,Ia۶m`0`l̳Hdg~BB$ !ed@BBBBBB$I<'` !$$$K HHHHHH  $I@  , ضm%I2g1AHyIHHlK$I$$I$IB♄`.m `L5s}}SKGͤɭ';ٽu`*A UsO\?fǶ[b`U]Za#$Yq 666@ 'IBdll۶v" l$H`1Fض-aFR:m16`m2ۀmۀ$PAm8mlc۶tm;mm vb0`nsj-ٜnviccmg !6a`[[`m  y&Nv:INmcm#2v PFLgh t4Z"$EBx&68M6mlK$ HgfaX񛿉J8N#llcm;3sE:Cv[ګč$IPBRH$`۶m`;m;Ӷv˔8v|Ӝ{{{:QYH`dH([QD8-E?\fcYB@F$ aـB<-,$$ƶ1Y̳mۉ99'eS*FVX!Pp)$!q`s  @l0l0Fcccc !!܄$![62` 3 g0  6Adl<@~0!m 16N !H$F$@<@66&$$  m I\f3l0Hـm# `LIij0`  %a d#`\fB12I6@0B19lsؖ`3H3&$2`0dL0#@ 1$0`1ͳg2`$0`I[lR3$00 @i HD\f$  x&LAAl# d[BS  ,m $ lc$d ~B 3 l06sl@`.eL6 $a ͳ @@\f$F0L@;u:&~w7N@Lf /›|5GG,9Ҭ4Of$q a\aH60lyc'y^6 ++$'.%@g/$.$AddsAH<1$@6L+$lMmvyi+n?~S1a!فCY2Bvʔ[ۊXd `@V/o.E%~~bjYJ```l/󒥛c"dɶ6H6`0HBFHe_eABؙ `#*~gӞdIQ;g>qc?#//E_ůگyxt!lNk0رcx ™6x$0 g206g2!B@\aX`K @ I 0`!0`lE06WA 0لB` \aeyH0Y2s?A!@mmAB @y6q$@ 0 @B}[2ҤKx0@D*'=TC6`a鹪sض9+@Bg3f6"$ 0H~wlOSvkӍ4o!l#!3 lK "KԋgfڶAv%ӟ)_5 m%J_[[|wۿ-i6)뎖+Rfx#*`x6OFDѕ`L %Hd  +$, msAHlL`܌dlp,c#L–0@<@0`e 0W00a.3 `g1Is @ Mڶ@g002$!``la[`mH 13I X'F@cT.>̐l25Q]Wa1 ceXX12lL ,bKlF,6$ `x&`E3@ s0g 0WgċH~Bl bWHs2IK<_ 2H1 6!1& ƈ `06mh6P(eRBȒm@#̳dX`\!I♄,X\&$B62gC`< aI\f[`!d[ 0`)leRB`%2ےm!~B [$$$0 $$aHB l ,l `$i+` [@f H-  $$"J;#$!QJDD:rr$ v;qxkͶA){vnGGckCk-g ۿ?[S$FB0887^.WｵoFiJ?Y 7( s3 ""$TtE6 `@ Fl1d@,A 0AL--Y<L`&$`@\a#6`2y&,2`# ,l$.0,@cCHXB<H€m!$l$! s1Xlda1` *S3 7;`, Ekdc28 \NKLqq<@1`c#BF$gij  22 I<a,`gs@\!M<HdynA6d[<[4-I(m7ވB3m# HP !I!I1[,M* lZٟm>}z}7z7z7?::X[uW}u:`vE ^,Vp +2'666$I$I Xt]$I aF8}Ƿ}7ntf6C8eN?]-Nc#Z"BRH!) @B a0d%$$$eq@d$60#Wۘ02# `ɉ I9 ll0g g`2,۶`@Na$=IO=w|)Ue!06Nmvb9Ip@D@! # oOm~Y"6Cs"'~ZfD 2 JI! R#RH2`l0m@L+{˫,(ja``@<slcـccc ` &qml0 ƀm `l0 6l;I@6FI¶ dIB"$IH!ccI\&ɶmI\&$I a" M:LbXDHH)@ I\& c- <%Hmg@HB,H$#H FGGGGtffvU(P@$I$I"i~X*"3P߬|ccpu9 F5gdogVA%)TK@HLglδm(DD J!DXP|W,оPSB :;c>_!$%Dֈ( *(P @<` l3 @~<cBB<`.d[FLʦh6bg3$̳X\&ij@`ccl06FF I`0mgcm$`mlcۼƐ6a,0\f$G8 Py^{A"C9:X[zOXz9,8}sv[|u%^$2*![[^tX(  ^$_ @B $q♄fc6 @ ly0b0#l2<6`x!llWHYlll ? $  $LBB<@ @`6`^I<B<@<KBx@B 6B[zo~\Rݍy<ү}la,I D /k~x>ECd ,3sm 0aNccF H`g0$Ls?a <$\@WI% mcc%e) -d[ H-vf 40$ImH\f'iSn)()$ 6`#,dar0`%$ A`$I6$I ;%A֫C (%0$`!0 )ӒI۶fLg6EY\|w~|c?3{] ,;^^hRpi iN$@`[X($B{@HBiOO~cRQ` )"T:z[|pRK:%-6 `` ld[ˉ L Zn=?xṑf~oWיB zt.~wϿC@Jc e6/y sx&L 6@y&,0,B< B`!a$ l$l湈$-a 3b[<dy&lHsy& 2$lO\f[@ `3$`g$, \a\$@m'fI6 $' \ax$!0ϟ@ImL63 2Hm/ V2tщf;֗.|tif̖IFI$`6Ch9f<?W4030Y y& c#x6#@6W80X@`Al``lI3 FH$a,$ $IƶfdF<IH2I` @"m +9Z2d$ 0XF H q$l @- d!ɶ @D(dch23JA2.]AYJIK`y2`O*ҽ_e_ddKul[0}=/r/R-a(E!B5;HF%B(5J "BDD(R:sBAژqI+@**nF!Y"$7 IHP($ J8) 2F`m3g1WygIلĨ&30gIH HAI2$!aslB 02`l1 A¶10@ BBCKn|7Xi^ Llnwp{-{=(E!>vN-w9"!3lxѭꖳLl<XP6`0@`I@\&0l0 d leƘ$669 x6@6 .3̳˄ M<$0A\a B`mijH[SLZ(.Eض!-!9jAL6l#?$aKHְ%t6l cmƀl F!as 3<@<c0`aq-@Bl$%@+l1WF!d` Su - d[F¶I $#\i @@$l, p"#!ð"; Nl_8?Bx&!4eWkd&L@ '%JD={PH]5}}Qfs&0`831""Lx:Z.8bK^܍2 E c6`ҐmcB\! /\KH$`HxF%h 1a0 #$!146W+s02Aijg!dl BA IFA +SS# gFl!s 0$E r>yԩkllnt}po޻ݿۦ1'`\f0x 16X+  c `$Iq,$P$"B 0JD98}N)FhX([`쐙&q D(Aa!lϖO{2,5hS& [<+l !+ I@`@ `sm$Il 6 g q?cijH<̳X2d@ x!l~g", @2`AexٌA$~Bcy6Bmyn6s0 "a@s3/ y6c!˘2@6ـ [@ag 2d6062 l01ϗ2`#a$0H@ ̋o]jcLDaFe~xk_3DUK7Lv$@ hl?:9HX\f[ yn$@ BlI6$!lHO`9I\agdijg cYFYlc,   $0ijF~d+ $l0`̳H`,+$smWH`A+lLF\a2$qm<  qe0B b @\f$ ƘL~< qBy $@6`l$!1mdl0B\! ``,3 lsؖ<2@g3f!$ gyAdF< q̳BB1w~{ޖ! @ $ٶv HI% `ʢhm` H2B6HI%$`W `l[ ˄@`IRHdK4 ABVBiJ 6$$$ Z-N:mHtupXLB2ae$10LP( ^x 6Bz<8wHc2J @1l#PcHaFLc$A<`qųge2@2HR81r    @2 "P8yz8FBPKK?ww<"p F< y& C  c܌m 2-$d,F 9yx G82*Z߸qy_Rf B6m#dt'ooms? eχA x&vʃxW?[ן8 Ӹ^zlFR踴ڥ?w>1Wl0XgÇ}鋵ZMA4O4(|Iѯ鿷XH)eLˌ!m 6l#cxe+l+ ` $@ x^2H@$ ,I(y{K4583im  )$u\sͯʯl,;A`#@i0B#XF`,sAm"ɤ)` 2$a.3x$ @%$c$m$0 "2H¬׫Lo.eD'ȶ'4<֧˼$IDKc"Hd,X @J)O25/W˳Qӎ2%SsU!y}Z =M|olll!#pHK؉xLؖm)]w~wQct3g3gH@H,y ` ` Ϗ\a,e&iJg )-f$Iv B`ijI< <I=y}ٱ$6vi 0^p {?i땢AB`1K69#a   $s$l M&b$cb'&pxtI]cJgX|ˇ=؍G|zaVq=DvQDl^ir}/wrwE&s@#' <3ijϟ  ,s?Iy&<ۀs? .3Ks3I6 ̳gWe 1c3A s sAl$$@`l [cx 6! + @c l +Y0x&qe Ae0F1 3 < `#`ybI϶$A6A' )Ooe^_u͏玒8¹λ'?]*0b~g=>QxoR{q@$$K؀ij ضmc@ؒ 3 gJIB1`!! 0   #0HB$`$$q^_/.^D̴ 6d$$B(K{//=g~v{kdp,ɶm!c-6$ٖK{6kf lA6m@m1#%2c$B, 1iIdEFl-3ӭen,6) 0G'o6o/ DH/t3gx&@@O<13<˜"y6 0$.g2- I~!;1ȡJ;zo=SyخGށyt2#!I2uK\2@Rl>zO{ȏ|ٝ@-` # `2``H|E $x6 #l2l#c0$<7`L2#I\a,! B:Z-_^/w/D+$B$cR("JHRzKK\pvZ6!c@aLI\aK2I!$B \:gSpCa@X`KH #exN)0N)Ɩ1  I#Kƀ%L ƙvohf[y7DMlk^Ư/sbťP.<ڭLk\-{Gk;Oz~G~'K<J6o妧? Pa0 $X&~_@EƘg"0+ 0 `# 0H`sc3&0BITӏ>jq*p2TXҹ9m|uן@yBQl~;6nNJwv.N4%Tę @ 1`$M@`x c!s?@ IB\a6y &0lI`~6€x&s? a#g3`gyƀ @\ag2/+$01Ϗd$MdLƘ6ϗ12Ll YlKlKY Ƙg3@$33 A`y6/$\fd $e 03I؀0A0x.lW $l 0gm `d!ض I\a<̀WHj $ٶprm6D(Qo~g=ԫ5ɂhj{7ȗMwё-IX`X`@X`$ۀm lF\fULy6H` m`0ˌFx 06ju˃nyW~K{ "58]"6 Edfk6@*/\xz>.}ײB6 vJe$, d[$;C2VEhHjQs$ `@Bؖd mK;-$ mtpph2nS֮-@l  ۞qr\lN 〩M'NzW~? Mm69M[owMGmblI$ OY42O?6`7[HRk2AEu8 0`H<<@` ,H\&+lyNyNlI`+l$˜$@<16 <l`L $c!@sB6$0`F3<0"⹙" HlH2MO|mݺ<\c'|˃n~qc˦ @W+d`[m.#$l )d[!X@2`S9D H<$N0HIے$66ؖda[ @B%$ E@w+lxNFT@{Ξ={lI2;[ďiV(qc@sxz{VՇ~~w~_%|{]Foznt,}a@ eT%l)ߔԽ;gos~§g'<覛a|4DHٶ!0$mn{a[.Vke 0g2@@ ED(BgB`$.3@2 `e6` @ F⁌1+, 'gC GmX"ɶ$ s@<< {8uz  j}r6?y<_$@勿ѯg20~  @2 $.-` ضAY`EH$I6!""tKzٷ=3p H Hm[`$+B4a BdZ69+ٰm lsAmۀ$ۀ1l#IIضLm H~-JTF$lci-x&F (e҅?z#.BF|G@0DPblH&'$!s? l$mɘ@`@`29$ͳH`lBH6`KBlH `Y B y&sgW\3+lI<`# .3`$m02dl0$qm@<[`H|1xOlgkN2tN-Wc^:δm۶m m0B$cے$l0NaĶضmB6ضm#\&I$ a@ HH6b$ۀ@qm`s<bc$ TPjD-AW(~\JN1ēYKYpℴ9L7y7|7{_};7?o7J(+P5aHM,8{׻ß.לq_e|cV6gv&Zh1bSB(ʥrj33N`022g2QBI$sm'xAij ̳ͳI $_^+r*d 090`MRJ ζ9urq0`lY_??;w*UtQ:<=o.@Ȗ7r @@ g1 ! #`<@m`H\f0lI$IED(BdjlԛXU:CRUDm[OsQ4;qڤH&!`02Jq$m۶y I6ضm @B@6ijH 66 +6xc̳ 2Y g2C MeY @\aF y~xL@ `Yl@ M,626Y<ijH`^I<xN慲09B@϶m$6bfx. d^0@ sal\a0`0W< ~晌x^q?m@HH\&g"!LY$$$<6x!  mLLYl [2qB /mldl,e)v}[;SFsj>A׿v0jRM`Hƶmclc`E R ~$Ilccc`\aH asx&@`ל)]e̴36^WKUBRPD g]ߟƱHgڙN{|v38bƶ  @ I6R €@mie6 ض66ccm۶IBA!Iؒ333%HH0l$!IHB*"*@@$!{?(D )BklsXԚ G8!$ VO6x_˽{/Ũ 9h`m"qBEBCilH$Ȗ-qwsh_yWMXr-jҨ9?C?h_m\xa^[{ws #;a b| 0D0f@  0`acc0W+lg$!h7V@ 1`y@< d D),7ЉS'itf:333M.'C\ծv B?~ypwN8vN%@!3F@H\a$  H(BBPDDix${V2Se='Deg 6`9eBcm#'!1@<$ x 6Exlll0 m@ B+$$s1g3bs3d0`02I\f0 vft΁ib\x->_r;L& qbcciضmll0 2!0H 6 3 `0a 6 $ 2l'Nj-[2LO4>X )$EDDH=.;>e6e3mmʜ|qt&lKHHض qmIm\a\fvڶ &6FH 0lclmc m۶mclK66`s -F6z^֒@l>@a+LC;ngNZ-_^ [iji uX%Əyׇ7?a7pI:X`'d`SNe#l3mcla%@rYjjY.}{,+Y;cߎ+B ,RTJZy^VtCp=qqPHR@HHIm  YliD @ $L6W`۶m`۶1IB@ !g@ʱd `c0`@HHH@   e)3vttpxw@`@"@aPmIm}}N;[lw2'$$IB`cc0D)`0ba~$@ B$$)"BQ""Z[(1mkX wU5]M x1ll0$I`L~ I<$2 F`I@ I 2<I< Hll.m$I$I`cLF $"a.3$$K@616[d0W`0 sqd `0ac`10W+$I@< $B<0 m+$ -, @ `,#$g36ͳXB3 $!!!IW!@`cs\a#dɲ-$ij @ @$I$lؒ$$` ɒme e$$$$$2666KHH@aI$I$ 01@3 6 x̳$$^80@\al €x3g\ax& +$'g q3ˌ`@%W0Ƙg2`l!dxx !< @$W+ $ @>>693!!(x=7f u/cfiVGv~G~wFс0Οu^{u??~mOY *(@ \!2$cLQ$ /2#My lPBBB@ L yF !!)뺾l`3mgD9°:2addBR^p! ld02as`.AJy&! c$$sH ,H !IP"BRH@Mf䘵Ĵ%w-$I㢏2ih1t:x6Ԥ  N\! ! zr1d`IFm;l'$+lc.3;ؠl۶4?{##6HI]dlaӳi L$iHm6i;3pf1IBBcm c6ؖ$ٶmc`ddl ۶`c$INcVё$g}E@e*3™o'=i|jq6DKq/۾Oc G^%Nw< uav*ULU6.;毽mlƍƴvi۶Nڮ3m̮)ѩk%Dk{+_|_r<)[NUX*?_%\./\8^p;\ԎVvn:CRHBdd0 .3X<8m鐄B<' $ K+$0$sx&l0X@<@ 9\B BFI@BF% K s3I{&vډ 6!Iʸ2'm4g6 eYe6 jmmcc6`# 0@<H$$IR I 2ᑪV׿=+bn'g$ed gdll۶1 l,۶m[~  0 y$l$$$$Y2,$I `sm0Ex 06$I,!YBBK\!Ye1 XdH  2se!!IxqW  s$$$$I3 ,00"!1@B 1m۲e!$I$$ y<6b!E L2$g`0ؘgBBBB1d ɀm gm`c0 #  [666666`ٲ-,!,22bllll$$$seQy6LIyNX+3Iy~$Ϙ02<22 y62@0χAa#g2W@%L `<̳g@`̳g2ij ?s}FN62$<c P9 `!̿@`.Ș$<dc, d0# tMB[kp @ ~"H )A0  y&Qj< `\f l6Ӕ`cHy $!!2`]7~1@Y l$yyڅ*oӽkm/;{57ٓ~Zb"Ԇi|ȃ?"[f-cHɲA0&c!-d3im)y.#!ͳ I20dH\f0l^Cm`0HB1$.@\!0 OӰ^w#uvE2! !㮛R#>1/2~C>{ONj.Heu]?Kg}?֪v>^"6U㤭~GeX ^촘$$$)3 & P=Cp#3 cv0^[]޴_ح~W}WW?}T_5cg67x_?|EF,0gZ3Z1d,f@<`@$l3+,Nlc;؀@ <W̳`ٌWG˝c'&&$N@l &lIH$q䉨UABiI{gA\!,ɀv! ledplclKp~VNw2=L6vLasy)#%B@ ){ g/S3 EoӦs-L! l-٦b,{Uo?w~o_Q/gN_fWˢW)ơv5(l06`Ov}d6$ے6d1@\f lsW؀AF< ;L,Te̳+ `@57` qgg{q½ H`[t $$cٗ.\ @<7`@LCbs? )caf̴e,=;OݕF  @ 0K\!0`lyq y  qmB9+`+ld6"\!q?c!^8\$`L ˄x q$c1`dL0 xdy9A\& +l#0"@sH 0A$qy&L@#s2 l012<A a# +B1! q$6eHFH2[6H``I0 \&W< $0   l$ۀADlF ijX \a$ @<19}ё,c+eZ??2\a WOmI6W BBcccc)l6+$m2 0I`.LFHs!@$€d@0W=_*%nQ"B͉0X$6dyzs=?o}b:3˷~m[ܐ␣C-%T-XtrSG\Cy3xϗKvݠQ`EpX2ßpץ|7^%鈱 NT-?ղ~tz|y׎ݙIszg^̆i%Lp`Ɉ&H Bi~} %Wcq?s?!\ O ̳g2W FXƘ$lgf$AL$#1˥=!$ 3G?Qa`C"DJB=_\a[MeƃK{P B2 F1g$,K6;әK  Zg!* AXB 'e#/0`# a Lesy@Y 0x&Im0sx$cs0Iy`^($dBd,K`M !@ yIe\s2X2y fy&g`$a @\!,$1Ed@2@Y1W !0 q?I1Ϋ#<͕'ӖUNN4rTZ9|#Un}8 vydDTmY,8j6#ߧVtNDYJ8e#!d{\ #N~yttp.OƗ|T}7[={D@` q"@ @2!@1M-I@* l\fM2/el@` `i2`B!BلyBo־eLiSKęk}w߽0l>}cVP$H®\ۻλ3H`q!@2 0$dl c׫ @<`;m0 B" EPP B؀A<d3lWH\f,0Wg1$I\a 0qͳIl#0edla y+$^d.10$s0lA6`!csl yL62x<܌y~$^! y IB<Al? bo| K@`ITEQPS<䉝B l n<cr8Q ˌ<c0 ȶ c mm@d,P 7m߶zd ez^ l)BDH77gga.! (16$ۖ16H@ڀ@$@$I$I! X0H2`#qD%I2 l#a$ ~B l ! ) %B*L$}Ļ_qmS0I ("d D`01v em 0H– -IL6& H@: ^oϘ/n`$ H"d O$I֜*I:scXln+$ @6`l0g2c 0B$ I\! yl @gd !N37)q! 3Hdۉli'vpvjW&U<03F@Q3g #d B`!@BH٩ #g axH؀``$0€y,c 0Agg FI$Ey` `6~xNƀ 6@x@X 0 s l@ 0yg3xA~lM  `0Ks066Bm3y&cgeI<0ϟA`!\@`y@` I2@<0WHۘڻ2s&` @$ lA`666v!A@` H l" cls 6 qd$@03g2fA~dyg2ɀ B2 @2,\a<I`,6Wq? y6 O Xm$x AY3ɀ@x&, lO /Ac.3A@2 Wg3WH\&l 1I1 + `@\!. H0  cY\fxNF2Imy&ls-l.2`%I `<؀X\&  ؀AXBm@<7,6 $@ ƀ <0W؀x2 @6$^/0 6 . H;LK\a1ؼ`1`@ ċHHoO|-rcANEY.[Oޥl@6 $F$H6`c$aLg(l4<1Fm. 0$62H%@mK؄0ƒ0 $0 E)#gJmHN^o^2,,%3 $$B[ 0BȘB$Ӷ@600 `F %'6XVqTqr뽤 6J!a0n !1HHl/^6N($I! #0@"9 @y@$,$$HA\f.A @€;?Q75 4mޣyoS)33ә28GwuO #̳O0&KŤmc `!c aNg21H`l1ض F0A6`$0Y$s2xN 6K2AA0 @`x6[<c < "2 y ۼ6gd@Be\a#g20 Ʋx>Y@{Yi]7}\I&q\糷~۷K} 0 $a@3F̖i3m۶mLKBؖd;3؀$ 2`#6 da e vڒlHXcB .Dm;WGK(E٨٦+/ &=,g@B(,a$#%, $S:,.m'6l8iI6-6F& ! 8SS#-eZðfF7+!8tC46cΗzq&0- e30%e l< 0⹉Y _oŷ/,c975=s~O wwwDNI\`$ l`,ؚGd&62Lƀ0+$1Xs00 0 D\f!c <$e6b/<1\aB@c2 \fxIƘg30< H<0" s@<<0g3C϶mu a0 `0g\a `s3ml]ؗy13N68m0XN`0X`e`0ؘgd PȚuyYPdt:mLvĉ ),,@B @ `0$H 1qWX<¶$'9 0`' I $@\&`EYd06d0s<`IBLmc@ s`ccˆ!l2caX3s`l0s1b0 1<aDBB9sg?!Hs1WgsY 2b FF\aslsel`,@πsa aL\feF2 Ld#%L2IL6 ,0beA00H@<`ggxfseW+mۀ$6I L 2$a$.2 -O`F\!<'as? 1$ l# $l,2&6d$I\f` 0d'60ls?!l0$l `'$0 e,6`lGU Ilϖi!cےl %I%L $lv ƶ ضB}?ۏ@!XIBa.m A lH6 a#&m'ZR/7l #Ia#mH6B 1mX6` $q F`Lgde:bc1Z^@˄%p<)^bgIn=(chNwew}_0alIB0 l,@d `@8``2d̳L"X(ٜk/:I_H-P0]w^{:wW@<`s ?/r/i89s RfA dA\!l2cL6v[Gml-x&a( g1yA PH(%V !HBHAl1H ' `+ b= A`#0$Fd&WyI06 @Ae€$x\f md % `s0 B`c# 9G 2sxgW!6dLFBݛ^(6~Zf*L;?k1Vk+E{or"I h$'g9A  $$.dd@BH@ 122JcVl&ZSS<?﫪RLxTe94P \?~BB6``0$}KH0^{4a$$ ` FHHw]ў|nJG!VI,IBI-g/]9NbԙkMF@sAX I`0` I $IH $I$ $ o|c9 ksLصzv\ 0 -@ I EHBQ KF  ƶ#HllE l ` 4 cl609 @@$$$m I xBؘl.366 s<7ٶͳ #00ˀ ",12$!e~ 恌mylsl۶6 ۶y!al`̳ ^8 `L66d 23[1mr6a0$ #`@H m[ %q$mgl.3 a[- IP)PP(B$ `c$I osc ^U^_G%* $ ɐv#a!emla6A2$$PDq;5M3%Цic{t}:`$\EᏬ,j YǏ~~s_:UFɑ7zç>L;01N9ٜ-ݚ%lHؐ`. @ QQEBHF,2؀l4%jI+ۥ=T66_},H{=NNﺪKY+$ٳ?[b ."@(m/^% -- @ef# y@لx!(D >}zG$v7ѾJ'Ya0y "DP@!!@H-, @H $gIl\!!XJ `al 66 1@m'/$g@`<0`0,![ilmlƱl ``` !!^ ۶Y$$lYlyn1l33+l#M $IxN1/۶y L6yAL 90l@\fc gm[/ij϶m@<1"!!q0mg2\a Fx.9ynl0Ws?el y؀ @ijXm0$`0gml̳x0A\&0g@[Wecao?__}l׼^]X6qMs!1B 0gFI` ˌ -`c$"(ejy¸^%ş<_?|*a>S:4|>1ٌOonUBi,x Y@d0]w!)atbkF!g22,0@@ )oQ/z)dYӵ6߷>1Yef2@! 2 0$00$+ll晌 I3i<X PL33H晄`e2g`HH 0"݆c{=AykOuLRau=ymOy.{8jo#Ș s?,F llH B\!@\!g 9H<  dy6 3 ,s1!gdg/6A\ag 6I1Hsxq<_B<_3+ij @,s1,@g2<'.,6y~̋ 2@/0e, s?`d@0 .3x@?[~cM̤QnH"L% lXiu~0M'px#z;% g€A ,ɀy&[c BIu>5 K!, l׮dyܰefg$ .ll2̳c;J`A`E#0 I<`I\!0Yl YEUmNd,dl;AиrL ylGmigGgX\! As d0 F\ Qtz:Z l,9ek拍~:}EiƀA@\f,1&M`9d0 ƀA FR0ld8f*R`Bl x0gyƀl@`F$1`l$ mL;#ef:3vlB˄d$iI~Oc7˷"d5kk8o/e 6 eHB$@(m–d !Bu>zI9Ο b:2 n&ñj7/Α&; ic?[oW>]Z~XwfH 0L؉ ` Cb9B{w Ӕ[bC]^~oZE2Y)Mu~"4.4d)Hؐ؉_ 03 #a`H)%T˰ܿ;GV+pǾ'EɶA&B\a 3IY4G<ð!k)-q˽K  g2$ l9ض p`e@q$< 2e~j=% d`*,@yȀx& ` ,gx  ~ȣ^ M8v`g#6 ;aXVB G<??ߞG*=X6 $m$x |l|  < ~" c"0dϟlgg_"0@< Ey ۀyyd0ƀ$1 Hmkç], 5Zb0O`tbll9áa^l ܟ [kӬrheXN}Fwxa?4%$1HBɋV|O_ LF\&IeI`l`,diO~#8>_2$cȀq1 <A!xG 5H+tWڻu`b <l m,2qq0LYd0A x&\a26$s?m'y 1]$&a B`%$H-Lcc `gL3Aq~3`d[M^_⥽PD233m2_KyWzn~g/en7! `,#,0/mY$@6̳ sy& H 0ل² q?qAy&\3 `0,qy& L@\!I\0@!22c$.6WHB %\!$`$$gW@ 7$MՏ*5͞얞閴&RTQVk?nmg 9ٯ_ه}3DR7f5u#_q_Zgo{44iN9?曺_s%ۍY˒.@ eBXX ♞.jt5zCXj8%@`clB`XX0=ƶXZ"?PY@Hy.,lCBBb;lδә$B@g36yc ؘg2@<7Rj~6ـaD BB0˄al q6晌 x6ijX#XDCHa^Uϟ]" ` $$$avIISvϜ>'sQ #`7|g;3iD=3ض Q|?et@& X.76۷}fnpӾg[**Gd5_vNo\UF[_=bKQk]tUh}is5!՞-:.uz\~ymCNQȆZ#U WfZ{X]6Jg'@@6W#a6Y 晌e,sxSzZJ)#nvlƤ ~y`#s}WK$ lwLW>8$f4`a`smH%$%I2d$M\!dL q?@2 Ldu괍x 0 BEI2(H0`clB~03xI`I2q0$@` c۲=G+ "3%-MDD!ZqïmY;o?? ,6`Bls$cHO``#WdI `Hm!yH<c<<L!l,A< @x B[uGa=p8x_5_Ue?^gEuW *6?d}W~x0 B)'ӊqtg1S?Uݝ׏>I`5u5j('<=$њ:֘2-aƬ3OãIG9AA@Xe cWyז4ɓ/'™xLYm c@=dyt( hS:Nq-`ll "6<l@#Y\&$qc 1W!0 6$@H* 1H LI aB&CӉ@F,F\&q lK1C- B*iI컮rwve}Xk^F BQʥ?azz_y,d,B@ij@<K0l  @ cs"aHY$B& @y`eF0ˆ0f e @Al`s `'.y&H2 0$ lH lsy&L`glg !.6l!`0WL 0B@`IIL@2x&@`[`L y x&m@` H2 d!se2! 0X c3IT/|H<xn$^a 00H< x ͳ29 0`  c L9cxng0 yN|YW@i_~8D)aѧ|Hos~h_)Qt%})0}OgxЙx_~rVv%y^4S?Omr}-"MNȎl uޫ֫ d$ BB $ 1d=0 %9s<~ݍ/K=w7ͅBAMVD(H’L9ÿϾ7vx~U5}V}S_#ӷ0L'ޱ_"f[J2`!4n*zwc:( L2B%D3 YOgKɓ*1a@H[`@\!1@`0E6 omZ֮-[nxЃ|#fΆx&HHlc0Nko~}P",Gzk7 =>s  s $@`$W 2$[+$l66+$ 6$,63`#22pFƀm H4 a 8m6$[B\&q?aa0lc|Kj&q )ǷO7IRDM;g<Wy~j$ECem?^"0Yl 0b 06`1K x$qBa$s1 B\!qL~6O@x$ #0B\f`K" MlsA6WH\&B`$.6$qe!c3I\&Ll@ L61  E`+d el .eƼ F`+$.ed̳$q`sW0 y&\! `0 !<Kds%$ !s[70 II6`IHFR(A ;J al V00Bx&l@rz` c,l HHF 0s% B3%؀m`#@$D("Dȴ$60$ `l#c#l mKOOۿΩGP4X5^ O|J)vF X!$$IR sۙmg"4 R@\Ї;qoo6Je:J!3J@ N6cZKN} ?~[vrjPuI2wԱ>wх!03j LVS;A`P=TCvhB;2[V>iyȭw{U Yqܹ`8~F]IK@ѕ0iJ^U{3jgdd  0-aQ""DN[_uK5^_'PC$!v`!@Q 8$ca@D:~M}j48(: ѾJd0 0$ s$0!.HP( $@:<ls$B[ǷI%yggWAPL`Gi޸^٥#$Iq|=WF`x&gyB ` l\ 0\fI  @@@g3WlL y Ls&0yF ` x& ,@<$H @Y1` sBOȘ0g"y⹘<!Bx&!\A<,I s y6 s?cL@`,6*ƀ@F6ɶȶ♌  $,2H6Im Kl$@c$.-I`@B!0F F0f c @O1d2I\a c0 leY 2 s I< M !T) ~1{㟺=0d6FSǼMS ms6;~ݷC@L0D l C`IX  ld'`0ض%Iy` \Q%00WcI6 21m @ْҖmH8- Lƒll`6H@+ ($$)BmIFa%6 ؒ1W؀id@ O؏۾ͩk98vzy(! l>fL $$@pl2 Irˮ+{\$`# A` Ilgx&)Bqm  `, XK\&A0a @dY~>}fd'A0Hd#$-$*m$2C&6 0@`  06 0&3 Ѐ[69# 9s{?ߒ""a[%vD'_>!zc_r(H#xkJ$ 0`$@ Fl6mۙL18ph/R aa'>0ma!`j ! 6 Ϝ:~9]Km^ 1ǯw6立6!c@21|3ShG+,B%$!d8әGP_eu_6_y\>I>ZU;)hI1`8\O7J}z=~K{}onl\8}4$Jal8@ 6A`+-jWm#lL©Zh?G=1GxǍ˿+ޯ,$&@9ti'PQ!) l!2G@#]:'rX=g3bI2ˌ,$&N m9q 9ds0 @Fx6!sc x&AB`0F$G˴ 1d8B$~֝8s}m[PDQQBH[8@N#ZID&`, d @`l#)"J)ԛq$_ɟOʬea@H`+0(?G?%j u7\w޻%I<  26$$l# lBy6 $`L 06$d@\aE$lI<7 @` `I`0I`sm@6`I`%e,BAy&!O`%`$E0`dIlL ,9c^\fϟI\&6l. "aL s0` #.3l%M<6ϟy& 20`@ < gb6?_;MSJe{/+q ?@$eȂ)ciFVwab"rț̜&&h lt]F] SӸ:q!2/R??wFQkЇ<VAHB6ZL!ےHH,aD) |`oo^5^uoo?"5\{_E`ۀP Ϟql D(FmIe9' @l,02L $c`AȬD  Ed^ gl gX`ϪMk $H (5!H$ɠ(%n\R@@f21]ߑ۶0 BQ"J c[B!`01 dl#@3ݜ50B0`@ J[12m`6b @Ja!˛+Ƶ3Aiơ + !I J?Oc;~' tknO{#SQﺸzO_}ț/>=z/Z*f q.&YdSs81 1وLb's'^YA]m$7eN]7w~Ƿ}۷??wbpR"KcǶg^~ dNgAR B q@Bٿ?xKeyk_U^w@%6,;ZV6J)PHl ]JZ;qTTcxn`s1b s1B&:ym?E.|uJbHm@ 0 2` M~ $l$A 0 H@ Q+qi<\6  ZJD6!HR6`LKR#,! RVDmc,d,($+,@6` 4<}.ѡT$0  8~>qlBڽxiW1 <ۈCY$yijG`H $ s? y6Kc@ g$  `g l.3\f 0`E`<'Lcc~28q?m,0FS $BFa[m$ "3g>ۿ+HQ IH a6vfffbi~B}Jg#$!T\+ʉS'_D2_sci2^ȉ- RO[ZTh5R}}//K?xL=W Ȳg M#c9Fd3D&l#Q].,~BwQ xDጩ؏|-7?>DB!@ƩSˣ#c'.FIs1@b$l+dc[ l*n//uu'kk_M[IK 0)q]LBHa66 @ڊ"HF@4ml.1ApHW K><$A<33>vIm. ٸBF2d$aA`g2d@- $Bn/қ[^{GQ¶r5o&o?g{w @c d# #5gHBaH60 0%666 #I0`δmۙ``!MB ۲]k $Ssgnm.+`$Kl %B2(˼KZ>9!4S Ke{kgi*U;` ` l .Ieƀ aS?I$a0Ș`!.\ 9iX\fQx6AuӟJ! X `i ƀ@HRDd!Il#$IQBaV5^NpzIH^_O|ǥ +,Y$EqWx""a:wY @`.6 0I B0KK06`bs1H1W 6 x.6d$A<1̳< x&`W2$<'#?%@<%02 s1 X g6``Ws$0$y& 0sL`Y B_de$gA y&  Xyg`ϟy$O`x6b`$B\!gͳ 2q q$L61IlKb@<@0`g20I@#0 m 23 3+$qm€x@⁌Y`3 @sW+d .3F2I\f#0 gL~ AH0@@<󐸟y.Bl 9I0$\! $+ll6\!0!F@ٿ;(a$it=wI=*O Y=37\^ 2lJ0ӹ{5` |CHB 6{j-Nӄ#dTk a RHsw! 6W!-Ks3Ҁd؄d0c$~Ii lۖdg3e@`, )go<:^@(F(2w{y} Z !]=sR3CZRЇoF(R1HAƀӡH-Imll l;S!!dW;džb^wH12`, ` ` `1B`X0I0l`ld)%<N|FWHB (pbPӤҙkԺp_[헎V!2Kk_e^ ^U_{[JaatԩS} jD)Qk;31Hl۶sضy6`0A d,ml`0W ۲m0x:L(@v@H H E$Y+dۀB""BD! *JTEQ (PT,Yd )5JGUfQgӞ$ !Bˇ?o0?~:eld#qƱo.t-::XJ2FRTJ)hQB$.3l2ٶ̶<x&66 @ +`m6&0Wyضy!$`^˄s1ij60`c`0g3\& ۶y&HH<BB<@ϗ@ 1,20`g10$$<`lc?aLy ̳IHH\!x \BHg@d  B$$x&`0 ̳gLF`L$zPHB B7gGQ)@B9X%[ I`$Hx&qA$$ ɀ#B3ל9~j3ӊLڋ䋟;{ٳ~lBI\! elK-asl IL6`m- -m6acLP"v/9)`3ɷ}?c{b$dSJ,*@@"pDioo9Kgf;\p&C7z?B5jdJl9?~~'3ײ3L< 4' V(g>JЯϾO\VQ+P1=.yzw~wKW)!Q57773DHhto:@6IH0`1mHRD9{=yöwa 8 \{K]уRH!I  0 K$!!$$#@HK+ ’Av[Ե6d$ \Y~˟onicM~0 I<IF`$I$$)LnX_m3ӽ[3+ d@yXs^ ,EBF$ -)^mc06`M I B68`$`a: {0RHZS^%^|iJfү*zXl-!Ia>ϝ='2aa s1WHH IB+$`I  \!' $I%IB<0"q@ 6,!$@ LB$ !a@gWqI+$ s2 $Is$I$I$ I$ @\a!$I@ .$sAO$ WgA g@I6WH I$IY$@ $$$$$ H2`'!$$$HHBO0HeAH`  !$6% $Ia Te<]O9).F("mZ++㻽ΟS)]!$q͍͖HnƗx?L81R(e2 lA6lDHά]#nic~g`$<0B20OBXB74Kɶ̀1y&(h,$VZA Nے`ll !.3`,2H`@̟=19~85 X{ǾKG0t}s2ӵā!(BFG(sgm  g$A<A6&El& B @<0l'@@QBZ? m, Ri^6$sol+Ҕi$p4]?QۣFtBtj==_5_7Ζ3ZuOu[Oj铳Yr-&}+dG &UMG=%-%^ŏ_8:2Q("P(l:}r4% $3z?ID0`M I`[a[ cɶiIlcOxܓěrz+/m0` 1H\a21B Xc`0H\&qF<Ö6oxˏyH1 G)dR 3_u3[0d#l'0AcF` ,2\! "` `$!0 6H0ĠPUiB<\&$@RDL:%nS6`B< l1$02#%,d(JVۿ6δX RK-B J?2W6BѦBFYֆ'}xb0f s?I\fC6$I<'g2 &<,yK6x [؀  ly6 daXqef.2y<_m!2ij $<t->[,VSyl1t>nTf$a$1b#q !\aLm0W7vBLI2 D)GKg$.R(Fr6#0 x3+02"e~[~ ,)6 "mclӐVˈr:~ӟ߅#0Ac€y! @ee"^0g2 A myQ l0`H<7c/XϏ%xNs`Lˀϗa.3b0dy.<l6A` g `,B@Ș+$,ƀlx&9"I\f̳d l/L .3B<<I6`yc0`b~ 2sc!X`@<0dg2` aH  ̶$L`0\!q3Hgd#1L!d+ $,!asy&q$L6l$.s1$!c L~F1Fa6$6b `@\asl!.`l@`l$dijl$ qm$ 6WHL2\X qH0&I9lH%qL  yN湙y.Yl$.3y6A\aE7_|c_Ż @ H $'@:~I6e% ql,.♌H< 36Mu# YJ)HX< HtIA g2*\!ӀA-6 a `$ $6 lKؖBmIv"ldB`۶%6<0"$8ZM͍߰Eˆ XH` l ۀ1i$0ll,l$l$eZ$ $,Ivh* Ջ?j7'u"3H%pePbI N'D؋]"0qN?bz?ZlXV^u_W'~wU&[RI$ d\ gҺ[Mu^CqiRg]m Ϝ9=f\ מn}w>"PH eZ4$% `.-ɶmIqӳ;W//sxtDE7|65$`@  - 0@晄1,06 `!.$)O.3әِn/R _~W~gi((8H- #DGk 4cd'5$Oc^sMkS) $ImWzW_gF\& 9S1$@0!.AR?_w-[u_ۿ =` F`0@ ɀF< <A`,IL'u-?ln%" _7Ea᰸6AIOz%@2B2 !K@2 L$@@  !I O|ƒ݆Z%W<9(Ieg晄$I $ɘg$B)2oxA/qpqu,@BA6)۞|o+ %:N lKڴ+ij 0b$$I$ IЇ?e__e_oXחآDW"DWpUIR`~>(; VM$$I]ÃxWz-RQqhoVo=I@b@dX+y !؀y&`@ Bԋm8 +kѐAw6gs_nN l `0F&qx.A< 0fEn6A`@-d2-l$dgD6$H@8湙+@B6$@\& @~H` ¶_ ~苽K^M|Ԛ6jUD?O|\*$  6eF  0 cL@"Bvtpp;q۸:E ,01$1&x.`@`H<g2 x&HcA2y3gdijH ld+ 3 eKY`B0`gB<'x@ e6À#1y f  $`g00@€-0H+ `$s0e@<<|7y__)O],f `06 I``,I$IOlm@(e[P2"AM\VovRj݋wsd[Kİ m$ F9WWCt(3 $L6!Zu/GrYkL p[š:tZyG˽q֫0DZba}aw8BQ""$j R!tr f4N% p沈(H o??RjL{l3 H BHmIX`{6.-BA _u_ Ftgcl0y3 (5/}SMi+bsc~[򫞼>7E,`@@s0+$ s`2qe0 +-0   q1l$Eho†x& !0!@ev 0 6 Iy0 [sA$ pIDD& EԙmgBc$@\!0@\&q$@<0&'sq?!!s@`s/ /!d00s? @\!0<Ϗ %\lȘ  y<0F8Z{q*]hyq}g U+Q"2PڀB&HBD("j7p|tDHiS4!B֦6a%i˽K8}^j'N6 0Hd$)0B2e7?OYllL-Woo(v,$$ BXl`B$l ,R4Go7Z4 lo'){(s# ♄0l`e1dq16 ۩V#06HP \I C\a!.m[< [b``c@ l \fc0@668m*1C]dS&O $$#` #0 $$!ٶ 1$IBd $I!!I$[۶mO@H$$$ ۶mI$Iٲmlly c0@ !!!$c۶m @ g2`$$K $$9  I$qij l Y$$$$ILXX ! 6666`< !!IBB s?B% `E$I< HH`2`b::Jm/ƭOy<=bse $23"$6BAH @mILKm6`#lQby,d*[:zf~Y8Jg Z-ayh,d6Vd[_wMP IRB\&جǏccs(ZK"̖"#ZL0) $-%$l!Mv oom ØvWc;[Y_kLukc̩Saxil-M{2pN a=cj6+H`%a L(l# ac)?:7y7=&)_ OzSzS=Ny&K@@Bl$EK @h3/ܲ2nX[W5i W1晌2$ `$my>O[ll$IC { I%"BP)RJD-ZK-QK)ZJDRk%JRJ)Q""JDQB @[byOp &(Rs.O_w;׻" /bnR!$E !!ijGĉ ؑ.[I! P6mN;vf̴rylke^%RZj)JD)ju]DWkQZjWKRJ)QJRJ)%$B" PDƠLg˄SN-ftCo1M8N IDdqXonl<>ye֜&5H0$XV-m`HHaؖ$ @2 q$d<_,~w~-3_&7H eiP$"B%DDD(%(( QU Q$  'o64ҙiM9~+>gNllMHHL Hllll0 ضmdg33@+ co+sbl6mlҶ !m}qlmm\65$$@ $XH<6B@ IB<@ A e c`0$$d `Y26m@B!!!&\ ` I$ 3 x& .BfKBD&"0 QdH6dKtb۶61 J -۰I `L WC-ś[?c?qwڄ"\(6 E7RlLA6llj/\ːiSKvڴ]dN "l2[EV ac-̉_s;[[i5$$aۀ$C-@M Ńo)NxG`Dqg@d`Im$!!lR~7~--VX{qQ~ģ^7fwYB\&lIc0zpd)6|SSe H26XFY$lc$FYƘ+̳Hsx @d[3,g2 . A @x`FeB\f3 ,l@k ly&i>l 1`'`,1G/GHv a6da1M"#,MZ&$m$6m$l`I% lۀ$ۀ$sd#$ad \aƶYBo/7xxpl$IN/W+\f C2DHV @cgkHZLضm4(`BBM"`thFS?sxwnmmL(H-[rtx-;Bh_U_%^b^" ml s0A6*QZ}S~]3R PHL4"m̌b۶Cji6 MT"G,q`!I$`$ gF,B  `y $IB\al!!IBB#dm۶ddmllH[ij`q? eBB\!I@666IHmF’$q`0 `ccsm3,,0`y&q<`I$$$`0ll0$I<1 H$ !m0B@\!WH$Ks3@ `0s?IBB\!y6󼄄 `@<0a!Ix BBBBBB\!,6Wee@ $Iij <@6 FFFF Idmcc 3 `s?@ `@H `a0 F K@<F< vflK`l0RZƀlla|^P#d < vyLX BBl0,l42ۀmm6`m N66m۶̴mۙvZ`@R4_;ہ Ig"Q6m;mg&66Nglg&¶v%$ɒ _9FR"۰s~?Z_VkDf֜53q:88jS3BVmquooN$`6A 3 $BM-7/bZRT"X%)P(""%TJRj"~ٗ|{l("@(0dɲl@6FmH )"! řBr- sd[6ضmmNc;ڸ/iO}&X7}7#иL d)* If))2S¤12tI-6`ō;'R;#3l1$IH\aE`l[HHO\! ml̳H 6 bsh il'`[A)c I@`+$5;s H$@ 66,,aa0d@ @BB2I ``d IH$ؘ H y$IIxFF<`c`0$,s`m@2@ cF` `ddIs  `l`0"ms`My&e˶m @\a00lFF H\am` @$I+6$ٶ, `$I$,6H!!B6s3WH$ cccf0$IFBB3ɒ$I$ la!!!I$ AH$I$Ix&0  Y 6WH\&'m9s $!~m@Fa1x&@X$$`x&Ƙ<\asmg`0\fۘ!ɶmyN @  &ٶ 6Ϗ@<$$ cc0q?9IH\&,myH I m9 0m+ '$$g6ض 106晌@!6W Y @ $l۶ͳyȶm\a,@B\f0 "0`.3ض F`,$3 9 ²1`<7a F 6"@ml`0@  `FBB31LtڶmXVGFHHRH(X%)eM7^ZDDD l`m@1$'$)$Izk33%Tk-JQJDP("J)vҹb~+xZk-j" $2I@,gesν櫾#b㸞洠*Qei$%$ Hd F@_XֵֈRSo @B%EQPAU(.ֻ>l$t3=s9mritB(D^,{ܷL  !LO+ly2663`@<$$g۶mEBB2 p6 0Mmc;Q  dccK $Mm0&.`ddd2b۶1Ie@ ,l` B\a0Ȉgxxl~ml<\ Z[uj"cP@I\f)O{36w Y4<)L#j&LIT,[2ƴn}{?tE8Q `L6$+$'0 \aa s0W 0&I !a\eQ[e#<#dlab0sA(BARf6B\f'm6Y{_^_UW)̙l lZ667`7wk-)cm-[` ɀ/7ij%Jzwx g28|yig&mIH"IX*Z^WIv"B + ` 0$6 0B` `.g0♔gV%l.3M.\}6 ֊AD- hSs?6 H x& cdHmd@8eZ@B8\& 2-a[mEH- 6`233mA$! Ix l ۀma#)3%$6 a$lI@(f]]o_xC㩥v%! l#! i sytu$`$K1F%툐0ؼiO?xW'R^^iOz{V4  `!  # 0qc2<B1@A<0YO̳$$$@ ͳ `m[ 'c@`$0d66Ax  qy&ax&clK0$a0< a#asI9 g#!m$ l2 c`%qeBƀA  d$.d%l# s !<s0\a   cIy&q3IO\&.3 <c3A l!@ s?F BN#a$$AHY$lKJ[܅s/b/? 2 H'I(J/$I6!  al>tośt(Ikʓ۞(ۀ` 0`LF0̳ag3 l l6b#lB`!BWzKnAú]hw=u߻\;n d6Wij cf#q$/ͳes? |If@-ɀ0Km' O `g9H\a<c .y񢐰y. Ay&L\!0e?!m@m^8y>!a0 $0We˜ij A\&x&!~$0H `Ag3&lgX l qgXF2I\f$.3$qAB\f 6X`$d@2ےBFXA`I\!.03IL~ +$#3ijX3I0H s1 #@ !< \B2c!!dH`c' X@\a$`+$^LC@`%@ANz7[02` i7A_˫˼|}`  ge L a  KY`0`,$P"%ٖd"H2K-o%e  0`*@!2W@26;[eL B -m`۶$0K$`@m.dsBXde- H`K#!<Zb !$unË˼PL]-ɟ&ِrqF(`#l@d-<_aL@\&$l -1A` #LKl@`!cۀ@`0$lA!0;"uD(sϫګ=~ꓞ'-m l#0H0>:Z16 d$%'uox qlrt>u؛`i#!-X\&0`g @ ؀A\&@Yy$ @2#`lK`B@'HXۈ'jNf$am@"Gh8 6$HGDDd6@`" L$,xNd0`̀Hu+TyN,%#  < Kx&`0XX WH I IHH<08ۀm\j `PlpΧ_2Cj12B\!ll Tkܩδ @<1`8j5ð^00 088848M40N488M448 z^V ۶ m H2F3 8-ضllŶm ¶F4` ض cc2!6F1` ٶlvH8NAEBƻ{ zli_;2m vD,[y P $ Lc ؀-[ 6dR(D!!"Hd00icXӞ u$I @ a#锄lKH` X<II\f#6$F%3 l \fP(룥$$A&9۾7x}eq{k)OylnnL$XǃK8ekJ6@ l Ib& x A! g `c I$E2II$0؀6c$0`@sy& y&dH q?ͳ0 B`c$/O$ƶmcl۶鴝FN;"VC,#@tq4N By&c$s>VKw 6" @֮B\&I([m3g2 gـ0` @103W6˄@X  I)a'>+2ť"XH $B U>~S<4 a,@HSqseĞk틢ai\Z(fҤJt[]?{z2l.39ijs d B(iIԩ3s?mnmmMm a#@^Vllcd 0`M8 z|Z0#IBHBB ` d[ P B(Z뽽٬ ~`'`g$I\&0 B@ qjS&"1`~w~F`c 0WqDh -d[ 0\f#!k^Jk꥽W}W?˻o}L4-A egy Am.K ads 0F0J_~>_ֶL0Ƙ4Nضm46Xb'  Q"NѦӷk/48 BWH7uh@y2ZmH$# Z6$F$ $l$0g .s ̶x g 0`0`sI0$0 0d$@d &.3s1Yl1 dgWG8\JLJ9}:}5-7vZ-sʖ-5˽7ˉhvKH '$$Nla02c0 1˄’$\!2ll0ypf5vbl۶m;+ $IQK>jRmmcٶv2-:\?s66m6`H`oHETJR#"$E"x&`lAPښ%+kVJALB l۶1 6`@1BLmmmδmm lm6mB6#.3$$K A8MmSߝ4N3vfHG˽=Ngil1 ؀@m48q훽S)P($I I$I$Nig:33ӶӶ3y!B$IRjGw;>wm=ϸK{%Nۀmmۙmmض1lIRDE(B!IH@6`jjZf:F=62 ~B ,0.+`m,cll6mmmgf676@2Z;ەnS $$daalc 16 I@B1\f#@$H 2 [Sk $`!$)"$EDDDD9M ,%46K8e ˉNlc˶ @XH ʹ:hWfLm6̩66 `0 66d.`@ #$I3,,%#dCBH)#,5ĩ7W6Mni9vf2Kܫ;~b΢dIQt>uLL06ABB eض 3`e2cc`lXXXXH #@$3 ddm0 %K9ijlellL$I0FH$I$ L66qij`d<@$I1Xll$IL @$I%$Iƒ$Im2b0g1 $IdlY $`0&$IY0۶m@Fde˒$!@X`0CAl–-#K-۶m%`g2g`c0A !!!a I`0H$I 0H\!ac#$+W~6B@2IƘ$x6`FW! A09IN_sf=8t㍯ۿff B0 ij˄1H6b^{^6ZSk"zKg-dE,Q@ $ x& g2 X le$c`4& c"`aB )tdZ*Y` A@ RLNatƐ`0 VG6NH$`,Kd&`әi@R Rɵ+/ʯ_ !06 @ 0I`l#lK2%`,%cI  %)$F6V0d Gw,5[ha l OÀm @X`dTޮPDH* 6閙MS̴$@R(J-%""HvؖAPhΞ0 `vfr{;v%96b m@R)!E:qiZf2! B"]֮DZ3sxcl6iΟ;oMҚA`0m$B$[{8J 6€d6b@\&d%$lL`ڛo:=I l.l0RMA6d$l8vN˜jTmFVH 1&LG!`a`g$QKN#$9mY$4)le,@< x`@!`I W($!`xvVpoLH v-67~[/ն!w?#_{|;'QزqJ˾ٱ?< H\aŘ˄!,`sB !y s?qFK`Ils?@e3 @ lL H6d `x @Xy<' \aByF\a,d$Ŷ H0 @ls2l0@2`~ , LWg3`KF\&.3`I`H\! @6Ym HdeT g!l@6f,<B`gy~, 6W2x~sͳdO ,ˣF[`@-TL>o4! `mۙ HBW~W[4 %q5^_.=՚$ !I  6a`d@$B\&a$PKCD"LAۿi{gzkc(${|, e @ i[͛df(J)G- I $ HNl|ksc{kkc1/ I iFHA̍b{sswo@H HdvfgkϜXɴmۀ!dbֆaX r\0L@!mc؀ % څK(0d\ܹoo_eRdlcIYBS 3AG+bu,dWXv{oj|۷˯xrle2622l%0".y aijIs$![n,$Zsn=dE2 0h^ifdBJFQ`l<_D,wSQeR0$0Q$.31mvNn6j&@+rXԹU:" (PYq-K T8$p)6;$d(a `#ɶQ"چr6 ] C %6$Dfd}u~k۩ GZ3iXO=;~lF' BlH  00e"l A@ @<_ ql,@ EA<1Ac!2A<\ xgd,g<!.`M a 1B<L!xƲ1<YijsW@B\f0@`HA<c c0 ,  sBy^6f sBT-0¶$K!0\&`IB`Lˌ$Ƙ22@s- xH~dWcex.$l$lIs%\a ` bss0\a#g3ee `mI@+ @0!@g3%qma c6I x L'ac LL\& 0 x^6$E\!\ <3Y<@3 xq1&B8mgFے@ل m $Rf[b[lZrRZJv2`'TKi-lB$۲wp[ku!%F I@HFl1W4-ٙRX`[&m ۀvs[llKK\sݵˣU)`̙S:Kd6I@`$A0dLB%l`K`BJkoqcgkP2&qvp!HBƀ l HA&GӐ v d$0>w(u!+X PK6q`n^vNFtIQE tByX!pTVXt ""$ *D! dADRI,!fd XJ'DxjWxkG'V1g'g$<Hl@q?s? `@g~ͳHlY<1%EH$6/lq1d$s`#Iy`s%aegE cl^DBLIIIL` 8mt M'G*05lE4zҫ}L@Bm#6 ےl`A¶#؀y&cKF H2$Wk)@F9D ۼ;nl,.Rǩmmn¥7qA lh 1$(x 9::lZ $la9۾ל>:Z")]薛O:q۝wGiH2  VT ׻I)En l2a#@6۟~ӧO<CcrG Ȗ$IB@%ـLRD_]R^*mI6`00`#lA021@ n>= gs8 D@2qc$@0A aF0`B ę,sz$@!@Q2{BXG f;V[g2ش6, -6 ؖ26`ge??{WyY׭)X@1MzW{??:t:d$d 0\f[Bc! TG+7CBjyW~W9\]g5E/]"Avn3מ;H0bB@x}TB%Vðw @4;sulm0 !c. 0dd[ȶ$de21j0O8>M %$!0 clc! mN06Ӵ{wݲE@$I7?ay{ i"-,$cˌlPYy7|Cz˹ΞvM0vq~;H;I {ckg{>)ùUY`gؑLBo6B g-eomRT0g2 3 @!@/-LEXlKfw>2%lclAXE 6'$H0 A<̳X $,a`ed@ MNHlH02FˊvדN=@Id4N~7>22ݜ!Q[yn~2 ɚf}}G @ ͘ˌ l ˌ 6/@l,1 sl  e `I`L`  0`lL \a@2#.B`$E\&yHYl$yn&Lf6d<fI\f!$ 0y& 0ϟA<fXgF\a  Fx6ۈg0 0& $B\f`0X@\a !!I2H ,!gg,/$3 16 s/m\as$  !$$H Q6{KzDQPHBQp#Q7e9yհZ5Qz'^l_G|8Z mCsˬQW_ƹlerncfkZf˖n-[̖Zf˜2[f˜2)sʜZN-[ml--2s69srNў=9'nLg:촛ĉҙNmc4M Y$!IRHRu6G!In:)B1X, $ ,!Y!@9șv&$cC: #g$ɦn\YQDJSZ˫<1ZIH$q%&@,ls# b}eB+C-SW{}cu<6O[[ԧ<͉AAz=(Q@n:}-7u](3 -۵vA0¥D 4ɓ}#Ϝ<9qF$6F lB IH\&IH!~oooZ$,I$ $a   FH  &I1Y$!z}䣮;szX"!%$)J("BͻKoo~S)gSv әv ;szWxYNIvNjtD !HR(Gv`ksCAU|>7R@B  <`0X 6l0W$~ĉq@B LS5Eq$a066F2 #m+ X$t~)*RH!!a HB6$@սdc `1R: +[kvB,۶m۶m۶N;mvډmNinmʜ2'Әm6fSzJO-[2[mr9e٦lc9ek-3-̴34M1Jԣq4!Az߮|?#0]Z(%#=1xݏZbf {RUT؝) $$lg01 ql+s3 `۶ms-\fc IB` @  $$I ƶm0@ L6H<ijٶͳHH 0660`@ 36`llل&!! ` x&a@< 'y&܌11gc2xNy   g2/@g20/Zq^v{Wa&26X ,!At+.JE22g~V6⊐l$1!@Bm[FRlRAJi%JDD)nsb@ `+l. ؖؖH$$$)G+A"jdiةOۘ@(V?c9 m`+z$ :{}MO}`B@~_ZK.^{~7D0M c,ɶ$lx&؈$! "$XB!@躮:gL$I؀H I00IӧOK^ګ IBH $0 7|]wW֢eFFc)RJhζwG<ŽמZ^<{70N p&Ha H-q$IIKA;/荍iqn~\z I<lE2 mXIB:uu;'NB I%Z[o4)*@H @! IBH!a؀0 d@2ۙRh1KH*2L<)d-HB 64H!!@  !2'FO  6c.ˀ!R(S_{tVHBBR5/ܹaXm=/{?喗y3KK(ѕ rggO>Xف!B\!@sWHBF+BY$! Il'^Ix6q$ d$I$I$!a@$I$Id'L@ K$IC I$I2 ~sd IdB2I@!IuuǏ֢s? 點& ♌ ,0 !6`3s?0T8ѵil \&@FW T{dFmyd,aB@`0 @\! <@OX<!(0`dv#3GmKT&$E&xݫ;ܽ{n~r:"((e:9- <'d@a+yNc̳ 6*dl0Xl 06, R2$Ogn껹Z!F`llyVq!l B`(Ll.4m8mƶ!B)D@!l0-#-K,Y20mcc˖ȀB )D85?=wDˬZ0Jg {-/={7~zkͺ-]V,SdoĹ ?B$@ $BBx$IH$I$!d$I$,`H$̀$I<'`m0 $$E `l. ̳@$IB<0g2 ms3$I  a0dY H Id۶m!! W`c03ٲ,YB@@<' $I<@F+ 6666ml  22mll#``0 @H$ l0Xlllll $$IHB Iec²1\& !) `l`le۶~m<@<_m|Y\!!!q?۶ @<`۶xmc^xc+ `󒐐m3IH `0`m6Wc@<x& IOm$'+$$$.y6@+ 0IemQO)2< ``M'8)BIFq3)\a@d,2  f$Y؀Ha`H41M)0 c.- 1[^6 aVcFŒ`7Q`l0 0 $qB+ @A`1 l$,.cP>{ש݋Z3V: ne$M  hɓޑiO. 9 e gd ij !޻z$,ABEzW{{٣XD4MOd1@6 ,av(l mm6` e@A`@6$Hm!I2IH,0H I @0|Ӱ^ZHS6n|7za 8߽{ǎ/b>/ն əQ$ٖI9` `3 6Rf*"Ї>d˖<!3,r=[̝!0 @$EHR/6i! &rmwR,HcI\fM`x&q?L &IOBB@$g9HssJ^O!Of(E"K 9DƢ>/{IQ $ $L - a$@<!0LX`,9I ,0`,sSkOBPJq}t$U,,JNcwWy6S.WCD $0dݣ"x&LqTJ?A1 BB~!3I!c$l 3{qwA~HH0l8qqqaqqii666M8M4M44M8N48N440M4M4L4M04_ HPf}>O>qxt"Bz$9m _Q^^BDy򓞴:8*$@M55_ճ  mBdIƒ H! I! 2 @BAH$I2WHPH d@  IH$H HH$!@B"X g e>ݽK]$)1DڃnW.;(BB!ehg{K* WHPBșIAmAwr/RiҀ??G%ml^jm-ӤV:dfڭLl23mgsڙi+1@q3\$X-! $ L A/orwR*0ղ}$J-rL2 @ ,<20,L<3@0`M .t½[-%\QZ|ζg?e/O.N۶ L؀ӥ$0ᦇ>즛o::::Z'@e">oll2lK€I,m@m6B@$%@i FB`X $ۀm@ mBؒl6 @6`i9mnm Pkl243w/g I! Ӻ_lԲXj8^5> 7P٬m@"  I !$)$IH#mdt3Q L6`BHI$$Ll I<$e$(=WKs,e a 63<_sE 09dg[y wAB3I\&IH $!$$I@X ! $@$ IHH2 Y ! gdRV?߾xp]Xlԍ,}_ w^xRKac +s$$. Lc@@HH$KyI$Ig2gWH$IBBBIBBy&I$EB L2@$!$I  I<_6eB1$!@@ 22!!!@ˌy& ̳I 9 ,$!$I$I$<7$IijH$  6x  $I$IBHHl0@QzY0K pfT  6d\76_󾥓ZF'>Q bijWӶ3`$%@`$ l ۀS""[o'6m @2  `Y̳1aRřfș1 ijX`$c`0lͭn>7s@]IJsƠLgBx&s?ۀ ̒!0`0`+e00 0$0B\f `i~xy]7gԟv/d@ p .ai#,@ ` `d#.3sy&9K qld @0``W0fkBiK MM-  ` Gq륛~vXM--  A0ih^_ A ijݬwAm#H-ɶ$!;A$@IӖ lԲ{nO3_U^y\mۘs -3vd B2{O6G*3 $qPd[+C/(S˝_loMm 8vݥ ٚd[ a}s]6db @`$ d B9ȗxٗyim$m@ƶ$%$ۖؖ aےll$ۀmL+6`[mI2aK- l ca[H$ !ɶ$ HlmI6` 1KܬBla;$G^{#/2'\n€dDVnyrXO>yk}Wn63mpBml}ܽsZzȇ>яz_bF(L9;y\6"mgB6,d[oGDG6؀1@6e6$FNLR 8& i dq6',s#0I֊%l#qFs?Il$F 3 01`@`,A@-  $@d l@ƀdh/3\=Ck0JW"4@X cI$$Ŀ̬ݙ9amLCB` ƶviR٨]̺r=+ @j<1Ԧ s2 " `BF 0l03Id$j (Rl،1STL6Z#-;@ ij\asͶm<'x&@mM B<l.m$$@}{δ25(6 LIl$$lKB,aΟۿW~Wݽx\=[a@i|€ cI"0 GD3ɘg2XaW_j҆4< #Ԧ~=Bi !y I$@FlG/X4嫾+DXca Ɖm'L@!a A%@gs1d `ijHW=U6y}A`#\&YWkH [ \ԊA`0!FBƀ  L@3g6 s-@1@H\!0+0,0$#ijF Wg1L2y cb^!6x&|xd$<_2I+6d$s e3ll6$$l@@009s066/L B|0\!0A2̳,0`B<$s?! \fYc2ls?|y  L I fI@II@gH@H B g$Iaa@$IH$I `ll۶m,9O,YF##0 yN6\a+$ ~y$B$!I2L2`llIij I¶m۶%IlY$I$Ay&#cccm06`0χeyc@\&$$$ a`0lx$I$ 6$$ijXXeVA)'$6 IHBD"B $I`$ B`0$YmY I?z~71I4Hhnv: 8 pa$3I\!. +l`,Yll۶-$ $I$IH<'Σ,d`cKBƥlV7x $u}oY$!E- +``' ! I`e 62ll!`  Y 6W`-<$I!m$!!I$$,Y$IBBB @d6$@  c0g@B Lg366lB0<@<7 @<@ض@<@$$I$!$d@ s$I\!!x.B q1` ,c@< ƀ@ eۀ$I1 $#K 6!!`0χ` 0g@Bm,Y6!YX`dd#!! Wgd IgI$!6 ˄$I$@y 2ˌ6K<7 @66dH<`l\f3I\a0d06g2K\&Ws0 63I ! &3IH @ $$$gll\fl $+$۶y~`@\f!$EWA 6L el$$`d @ I Ŷm\fmm6myضma۶m0!emY$$$K``a-0ccg  @%#,c0m\!#1`0ll, @(b{ZD  a`6q0BpTOoaB$$q?(1χjP @<Ml@ -$%!!Bl#aaLWcmcI ! !K2`l\aۀҶml{\p OxM(l^uVKYSk[?iNZ3I [( JyӭU}A#@)5`-Uf2imE @H$IHHHg$!@6 m@$gF$I$II0F`3mKH@HcIl2!@6-Ll$@DF>*\&xg&J{҅L!P-݃PHB0`I$m۶mN3%4yW딓j}lG>,s@H)N8`H0ˌ@F $$ $`湘`0~!c` xmOHBBN?dym$$ +< K L8 ԮCB ,$M0g0WH<' 00`c`@BB`cl`\!0!d`.31Y sm@$$ m2 `@ bcml@ W0 L2@Y\a 0/gb m.m[&Lc۶leB<`6M !`۶yNB<7 @ d``0`c6[X B@ @Bx s3 x&0@ g`l1$c0 [`@ qy @1`6Wg& E``0 +3g2W$!`0ml@HHHX6msmm`g!!IB+l,66WH\a!! Lcc\a@ y@\a I$I$$IY!I$I` 2-[$IBHHmlll2 6-KW0q$I2y ˄$LB +$Iij`$IBBB  $I266c06ƶ-[F $I9 qmylllͿ0dl$$$♄yg W `0b##L`0<y666BBBBcclly6c0 <^%^l= L66`ۤmcm `l[$`0`#I F6$ cc`۶$I`[$m, $$Fmm$I6i 66ƀ ؒlۖmd mc6`lal4v:l ؒdCpKK?umA 0,Y@ym{˩)b= 7=~a$lLl@m ۶m2m vffi}sGM4KKN0N0@@!I I$@Xdɒ$$l$IL`lll0$ lc<7!=lVsbj @c; l0 ,`Ga@ I8 `0 @BB`x&lƶ`1`0666@ 0@ @<LX 6ٶ/x cdx^ƀmcc$۶y 1f0`ccM H2mg1mss@L@066m6WHHH <$BB @ȶm@H%666 @FHm06WH16 0 J<$@H0`6m2"BB12V@K`Lض-x&|6=LH$QjӯZ -Jd,}ޗTjZܼᖛ %I$9MZ`@6f`8qb;3u]-7O6d:3#` !#$ !@  @O66`Lmۀy͏'a $@$IB j?.Z$$6m۶m@™mAA xN20d$  \a0XX<@ \&`.e\fd0@ƶmH ,6ٶ g2 ll0`۶ms0d.366`dd'y&ccs?6yml`c0`s$gB  y6%m `lg1m`cs ٶ3xyeOE]̴d0llۀ0cF*x;v% e`aHےmm۶ Im۶mm[NcImI6 IB`@ 6 ۙml 2`sq$# 66@B 3YX\f[#mll<@ +l~~$$l ~9s2<7`0"!1 gllٲ16`0$زe`0666 @`0۶ !!!3  `$E m1H@Hll,$$`0` ,$HH $ #Kij e6M @ed66m۶-!Y  A \f0$$IBl Ylqe˖  l@0L I\!a0 yB al0cm`۶\!3+deF @ 8`laaa0 %*mHƶCyge5 #Lll@ \ `d<<@ $$gll, g1&WH XX mB@A B`@ xbll@llOB 9\f0L,A`@@ "/ ۶-ijijųl  `c3eY `0 XBB<0qm.`0W晌@  Hlc"\f+dm16 $Iqy6@<@¶e!!$y& 2g6Yc0+d ƶm۶m۶ms"$Iy@<ۀ$I< c6!!!Y2 Y$I_E 6 I @$۶y $`  ` !I#m`0"I$!!!ccc˖e Idm0!!I$I$x>#$I@ I mOBI2 $$$$!s$ !YI cۘ`c8Rd I$`H8qĉ@3Z2m۶mmg 0`Vڨ{yk֒\!@ +pM9!K6`33ٶA$ٶ--$۶ mm0$066`0ۀmۀ06ٖdc[FW(0P $)J8*jGK)Zbxs%"[:&3w}E-mVΉn6Lm3v&mp38L :_z?i>_֫xn: !!HHl6m`ll06@ !!dce$!!! 'I$!$\&l$eEzƸ ض  ›[{N"  ,66qf6O6Wc$B"d 4HHa0$,ȒAH I$IB@<@ I`l0Id`AH Bl lۈb066mlll0L$$$I$lE 0 ` B`0A lll0$!!I$!!! cc0IB0d0  $Iٶm%IKB m @$`!!I6$$ $6dc0WsƖm$ Hl $$d l `c@ m.y.’$!`,@$md <0 y&@Xd I@2Wly&   ,l!! H0E HHem<'$M``۶1"mc^q?cg1؀xd6!+$$ij\f6b!L262m$| ۶y@BI<\!+$$[@ `cc۶m+ KBHH\&3l2wٜ&l;<€ք!̶Fm۶۶1mIm$alK-!H¶m[6 I6il al#$lmۀF all 3- 0@66l6`IN al۶m\aU8 2 a~c^.]LxC:Q\xq\e4Sg 3- qf l`."l~vw;{n6/(UH&$, l g,#$Il HB$#`g3>:^#-[ #M w3Rz҃ 06{ I iƜeNf'N0&Ԥ&%JѠAKvy&LĀ0²eƀ1X  H9@ q? f0HH<I$I\!<`BB `-$IBm۶ BB۶mc0  IH$I yll@Ye6ˆ+m'ccF$@ls?ImE"|$A  WAL`HOyo\eu{+$ـm$lls?!0 Y @2$K lx"r-)!B0Qw=iBi mZ$mno.6$L@"v]DZ](I6ؖ$,KBAO=*$ $ L es$ ̳d.31H<晌y2@@!l,20Ƙ\ @< I c y&c@ K2c.2l#0`#.3H2 H e6Igijg`gͳeI `IƲ/  16E<0"6\!@m0fK<l2  '@`0Eg$s1cA0  9 l,6$B1q?!$$mI<;@`ge 06` 0&xƲA`@$c@mχjfY @< $ l[;w4\L4B|>G (ŦM-PJq(D c&CbȞBX@6P d ФZe^ԧ? a@Y X  l<$ gE6`.3FX\&l ll"@ 0HO Y 2dIYd/s<l`\f 6A<6WIX<Ϗ,<\fij9$HH<<€`s#`#@  F`,cdl@!l oR/xi&3LcclN9f-[زSll0295ۙ)vH~{`c!L;0NI< )>n^sԱDLH6Ycl$@Z' @0mN;qBRJ)D RX0m0 FBB@HC@$0`siX?8\#@c5yͿm<ͳƩzH ےl @6%-d[m.3F3%1H2H6@`,IB 3$ TԗW\69vbަI!'Zqm0p5iۄ\-F g?A-Xm@a[mI a6` ` ؒ$ؒlےے%F-)a2md[m`$- $amIAm,\f[ `[RlI"%! `&$Pض 0Lgv Ax^6wZBDB%ai"0@ڙ),%N[HO~^^ )q6w6O^{3TpJ6,  `, $$e$|+l`` yنu6 @IgHsiϣD"m,e]-pZ(6.H1 SNM(B$ lGHRD`֐TBRJ+ecs+j7N AQ<[csw :4!X6IH\&Am` 3MTg=``6I8C2BImIBlK- d$HH#, dHؘg԰&,G837rCn9X.mGDf>̀!!1c'Zk%))0&$[[ +-zZDL m$cs?a66FNKm @0AvBB\fd0I mA\f61F B`t"alK2m"h-%! lDm  L(!NelDkWyW~SAdEH(˥P(a{kk3$ aI\f$l !]}{̉塷C qx$0 $. # l xpp =⥷ǶNpT,AmFZ40R7H 툲{* $ I`cIؐ`RbW{8vjUUmK2D)[iX)l%lI6J(vS*($ `yy~ g3`s @O`@ϏB`01@ e qY$Xas"@`@\!@clM <!0`2039H g.3 yc,%x&yNy6+ϟW+ l$%HP€L<ų!c@ms3FF026be\309`T`L$@6W@`l< Bƒ@`s + $@AxSv;`PH- )M/oK"8no-.sc_G"r$j8 @ PA `02J9!EB%ƞn-j2QH$ l,`~P 9  0B 04 2;7K LqL`6$$em!Id-d[mm HH a,aK$ lltrA`5l`.iVPKK R.\pۭ c[ 0Ӓm [+bXL)Bk@p&$//wrdl H6-`$`I!$aB8mےm6 .- -N d. $FlKMr16 d !ai ΔdZf L%em L-Wz$H, #0i$bƆFa[g16c,l$i INխO{^w*ai0gdY0`$ `Id!`^K2```JZtzp5\b$1ƀt)lly㎤"Rd*lx& ;}W.[ I`% Ba`HFBL!@o⯾k-#j ҙboz ]نARv[n|ЍO93gD3~}ܻ>7BE!A lH$ ~l Hm`$l|!#0d.2`gxFF\f @`023 0dI`!@@`0e0` x6s?`I\!elO` }u|̋;zyJ8"M_ {PT햲qDlm\G҆3s16A` sˆ0[l a$$S@0p~ư 1 01$V>╎CD"~@ g˩v(l#lIP ɀm)0H`@H `sm@ X6؀& !;v//\ , P6l!0 H B\!@`cs?$lsBI6@6fLHF BtjWȀ' d$ `I!HH@$6`$ds$ ˀ$Kȶe6@ $ƀ tH6XrfB@4 IH2lc#$ig ӧxMmZi I&-ðݲ9uc$Ā0B l cI0 6үsn6Dk$I@ $,. y6B0 F @+ m0d, c^F{c\a㴛MMGi{$6`  !$I!@Pq 6`0N`0$ BR@ @" @FL~jg<E@Hlל~{]"Mm?e_ v?8Z-WCK@"HXLc;<)LLlVgn8jDW~}aqII$m۶ZG۾U8NN`0`2BBH2c 2+ll`6"LF qe$,I9IHH`d066$I$!! m$IȖ$+$$`0ٲ6dcc|H$Ig1 l9glllll۶ g!!0̳ Xll H$IMH<@$Is?<1m\l زd I6m~$a۶ -#,IHHy&c0W<$IeLe6@H B$$$ @$IcB$!l[B,̳I̳ 66WȒX`0l $$@B#0`l ` CeBY @Bض@<qB ,@<@<  la1W؀@FF<B $6 < mC<1L,ؘ+l$@2Y,#E`sL2 yNs\!'Y$Hb0d0g23b0@`0g1l۶Ȳec@BB~m 2`.366%``%0XX 66y @ 3`c۶y6A [@\!x&s$I@Pmm__s)D$"P!"$I!$Ɣ;8Ngn2;X1m; q?e[ƶ`0X@&@ `ؤIccacccmijH1"$I C?K?CHl "KQ_Y]Wim`02c0@ VtŽ! 8sjI$ $ a$B I1H[ H<$tfmNs$ l2$d GHo?_=5& - %0:_̍%I@X@5Z-YKF$_kmm LH@ƶI@B 6,l#m6  $6H$m!al0N&ۖ$B$@mBD: Hm¶46 !df2\f# $ I( H222 @ 2$vDZm $!.3yN HH 6Mq8yz,@ 6mH\a ,$$y&0``g0m`۶mseml慰y.em0m۶y IWCB g̶m̳ijq?x. +ij۶ yQ$m`!BBy B <۶m@<@<6@< ex&@ 0d@ 9Dʶ>sͯFҥP8,]#vwNǼ+ؓ)&Px&  I<$I c <$ f۶ dccg3d^$6/"L xyaHH@ IB!m\a.3`ll303A#O82- f2t'O!YH0m$ˀ lE0`c,m\;n  GA `[O/]Wejƀ$Xѯz)y6c7a#a$y&aI#a#lKl c6`  $ @ccI%6I9M`l8>1ƭO[f3LmcX(b)[l lt6 Q뮽nd ۀ - d,1HN@` F\a`#ٶ-6 HؖD:lmI lm@ )asm ۀ HaD4HrZ6AL4l))ƀmvN%Ҷ B̈hSSLt Es$0, amg`K` y&6H-0`mD-n~=c"2,0  d xN s?!I0 c0)ǜ8ylyxttma#` -luzSWG$H`.JM+l!XȰ^F`#0B6LA[``K` LaGG+ R{ٿERmL@2F!I`1F0\&3 L0! x6al` /X$ۼ Fl$lI !@$@<eB6$0 0"x.Bx!+l@$6`$3gd,gy al !,ll l< Hͳcl#@\!g/!^caa6Cw)Jo H #{v&) ll lse%8 oDbzؘDN0 A~B@`$y&2$l3H2!-̌Y,s Cp12`cdl&1,ቧaeYe$@mS֫UIɀW$ $@l IHMc,w/;{ ۉF!)JE(B!Et]`!{Xȴضm 3msȶ6-`e$@B" IƶA c`cL\a I<` `1 2 ٤mƶmcc  6 $Iii!I 3mҶI!޺pJ)'$`l V}I! -Q IBH @$1$.3XFH`wou8DD8]p@B\&0 \&@g3X,!  ,`0066& {:%[M "0c`0N`c??%HFlۀQj;ۀm 6 %֫5q$l`,ض @H2ضm €l`۶m.$(OZ#jH)$IE[[G~ۓoͬlLhQC>o ͍MP(0ܺ'E $d@gxcض`HH`0Xcl1WA $$I `09 x `0< KbթucƩL# d?ꓟX,$䰕"~~ﶿ{ZZDf`0 x&۶mABB%dl6/`smۘg˄xN؀e !L!XcBHl m۶`16q  =c@mϸ'?I1dq *8"5]OB3 6 ~ ۶y66$E0 1 LKn>416 ;wm@`d0@450g2M5$@ !!` I20d@ I $ 2I\a$ @(N 0*wq'FɀdHe,IBBRt3%RHl1G€$$nd 0% ` $L%X F !6$؀%0$I6$$ a0@-@lK2IH6$ٌ`\f#$mc-#.3eKM IB$0$4H``0.]WKB$!IBd0 $63/\7jSvlnmH9`` @ ~`0@  y$X#_ng.Z1H7' Q@ l0B$`c;"Zk9(B0 x&l s?aE `c`MEQkRJ%"}?qSD ##@Pء2o{S糙DQD(6 ` y&gWHHHdmB 3y`  !2!!@O $ `2cs$0x 1X~dd6m۶ym<,$$$ x6syg2I .\a`0-ɘg0 ` 6C @ ɼ0BsHHHLm+l`ygg̿g2dI "@ 0`m,9e۶!vl=`)xn~F<xn0HH\fdHasjy4B-S`+$g:b1__<DŹG-QƮ+5$#e ,0KƉv0&<3a@`[`smIIm d lle Hؖd$lKlA q1%$@qA`+lx$0 0$$q  @$6WȘ ay&X!`,2`2WI2 gχ@$I` HH!@ L0X$x~s1@< +B366۶1!`L9@y lijضmxl @<7+llL`0`@ Lȶm۶ms +msm^8 eB2`0F<0d$<$q@%""JD-z9I8qpb}ttxpXJ1$Qb@6 $ H<_s3`۶ 3 @٦al. 6dfP<Molwhͤ0@ lL걯SOt(4$H$mۀm$@ F,m0 HlmmILOض $IL;N;6eCq\?{DJ)٦!$b6Z!A Fdg?o3 $ m$I!!d0X$lKLy&K0`dۀmXgdsәN$@a۶ml'`,26\fg@ `dt+le"$!$IH2O:6Nlclhlf;3ÃEQT @ 6 06$0 @plT60d0 @`b$B<`l0XmRJ=g0iwjͶm !@f>9kAXv@@ ,]_k,jy ,2!~  q?c۶€2 Qk)T"B!u]wT`0$)4躾 @B!!!< 2gxL @$xI\!!@H B$$!y^m @ 66#gbl FB IK$6ms!!q$I<@+$$.$gx.66ٶmc۶mE ̀es\! dd% <_c, $@s3,Iy@<gms !|IH<`ſOOBB۶y6!!eB ض ` -xNE% X`c066c_ms0$c s1eF ` H0 L dʋ49Pf qoF'^beB2Bu}PfapZ0`$XX`@#0`g!Bx&#I )@!BơXNT0H8Zk2j !L@؀%6` cLYlKlHO$$@`s%@<lL .3 m72Ɇ 97M$L@zy @ 1d XFg sBI@qX Pg8)@1df?a0 1&!O.we6oA#D"0` #!/9iwDl#m2{EmNlK$2c!ے$0 c@`# B–% lK2-dX) 45CfΝoàņm# !ƒH`K%g2-l{ǝc.x0 'Vb> 1dm)ƒlc 1Fv$@a lc,a̶$ءH[l a m 2"lK%a lLb.1LI l qfJLm$ٶL!c@mDff$ؒlgKBgv| !Ȁ$dlF6hlER@L$$0 @6BXle G)7c! d# a 2F,x , ^ls4 $ Xlnz*$ LUKUgJ`# #lD as? ɀAI`Ha @@ Hlmy7K$lPͭEt6@Y .KwG)*"l@ˣUNy 6B`I By 1$$2[kԲM-33v:!!$ I2Ic, `Șg1B`0Wml2 $<@ I```X@W #'  lm۶sg1"!!vs'{=1oou7-vn}W't#WH `06H bll06 H ,Yc,666ϟ@HB ^d湈g`02y&x@,ƶms`̳cccg2HH\&` ̶m`g@\!xclۖx@ l6$f@ I$yL@ ųg1χ@`x! ۶A<1` l2s?@ #"I  KWHH ƶm0&ZKD?a9{ G;;pְ^-W c 6}.]z$yN cB⹘gcQqW֚m;4MS~~]Qg0!e3@  y&a,I<1A<0$E q\nlg$ ؞o.J?6H $Kͥ/wzjݪB`Di/~ w `&q],ag @H66 # H6`g` l ڬ%K㰚綑!c.H< `gclۘZ}gozt17r=x2(P[D$ @B<$@6mI` $ 66D Lg `.KDY$qm6c.3\a@!cy6I%K\a$0ϗ3,L2cnDi_޾J- H8Zj)\7(680pkN#k7=KE x6$Y @c@$B<L \Y ؀ 9ⅳ3<0 qyN "a!B1& `y6cFYlF6d3 ĿF$A<asp@y6 ɼ 0Ha,L6 ۿz.R1!'!)48Nm$f[Ӹ>y__ݟTDL`#   <0g1g<0 ζm2˽KRgB$QJ].# Z4H`` #&*˗|=wQS6AS, 3[ːΖR%2 d.BO\&x@2}{E8 Aa@HB36a^ d#*f]f p)e^BX <A0Wd  @ q?WH@Onɗ^dXmZ$eP(ZKOo⯗.(fl 2 By\!q?Imx&$F~晄BL` @`,lsW  $1% ls0WH 6H@<Wc$ 2@`I2$0~@@ \$mx&s$ @6YgBO\f+d.Hc`A2 +$\!q3B`.3Hl ex&\& dL1Y``s0A1 yyN6d@ @<1dd !Eg Ig1 lB<&qg`cF m0`0/1ͳ09 g \f<€A1d#qm. !a,`e$q?< c#܌1@ .` a@d!91M<` <W<ij3O` `.0 66m$I\!@ $T6C=ǾcoSgN/6dawwO~y;(d0 0l` l'L}𒯹q<\4 r"F`lLcmD9<:|=G?q[a cE`J-g2I $I~@meyI1Fd 0B. ZޙmM`$,bl,Fl,6D)00&lI<s?c $0  WH`0@ Ź{_㧮y#ru.67ΔDD<<;.(s l$l36 <l6s?I@1  6fijc@ @@2 @2 ;RQEض y $s?`#@`@<aK` eBu\gido,.N!0V?ܿuh\O 6 .@Iհz7:Sq)J0/ $g$ l W$@6B3 $.0 a.alcf۶ m2 X )k}k(He20X`g2A`Ҳ9~tf6+ "m!  cL$I$X %l#IA $ۀ!$6$1pIc m my&I$e,8*1F)$[M/]ee ؀lc4B"MDw|+kpnR 0@l8en'@efHc@m$@B@<$۶qm2Wض$qqfk! ۔(aMD)-V մZC H0$-dc 0W! mdL3~wު+4MQ  `c.s0"mql$~˶-J'`,$Rض Lm0$ F8Hm'`F`$`I @a8lLI ƶ%ٶe6ZlS#eƱ'[۞򄿁I]D dgfff:qX>[[Ǐpo{3k&0`$lKr, aKCcǗGGS?#G"xc X6m6Y زM0F<$dl `e ql`Yd y^F |l_l C뻒iA"@X Nҹ}_ʵpbd"Jil@\VKٿt @c$$ @g3fs6I128!!: $ۀ1n $aL<!0@!  $.y& ͶB `c3 $ ۀeB@AH Hy&܌y&xIm01"<6b@A\f+lx.6 gB2c0$03$y&sWqͳ`$6` a$  @ g Bd0g<q-01 0d 0 < +@gg@6WH 0@X HQ I l2F$< IgdM\& $@ EBBO\&\$$/2L&/oڋ,S #NgfffK6 RHe\]wL 6mIFK\a[N xj;;8bVg 0$@HHn45PX B\&@B\&$@<@O`EHBI@g ![M>7uøV",$@& 72/}}A:l<9Vj5$I(*^:͊@ $y6@< $+$ Lij $`gcc1FB d0X y@@$x&L@W$&BBBB l I $$$L B<@ @HH  x~@<˄B  @I\!!!!$@!!  +$$@W3 BA@ @\!!#3AO& l.WH!!`q?BHHI\a+$@yI e~$W+ a3 x^$g3@ ܄@B <$  @2 2$g2L q? q؈3X\!c$6dH<l!a\!q$.Fm#$m  cHy \aL2!d B ! g@s0- `$s <ؖ3 3dBA\a@lH2\aL9 !<``Hsf\8ZN]s3ݳP$HIlZJʖZ&mEx6 \& H22 y&c0qaG񃋗lKlllKvH@`'- Ajwlj!9qm$4,dVW|k^wݩV򎻗;wM+G!ٶ3M1*B8o}⫾+ZkmKmH[$dls Xȶ$۶%Imc,HΔضl;PKllc$9eBƶLRض 8d ` \a4JZmIӖv8 d$TMm68 7x/o|ۺ]kSҲ)54 &T0(aXVݼLN01-d4ٶm H8h24aiJn|$Ҭ|K@<]y5m˕d  qx `a`!a@#ABj9u˽ ze`1cdNģ{@yL@0d .i! @6`\aIg2`@L3 c 36 l6 @9X<I`` F0\ax& @ cI<6HF\&0@2I`lHe H 3+x&, FB c?q?<1&qI2\aL0eH l S%F@%mIv``:m@` sL)٦+io)s1 B!͍R&փ \fs?cIYlE ˄6 XȒC-/:ϔsw1-=,m !c0H$̤Lnv0E頁 H$fng6K d!@Բ^sPHF2`0@\!.A1`X< 0Wc,L,F2$@ <$|$q IB\!.3@`I !e9e0"@ M1+3Y<'񉻟?{,ji ɖfQ~߻}iR21Lͳ؀ $l4 HJl#mKJFH8m[N<3%9SA1 mcI m HI--ɶmKvdd& 6-)M Xi`Ztl{;؏au:SPFh =6$c4,Nm``H60vl @ŋ'NL8ͺͭp ,l%4Ma#a`$.dIl$ ۀA\f#A` ,RX"mjo~z\sbLB$Y:5o~8 $!`,0 GG ` A$3  $`ad 2aA$ 0!66#qy^0F,6ls3Y\a<1WX`x.6d@Y  @3@2I\f\a F3llx g2WHqm@"d K\& qBH2c.`eHsFv}B04AKt͙]_5ꃻ(T,բ`jڢna/oK߸xX= $lL@HF-__y|ϝ?umc @8m#˒dؖl#$LI̶1i6 1H`;Ad0Ki4H 1-mmLE;lpZmlX Lg:=6qxof3HJŠӲ[to*ޫ}Xwg~wE46T&4 \fۀ `̳Ӷ[ے 9KZ!Fm45#a! l30ge F l19>݋g3cWMŶd H B7/=}ڰ aDf$0$l)J3׊* C`F``6 l!H<0`$/ #I<`HZvlKinEiAq`dO~G#8 4OQ$ cs`ƒ1)Ø~bR2*Nq 8d)Fq%amcƀ2 I%~̶$ 6 llMǏ0 A , 8]g;m_{JRCR WLΦn1IODMoyw@dmR߽ګ෿}:6`# @, LNKaN3i Ny&ml  `@`mc `06Hrk$lc,Ll`66mKl[ml)S|wnFSHRyp?/MV l1_Wz^o/^w)=5H4i" mNi@8im$PkMa޻wtx^Uf 03q4ZWGGmF2  l9X0H0 La@26kݙcX$0F6 ӽG.ldK gmD(I kӤ8` ! <eL؀X\a#e ,0 a2$0̿<-ƀeW 029yn_`I~A`2$x 6I 6Wˌe<@$6 B/0e62ME9sW`L<W<3f36gx1g3!\a$6dg H  yqe H< 0Iq1F `! XX#2FHe0 `?sxnIO\!@ qm۶y @B~BXˌmc@ ^ƶyq$g۶m^s?ض6"@Wf$I_=O b7 L݆jgOVVv-(vv/~Q& ~ad˖ݹn{7|^ln;-mli`0lc +Fi!!<$$ ` i - 6`m2!IƀmK BIas$0Xl#$ Iigg瞻o7% j"&;kY}?^6c vi5aZ)E"'Mct:Ӷmceg 6̖i (HRuy|S=mU(@1nZ8fkvm\: B ̳+$ @ a ,FF V@MO_ba:ZR/^XZ+̶mmIt6frœwI+ԋclllcCB oͶ3`0(:Z@@ Y2 # ddd cc6X<`cclax#@6@@0l!l0ضmij@ijmij<\!dccc0x&l l2da0W,H<0@ q@ xA$$$! cl̳ \a۶m0ccs`0ض`$$@\!!@HHY$m g1`221ˌ066 d`-y6#`#`0%,c0d@ l dd@ , 21lٲ`cc 0& BB2؀$' 6A 3Y/$. - A1#%+ ,c'lۖ ass\f$l`B , l0@`I\f AC_mBhnd[QTOiruڡrŞ"m n/|ۻ Xt(e?>s/X d$,1I@fJ dL`Im  lsY`[RB1`[ \fɶ̀lH `$0v2elm+;$'$!v}[6P[[?}e[6ӻYMZqya4Il09f"d¤6i 3 Fl$NƕRULqqf'EHrpoiF`$@d3Y!~  c.)(Su]a,2!ۀX[4(2 0F٢RZkBLv)m}tq6&qb;g Dt + ` 63€dIs-3g1sc0$qA``LlI6WH\& ls m2!I湈g2I#@B<6HB6@ qm.0<g2`$K 6$- 2!-I`B2!.3\fx.6E2! c\&\a$0 lI<@< 6  xn9d`X < $H+$s$ l cXB09IO و3  0$@y&B<c F+$g1 0H< g sm@ ca9I2t^+%Y l!lX%r븎.fth x&AgٚӀl[^QݬBB]Wkׅd[d$(Bo/Wؘ+,IdH`~B`@Yg<0Xm \f  2B+$ g2$$$y&qs0d0$l@< \ Bd0$s?L2`s`'0B1B1NA8%RJ6l|j;*|.=!/me i#زJ[έ?_O=7)" 068enk}kky]$ۀ$cv4H¤$Iۀm$% L2@ 66%ml ٶm1BLKX`pZ3!l)IRr_բL˴slX**AۿoyiGAz:1;疉m,Mmq&mHB8eљX6"da [1Y`۞N(j x&ـ3 c`,Ȁ @d(_r|jYd  3_40"l 0mMmlj4@꺮*!F$a$  PB//Ai @<I ؈$m@<1BA\&F$6`y 6ـ%$H` #B`' 0O@$X`2y6@s6$d6$M`AH<'@~_b`qH`x 慓  A3 A2I2 02s?s0 ` ,0`  3 cx6x#MȘF\!l9BO3gyFx0<dL\&Hg $!qI$  s666$6E!!@Hs?c0$ IBm۶ml,lll'I`,I$IHg@\&$`0g$ `m I@lmc6 q@ @la00`0ؖ%K!I$y^IHHm۶-#I/y^9` `.33` c@̳H` Ȓx6#`a  .B $,ٶ ضmg1`ll3 - b0\!!0m۶y6$3 ♄m؀A @8W<)ΐt4\zza$5R l4 kIx&`;ә؀3 #lB!ʢ,arkRJBD @O]VBd He 03 eB@ cdˮ٩+Ã]r]Gr8y6 I>~PϞll`GF7}g[\a|1LiEl;i @$$dvNã#{WMr%$<@ ^0!IBB\!,YmI\!!$@d۶mccI<$m`l[FF0$!3 `H  g1la` @ Wm%/ d5 YH\&[,$cq$4M1jW`$  4#Y ue޿(z,nHa$e(ꑯuŷ*ܭ!a m0㘵(¶$ۀ$c$6mI ض$. -6 XL6L W}w/$LeƤ*?]}CxL/|d-L l 0`$ PHG A;?ܛ1dRAsK={lm1mmlm$)6 ɶm 2@$A&-aLlK؀Adl02-iv`Imsm ~NmI%٭iC-Rn |/qql::R ZJi{wh-jf 8[!_QrKf}g3 mllsmIl8zl`Hu'/[ʧݝԃU3Ja =9[7^z   b! e#a0ȈȀL7=ӪKcQU-#d,  0Y]?ۻAB`e^ll`l H ԦS'mmgKaJ!2BI N4vvwn"e2q?a  ` 02dW<c!Ims1  xy&L 3 ~%I~q?c$-@ qlij+$00I0sA l`@⹙gWH2f  @\&0 6I\&q?$6dW6W gBm0$@`!.I62dH<'g2$ 6$ LWȘg2`00&I\!H<bg9 @<`! $ly& @ϒ\f 0$q 3+d!B9 $0` 0`PQtH\&$L dK$ 0HGmI<@HHH 6EB !!!3I9Ƿ۹#:r,"]m`l 6cd\f+d\:;-eT `2 !Gj?c2/2wuw)Nvl 6`F¶m$ۀe%\fNcm m+2AδF6 almcA`l#6-lm۶dNVȶm{kiO{ȩI6?f;&EN>&$%ҥAdbX.kBZC0d2cIli- Hf'}z?nʣ$[eoz%Z:6ŋ(P`@` @ 0d $ˌd@"YYyG_.: `!c9 foYjQ;H ɀ 77AH @!Bb6uwvMfb R BQB II8Lۛڿny|GHi$}l=-%26BB!RH  x& @H x6xIg ! 2˘ !x$^0Iegϗ$.A<$I}c>ʱ 熮+!1ȉmS92?ŋPaW!p~>ϴ$B@r}A0llllviδ4__X& itv]l:RI0 @""B r┛0F0F~6l666 `0BWs2ˌ1g1E$!˖mHHx6~`I K,,!YB0g$Iyym!!'$I0``0 `mL  ,BBxq`66$.$$$I s03/`03,!I$ 0g20   ,YBx6s 6yL1 #Km @<'# cزe gLH  @2\a0@ <@B1Wys$$2s?< c0@(:$$I @\!BB#$0 !0$ g~!!c 6I,#H\&g2$I x$6 \fBs`@9HB@#0M$I\!!$,Fx$%I@q$FdB! X<@sԉbsVH!$!I #T걯|x$ΧzQ0 M$ I*nbs͌IB"] Ԇ` A{t#nyjnMBL߸׿qmH`qBE  $gsj9؀3 L`` B\"Ki5Z#Z66=_/7Bl1B?F!@ !H dXc^_i QPWvQ{~ƏϽ˿cb)I I Hl $H$0gA` Hm60c$a[  ̴l̀4I^~G~d\-UB!EB^oyKNDx}ALl91$TzuZƯ* 0`lll$I BHE8dklO-*n :GDNhM1)O,Q3L$m%09H $&@ B2sB"vvʻC&{_{ozV;KtVl,0 BB@HHB AFBH6uqf۠l0`d0OD?AQ `cI9I `l[a3ٖ"FI+ %$S,ض Ci@؉٦i(a6%6wǽO-RA[]l!l@(r P_e4:qBh0@ HP5r.__7vƝw+! c>y<~G=7̅F B $$c (H$0fq.b#s?Ica0f0ؙzӟq onmAE|vMuiuH8KWo~__~α2%S0MSUkwr5_wvm $$I@  !q@`! @A  @$$L2I $@@  ,I<7q@ M  0sx 9$@@>wނ8yL;[-) ޥpxS*֘'+IA [F 2 $ !@HA$ IWɒ% ~ [^rϝbaB<1HHJįyt:y"m BHazjϜmw[p K$3 @Ba#L2 `$IHB (mqm?!cwe~3U@ $@\a`>qM<~'?W/ s?!R/t $! $ƵV̳ 6` `@ƀy& CFTtoi*QR$|~-:wJ|^i2 m۶MbA[qN:uCt=垢Fax& @ $ q$gfBL@ B<I\&L@€ϟxe0I @H@<@H6MB0d̳ 0@ 3IHHHHH?rKSB`3 |mij c$ %@ 10]uAcjחTU3-YB`H6BSQ}퍳K~m $2WXH`[醑$L~{q׭)F2d0 0K0B2w7~5롨"@B*1 S++R׫uk 6ض$;`h9Ưۿ[{Q̰$ 6x!mIL6WH慱B2I< "y ` B\aM@`6H a # ,q-q3g@@lI\f\!q#+ x&I$ey+$.-g3O`<3y&ij$lgI +s0x. g2y&+$l`@YeW\!q l'0B~,! X 0x +l$@<a!Bq?#aH $,\f q3$3 dsm0X<\a9< qy&|X@`6 ,lM< &`@B6dMm.36@6,l 0A``' H~,b!$PfnnmfmlFL?.=zʵlK2H B clI?|/~R .də9M ,0 mIۀ i YJaIk!JxnK_/{tS~k^3"Z/:lG# uƸI] ;!`0c@6  X@Ž 9"OIo[Z6B6A0F AZ'~?n|s=4 $m@mc,2 Hے,ml NIƶ$ 36lI cl۶$Nm.";@EJd6qMNS !$! -7ʝw6?A|g򗏫?ih$0)r֏7G]W~4bl5|qv6vv6}ILK$a06 8(qkNL I`.3fynx&Kl@`6%Rm>ح}Ó cO*$dX!ۀf@B 2$\!$ @,6$q1/mIX\& "ž6xW{8@cD8m')"BN;33)Fȉ汫DY!?~oBs2~qLB< ae}t<\nKȶm)Zk[vvui3g7~|-l 0KH[`Lbz|xo|í  ۀ,6M*m`m,d[d- p +i\ol-^=ӳ͍E6i0/ek"#HEJ:S.\>=b$6,  ~N! 6`;4 `dҕq'E:2d FeFBDF/~;ŋ 2` a[RۂtFHl6`m6Ȁgi6`lDq&ض mi-[&iZnlgfH#;%@c[f_p6`lI HWe:Y~^s>=/O>~rK3_/_:ŋ>X2fq6f.5Na,%a@dR\p#t`0A\&3 2c,0%,0񼤔@N-1;̕.GEI[8-)$mB(fG%e-tZ6iIB9ߜ4*zls0H`+d!@`XHQ?|7|ǏWkE11 Ni۶B EDffLGR e=LE ` 66$`˄m\!qy&\x& a H`B♌!0gA0x+x&!gL `$!XLg1F +$0cI2!̀yf3 ' l@ijHl+$Y6Ȁ e6$2\!q?I`[<< @Y``IB`+$A<'q ldg0W+lH~ 0s , 00FA2sW` T\ay$|9gWl`0F< #™g2BƘg$@0m0K<<\A@BKy H ` 0ij+ yn$@q0&0@<$c 0$ l@6 aȀ  @< H` `A1 g2  s?#B`xq?q1Ay I62L$<|d 0 g1ȀA\ BO  <"^^ɢ9Qvs+(3glcQJ1iRA$Q"66n$%0$0dsy&ͅoa%av4mlm]sl$[0/<.r CM2H$!1d2kWv^/{Q1vw2 !B#,(--_>Unxԉ\`S,TG4Hŵ#v^* -Ya%.6WH؀% B%4t߽~/Ia120qAX&1L.~>~˷~}gZ%H 6[AA$H#aNslH[ $  %l#p 03)3m#!llDD@ $y'䄍 ) S'c}ۥK,f~^: ^OMˑ)'IW2' cAQ#d;R fX< `I0@g ,TG։Z6{L $0,@-0&OkgcXT` pn@JRK:<0smZCn}ngl&\)HD!Ljxkcu1+,<1g`L#0 ei:j.m0ݲvus{{}Dcƀ)QQȯ/1-׭%Bc @ FL47y~ⳟd A<'Rll$F`pKD\&R(#ٶϿ1yxq:wPE)Y2ID )D*zyW;~(K)6 Xma#K؀l!$cHHd-s{}F)S  B`s1&c`~ǯ/Ͻ;3"㴐1 d-)+ZKE8-ɶ 66Ӏ6 @ LBLLI-t(se۶m4I$4M2vڂ2S1V'4[iCΫDN02XA@m@Bޜp!sD1i+,@6S4G6Xp8=ٜ 6l Ir$ƉYG\&I\ .X ~`["Z+;z~yW;wn5#dcB!5vݥw~ijg3Rf9-FFppZ)zy&$؀` @0$+$#҆w^u_Հ¶md: 9j|]RcN[nAvNR Ie5 xG>Ob'晄e0 @Xm 1$.ϗ0eB9+̳  3 qAK @ !y& <3 # `1sWpΥ4m$ 2 0QB@$ɀd$3@бc]+W(Vc*jQ#JTJ%z${t>4Cm^S-c 6X q `#!s0@eIȏy;ζ2B2IB`.3"(??>Fo;=" $ H0`#0LI`$lsmؐ6 2l۶ mlSf3FdZH60=OUnR1K?rFV I B[@BB2FHZ̑IHH`ҴƔ4%j Ǐq)1X (ESޡ ,wv;KG`+)I !BB!a$2,q$#!d!I)W|/۫eg,$ d#ek?_3ɀ,A9ڴ H2FB\QBwޝH`0`xijIHH♄H$#mۮn6Z c\ {Jd0VG{_馛f̠B|9{]d3 @$2 cHH%@p$y!!@HH\!@ Id ͼ` E E l9@ !C$K < WH B\!3 B_CHG$e/ $I  ,@ $@@ Hd.3H @BBBx6l@@`<@<H2I<@gL !BL3I1A\&'!!'!3 qHeyH$!̳  $IB0@q$ X B!$$ s?s0 q$-gBx6 s? !I@+$$$KHI /I1ijY$L$ @Be \!q$ FHYlx.6!lLH$!I q$IlMsB2I IBY$x$\3 $ x&!$I$I 0&@ !@WX9IHH !!I$I@ `$ <7I$,6WH</L$!Y HHx6L !! _Hنg/6 #Z`}*5B%K9Sל̴$ Bhsc ad3+$$q0 H0H Ӱޮ$ d&iT$HBBDv]Ghh7!Hز1+4g2=7/PA@y&a.4R0H"SB*P7|7pfd5e[mNOKݿKNEC"!1 %<e%l` @6i'/`Ӗ(@@ȀH1`p%BV///Rv/u]@`-Fd&c,aim\alPN1&1a64HL64Ӷm g$m7~wg(Eڤ+nͷx!-3B !gnl:S yI$ l !d,0$@FB` `y& +$@\aI ,$I$`$!9I$IBq$$I@$!!!IB2$I !!$IHHHHK2I$<$!,#ijH y. $Iij\!a$ 0l WHsW\!@ $!Yg$eB0`@€%$d$$9I ! e $+ cx& $$a2!!1 $ BH$IH @BHB$!!!IH\&!! s$yAml0@m#s61g26# a♄@ mIHH "l۶6"#K 6I<-[m۶ymc.3 l۶3$H2I `HHH϶mc @ x^L&6b! F<۶F !$m۶y +ĿHB 666ضm۶m\@q`HHcI ,+ ccc$/ @B xll+$I2+l۶ c0  /IgH@,xMrmc roXdF:0a$Im7mJ)F-Ln}}'49mml^ @l ,ey&0pgg}/l۶[RRR#.&T{OWϞ>w.B` m 4##Iproq,M #` ~Bpk$I$qgGP%$nywyݥJZ뻇{duǯ F;Rݖù -( 8`1260lll3!,!!x 4i2Qؗ}_N4f2@RJˌ 6@FkFu!{=8~lje6W\X`ƶB6S6I@m,l-)3qض[lmgff6tS! l# xH0$J B!!2 @";>m^Q*YԠIml1d'l !IB`$B$ (-@uI5@\!H\!`c0b,@"6Ƙ!vύT0"mI\g/_߾T4&L 0_lZ36 (;<.<s`@`@~6@H`vJuiEIv"277mj-L]M5Pe=٬)y e0dx.eBB$I$I`cH$Id@ !IYll$0e0+d`b0g`0ؼ`$`cc@ y&s$ I$I gI!$I$Ix&g2bcc\ijɲy&lc6 L$6W666$Iy&[ $I @ g1f0b0dccs?I0 YBq,eBB$y$! sll@B`0EB9 $I `!! Ib0llll06cc@Hll`\f03Sלn0+2=wsQ-[v-I );n}6"m[mL#DBBcc`0/$$M +$$.@l#c 6ؙ({WGYMӄH ]Jl;SȖ 钖T7~ͷ*5#lc2m4l1xaxf)sB aH c$8gD(KZ>GQu{xuIŗjRULXƀ%$v8BN H841`d L08әm[󙲕Y`261#.MKFK9]zG|ǟ>yJDn-mZKۙiLqd:3 iH-LP:[mn 6[6Dk Hgf 05l&3Zk4vk ptZ`Zca&,L6+6BXM ##Kr;[9'cs3J jzm.8}[mLgS69 8@! LlllHKGPXL5 !#  @xa0  d)#dx7>u{T#b,!`mBe.6ܽŐJqDJHalc`` [pp\ ى` @O Id l i2~uXm٬Ӟ[SL55]$w>.}&M3]c8!E 6W\&O$I<6p:؈ 6#ee$0a0#g \f2  Xض X¶liI8q ֲ:7û%oV0ZB!@  TDH")/KbFl L;Ķ3m;3i)%4(e{ZL총Nc`ccl0l`0Yi llaX`2I l#6qZ\ap2^!> a3$ el,-Kkњ-=.\~Zff2mۆmligf:l2[6333[6۶mn-3mm6&33;Lvl-ANgfktq̴mg:m۶mgK[k4mrJ)$ IB`HowQlƍl`l'm06B ,I\&a6`lic[222`d@-4l@ 1 䴍,kkB9Y0X`06 1ؘs?X2HHAH~w9sFKOoYj$L@[5,ÿb&Tfd(l00-s>ѡ" X  F2YB2ˆgg3"!a@HBvvv3 OAB@"vfZ[65l`\fce @Bqd.Hij $+$$I $d0 YdasHij ,0lH ` 66/@ `0 F .3W+ls`$BBFW E"O$!I$y&ccccH<'H &mc I@x l-5 ~6!!ll6Wll۶m`cHH<'H\!g0q$+6` $`x.666 g1Wضm" `0̶m<@ G ~mYl̶mc 慑B<7ccce<B yBB266 23`06!IBB~B}F谔(ъZIx&g %$۶mٌgedelitffڙ-vڙNm,[!imp:BlmC˴ )mcgKۭ45Ҷl2Z4pffdtff٦Ωac.6 +B$lvltK2mccd %mۖ$6`l@Ϥm12a@iV&ٜI3iZbva=pp|t_9 EbI+ll02I pmX?{Qޥu#$ @ ` )7ǵ7v{QaBOaPtaN̶! c\al0d2a0&m6$$NAil;vfK{Fl9ўpÉ`'O̖fg}xp x`@s3d6`0lcIXB+ L@ 2 F²ecH\&!!"!266666$I`dd @ 6666666$I$\&$$@ cccc0 c`0`0g2"I$HH$I2<% @BBB~YHH,Y2ga@\f1$ ` IBB$H !Im0&`dd!!@02g1̳I$q@@<$I<l, IBBcc`g2  2I@1 @B \!ijؘ+mcc۶m0 m`0$0el۶mc$ %KH HHex6<7acc˖`06$ccmllm,Yl^cc̳ @\!gs?۶mضm6d0ٶmc6y`ccc0`@۶mcccg266[6F Wgd1W m۶y&#+0m0`0 #Ȁ$I ?al<@  @ 266qc6I c۶@ mcc.H 2226ƶ cq?lƖ#$AH$0d0"!!dٲ1’eC\!I$`E$!q1I$I\!c0ac`P <'@0}AL۫[n>}mN+#c@$IRD>G?r=@RD?w` FH$a0 ml-$I 6Hij00FG{j%a%lN9wN H˄E)Ow't؉%eҶHH`c۶Lq kJf3e```y8qzIDkjstfvb62$B `FHض llal[F\f 0l  eIl)~Bj͑۶\&I IH 0i'4Jdծb-Nt4 ;mv:[gfҙvd;6&[23mM˴-efڴ2mef& p3gbgLKgPki$IH$^ ҭeLeLllvZBA$! ! pڀ V&6L$٤L&5TkVkش$.a~obm#'$̳I  ! ٲ1gm@$\m8{wnyᠧ?wv:cm m9T6Ǎ揟G"JH@ ;F46ٹX!+$3$IW!!̳\!  F 0xtib)N;LgkmLJ=l I $<>яml @ !Iv;{Y~@ !`0`ll ` @BBB`0`$IYlll $$@F m`\$$$MHls?ɒ˄y&yI$!I $$l@$I6L ``CBD?<] p1&3i83m۶[6%& IiDNqHil4d:ضә2[biH3ۙim"$)$IB%$>Va͙6ilAa$023m IB,!$ 6 llLc2q:Ӷm`$ۤiLtkxa|WWypSL`l0XX lLLB $IBB>͎X{ɶ`ظImrԼŅs.>8e LHbsH0.]8{X[`00/Wg$$IH$wbe4c^e_$Y0 YAՙox0 R $` aij`#, $@a666晌0l BBB $qd0X $Im_ClO ؀B I  $Iز6 m晌@ @<@yN$,066y66m۶$m<'Ix&!!!!!a0x&`0!@@ͳ ϟ[ ##yQ,,!@B<d3@g2$ؘBH$ٶmEBBY  ƶm ,l< cIBq,IHH\f۶ [,۶\!!!!!! g"e@€1666湙g2d00BBX3 $+$ϗgsm!IB <'L~~ B!2 0`0~`$$@\!Kضms?܄e$@ I !q$I\!s1y&@ ,BB$IBY@ 106b$q`cc0g2 !I $IY3 g1d̳ BHHBx& d0I06366FBIx&`@32xQg `0M .s$I !!`l$Iy $ $I3 L`$@ 6/wjfmgf^kn98 !SjW}>qz#$EDHRu.^<`,asBOB /s @@ @ \Z.g]-%`QksXԊ ` `Ė3ӗ#w? I!`e6lHHnS+ѝ?~oyڏh"!m6tN#1A*jKnHH I E $Ɩ$vi$ؖ # 0 ض $m6LmۙtnoGnXEdQ,a 0`'$$xSl i2m;әiivefffZm4H'M:[fk-41i;Mڶ[fb2sdLۙLliFdid&;WIBQ7ϻh L۔i10g-i`m$qm#dL2! `!$fF%?=:u˚p! `dqLBB @ @_ehtUxLf7H`@ 2vƍӺgk3-lL0Rcl@6 !  \a,[F &!q$IABH@qXFHZ+ = 9Inz^5_cjmI$"z22GI"`!!2H<5@ $׏;CFFEu` 2 !I`H2 #Il$I0&cAY I`m)2ĩi2VDG B@B\fl$K*JH۶ ؤm,ic06LNgffmmi۶ 6`M-ֲ5 ɖm1m6`[ϣ$G=xmʭ`; 3A  H@6XH3a 2e,H k\aм}{|QKP"KX < a@dقlTܴ^bvp;)iؘLcllcmcl~nx߭J5B$1F PhckKE BBryy&m @HgmXHB@2}; EBQB x7D7oii휎:ү*/j{BTnhnG #"L`ell`l\$$@BBy s$I<@  ۶mc@\a'!q?mllٲ16  @ل@ x \!#3 2cc@Ll.m6/x&@<@ٶ6`6d y&`016d˖mc ! @ Lttxb>뎖`KI [9P`d,'頴}w! B SX`8 GiH0`e&P F)x2NIꎧ !$l2Y, c,X`m$ٖd$L $ llP;^ް_]YvZX8@`X20PfJضdH2%lKtNK )v0dKIL;$; 2m["mi ֦ ;6&m3Kq86`f*R S 66d[8-ImmIF`[I\fH ll! c63`BqZCowt?e!NYmB``Ad2!c@4c?5]wPy%)02l m[` v5ַ}1R-  @vf~6lB1 c{csqiw/F<3g1€A2Y+l0 e6H?n%lD )@Nz~z5R66<Q%-^'<អ7s6\lI<7L@Am @B6$F`x^ lH6/xqA`02aHKB<Y$`$Xe< I~@6ɘ+l.6dB\!d`#[\aI<7<2 ijY\!eg؀Wؼ@s3F<, @yLl2 dg3` lsxnKls@\a`sel\!cX !d Axn$.`0F\! !I6!$!am < H @H26ml BBB L I`۶y6۶3g/ XBB`@F Hy6 &m۶ym al122B@!I’%`@0f01@<0bl  I l6m ƶ`۶mceB̳`2̳XX1m6F %$I`0` €y&##̳ aYFF,,IB$m3۶m۶m"x6@ `$q󒐐 B2 ##-kBA MG<7|攢P"$I&L؁B $$$a$H ux8uѼn{窭ke 0dgl?8}&66`$Lζ Ig}¥P 'Id$$mc,2l@ 3+lAb2[_x㟸%;JPDz=O=躛n8\{-Z[*FuuSxT$B  ۶m, I6󐐐`a0B\!!!I,20m c 0XX @HHs 'e ۶mcc@B`0 ll`m e66lBB9ضmۀ$$$m6 &g2`. b`H x&ssB\!L m۶m -#$m0 ,@ /@ K MW`l  q?̳۶ƀcccdcIHH $$m$ȶmEBBmcc3IHH\f+$.y&$! !0`c $ecs$$ l0`lL XB@ !!$y€`I晌 F!2x/`@\&I$IYll@ Cms󒐐Bۀ$@<`E$I$I !!!I<'cdd$Ix O3IH\!B`2L  yx gl` s?dy ,$I$Isd 0g36 I$Ix$ILy&٤ׇxc!@B8NZz&lLdfNۛvtl [B\f@$'$$,66FH @<@ @ ƶeFB<cc g"ms ʖnp1$D?ۛ} Z`m `1l%!qwwcw5Q #B$IHH65'( b~ѝ^nH+q&mmْ1ml.l6`3mcؤqb[mm0 ml2I)D[X8"H!1`)D`XR_6J!@ !!mll  $I0 6`0``$$'v3vv G)" ijh9Vٚ9vBqVR`ccs?@ BBB``؀`!HB˜06   gB BB l 6$$dɀ3 0`0f0+lIB`0IB~6dB\!I$^m`0qm Ommtp-3[Gvq pe) ij`g6@ d`1`@ P -Il\&ןfJQ-kw˼/Op}gq੩t2l6`06әɗz?as.A @ BBAF{cؽM2Wز` nRKfr@#sI`Fϗm $%$$$06$'ح767J !$! @6-97}gK#$!q@`cll0 !`0dd3ˌ<HHHg$I\&$Bؼ0s$I36$IH<@\f@BB l<  $!!aLy\lllW+y. Sww/p`ȴ `'`0ضӶ$۶mN#Ngfk-4 eԚ3mc,$eK Ie:3@vZ6ض1Vfnc?ӫ7vژWzX2GB  l- 0pZmd[`ƀlI$Fcl#dۀ  !$IP -f8 -WΦ:T\ЎL&OZ9`1X0WH@TdI zrosw+=I BSiK\w_Y\$g.cK2I@ں箻0( $ !!KB @~$IB~$$$IFs?$APzG mmnY]DH%tq}|S`;J$@$IxB @HHbH\!H g ij&ssB2I$q$$$$$'eF\!!!qx&$ < @ e0dII$yn @ecs@@ I`+sIx& IBB HH@2IHH@`!lH q$H $I\&A BB$Ib$ A 0`H```,恌$Mlm Bd,B`M<x&yAlxc`2cxQI\f@\a[$ < 6$.`qdy&$ ,3!ĿD$.%1A 1W+2WXl 0AB2` dI3L,ad#aB<7!L#l FB^Vm#AH` a Q^]NnBQ$+JF`  <$gx& `.  $L# @\&@$$$lV(mrH62/_er?alt6da"ho7z(1hݩ: I$I $%I.M=ϟO1oo3  0>vlU:0`El$$a+H\&d!!!q$0PiXWqrT<L aIY$WHOWH 6&@<@ @3 !!IYx&@<@ !'`$s02$$$$A\& IH@@$x!cE q@ HHHHH 0B  g@ a9 2$d$ g2W3 @ !,@ @`@HHxq0$ '!!!2H y~$a@ !0"q$b#$$ q ˌex!$0$D幙%0 0Ac!l @egAlcI\f@ 0[<0$@♌L 0$<0a9X K$I<x.6 ے0F0Be!^<+l b,@g" 0!a sK<$HO/<  6@l'09g`I`fdI`9I c eeF`,K`|+ 0s+ md !EEp@@`  g0X` ,̘$q--Y6e< CCaZZ >7\wKi8m cӲٖRAH$ag Hm۶3Im۶mPF"Ӷmc+$))ml 3683m˲Vƾ/Goo6,7e!쨴ѷ\WE/MPOC+ l %0@ۀmX`d-da$m@60`a; B`NS:@0\S=hJdOigO?zdff(jWBV-g~)K.:C6,!)Ö4^{wwQ%7A`HF -pf?.{b <30``K02s\&OH eLm,P*m60%0l BH`+$g$e` 0HIyLf.as?!cq H` !q<0eBHe0€\&Am#$6d e`$s$. 0WDy&I+ xF 0e<7Lijb6`@`0/e6d~LI<1W  @d`+l 0,ImB2  A\fFl$A`<0Wg3mHBBBlc 6♄ 266"g۶m q?۶m m۶$ٶm۶m-6#,[ų,Xl ``Im۶l2Bضmq?`0$+$$Im6$@+l۶m6c l666ضm۶mc۶m`l.`csͳHH0alls`cm۶-ؘg@ 06Yl $+$ccI<$^ BB_EBa0@Ba<7¼ cH$I\&@@\!$$H\!!cd$acˀ $!!!  Ld$$3IH<ig͙`@l +$qBB\!@,,Y2 e @\ac0, ll۶yn$lll@ 0V>:RB I$Z` , ,g*>|Sick+ %!m l HZ}|字yk)bTLvbc 0–Mĉn8m86 \&#  mI c@m[dWd @B@H!!`d  2l@ 6 yٲdd166l25%SS8y=rÍQ Acc1q}Sޫe  *YQoG_]mQv/B@`0B@A@P&3ԙMwwK'1ƀ!IllG @+$<{}&6F lHA$a<$!Y06`ca0d 6iIc0񼄸` 慑@s>ڞZlcgff=M&ӭ5LɴD0 3ۭ5Zڙl)meKgfKmۙ tڶ L2eiۙ ؤ j-df~Y?UeZF˒.RDD)U>.P@$ٰmc06l@mcl@6 -a$H`i$l Hi'Ll;-iMq[ nIǶF(f^JQ$B $Afb7[+G46X6,lh<}c;TZN gsgJ !@z=_:< $FH @L FFl$@9 o!Ӕ dpff SilKi.N!3me"lg:ZD沴miٶmI;3iiWXH$ۀDfڌӸX̢ ĿcL"P(fҏ{*f.vm<6ۀ1 l[ vڀ2ؖ# H42malضm$6Rgl8&g\8oJ,a+)%)&P@!ETCuxŷ?'iZǥZ&m0$$`Y2TM7o_;eJ%b "6-# $!K(1/^lIsH 0+$$$d I\fm`Iij @<̶m\ase0`˖yN@\& g22@`a@@HH`I<_ƶ16 f0dl BB !!0$,  lll$$$0 @}%Y6{g!EHl|QBkvk-әtڶme2v[ff̖ #tmg&`l;3m;3ӆl֌l̴ 5)dc;$lId;3im<~b`?/PON$RXX !I<iԴ9 K460[$l;1mlA[d  % 6lm6i$Idlld 9Q uU$pi6O *(DH׼bѴvϯ9ƶ aqَ7~U{iH`ciYi!I #$aqST0a`21#$$$2 `1l m0l0WOB0 6$I\!0χB y.,Ib0d0`$g1l0I@$IBB0`ɒ%#122ls1 +ije L2۶m $!c0X %3 <IBB0gm^ L`9I$$ !`0  s B pVF H@9@ @L<$ d$`  BHL@as`ccvi,}t#7~sIB$՟;{|N2mc! $Xl!0BҖ,i,e6 I @Jqi3g'|Żu&!L@AȊ+D>=tB6i`I`$$< @$X`m6 $60-W a$! M cH6V.5M.A%(~yDu[Ե6Z%N cx&a@!@$vnzģ_ֻLeg39q¤!@Ⲯw$HyN6$$0EdHH  !!s$/BF EϏ$ BȘ < Bq$!E@ %ex x#g`ɼP``0ij d 2#`0lIB`@d0g3M M$Ϗ@-#x6$<$$`066♄ BBBB$!Ey3lll F qͳ  0 Jg{k HH`c'`H H@'?vS;NR"1_Lӕ{.;^w˝HLB(ꋟ8y1OVP$$K\!,mض2ۀ FX l m m vm6 4WlۙNc6 ݕݥ;CQV 1[;;& e 8w|[/Q\fL$`ccL@$IB`c2@ $,666IB!Iل˜069I$,1cs6I<<`cBB qsg1l0g3E M I66d0LB AHgO $I<ͳB $IyH$g1@HHHBBB~c 66 s0 `ll06 ` ,Y0 s0EF\!`y6ۼ$I$$@b q0g@@ $IY̳<@X2+B2ll',l0-[3 e0Fcƶ BB!I $+F B2ƶm,Y$IHecll۶m% %sB,Y6A66g!+HHH`I $$۶m el۶,m$I 0m`(2S # $IETD=o1޸eѦe!J0Wp)H»Q&ŴGHBBBB@F$F Il6XB6`@F L6@H\!$! ɶ cۀal Hc;,Xjoӓx%WIY2#6l}=uh=8Ig"f, l 8mDfZmtB3V7'dt %dǎ}__%2%y7;671!M>6`!m0FB1 l# 1HBdq?`d dd dM .m[BXB K9BEp):5ckX7j)D@@@(?tqpPI4imvBL'Zk妇/u )%AHH`!~>w`Ȓ|ΟG0F HH$$g۶e۶ ijHH eBB`m`22222۶y ˄x6se m\a'g$#cc  <'&!.3lm666F f0$IB ,m۶@Bg !s? L<@ @\!$ d0" x&q?I ɒ%I♄ضmcc<!H\!llccc#@la sl<B`06m /@Haa66 $̳9,Yd`۶m26 b,nvv@HH $9d)Cnxyh_6u= `ad#a@€Mm!m۶ m;@#$AB@6Bm6l,@NgvCt;;H(եp]oĸf'I [-V{nnlMM-sJvf:m;m 8ZLt;33[6l!%&[:m;[vf˴̖itfn\`g#K(Tn'?Kl%Hd 'nv2tX}Ѝ]6@̶0`dcl944`vcm#lcc&mlm@Nllm`˶ ƒm+vwJ5@ &/]O;:kmmOd)28ect&6j5Ss=G]22W:v,l#e%b8{ϽdO$!B󰄄 `$$ q$I LHc`d0F$$!!`~`$g1f`H`lll'IgL 6WO$+ s-#dKBgH d0`$`1,IHH 06W2q?`0 666f+3I0/Ws #6<7g9J`ŀ$Ia !< @ eB  l@0 !!g%`L Kͳ գYK+JP:nq'GWvvGΖf93)ə%a6ض BP ! @ضm,)`al ƶmm۶$B$N?s||'~ʅ;RMkNg2g-5Myͩ:vKEJV)E!dHHBL a $llD @, 6%ll  %$$IA⾧뵻ʥB BH tiyq8B'6  (%i̓K헿.8 A!D9!! {aw<:PضFgWؘ @66M2#$` !@<2۶@6WH\a̶m`c<`۶mE Bc0dm۶€@$$$ ۶! &!0Wll@ȶmc6`0`mcض c۶m$$$,ضmccc#IضmY $IB 2aa!IB e%$IHcccl0 syN!!!!L@ $2$B`Tcǎ׃$\!ɖ} ` #Yx륲/*/+Y!$I!,$ `3q}Cn'TAB!EqSݖ~$VP%/]a0$@-y& c.$6`@X`dl$ldـ@@#R4MZ@Z[?KGi5 Z6wOe_hFml;m m$ٶm@δ$ 3 66Ӷ$۶Ddf˴`fr:ubZďW~< )5YIIX!Km}<eTCܽ6l[Ɩ$L\f[ƒL dc@"$$F-6@6Ҷe I,jh דB 8Ig)6ƶ!E ԃ|z[)I$!exö1ėݦV#B2 @}djf3 , utڽB$2WH @HKOO$ I\!MI$B\!q$I3IH+qc mHHmfE\lubB!  )P̙}b>볩1 ##&raI@]?[g A6"$H$I $$$l$@6H@H/Im$HBIHH"qB$q\&`Ŀ@kH\&\$ <@g!HH $ggϗBij $E qB$ I@ '0W% $q@ w$ e~ $@<7s3 /l6"06`6W<~cH\& lH\&~$ ,W<  !.30 6 SidMPt}Cڿ:h$16d(toƯxwyy~tz=HR@2"iےdeEf6-Y" 8dMM te{Ɠã Z̶)-[ddal# 2 FHHJ ҄$M}rR62H@i0FRڀl1@ڒH $0F0`c)BcKVk 18A6mb>?W8 ,;ݸn F$!K $PDFr{gT7Hy&a,6Wvf- ֽޛJ6 lHl !- 0B$c@I9% 0 I\f$ l$\$H6  `#Ilg302$y&qA` .6M`00~YdIeWgC< 62a l 0܌LdH22`g2̳gWH\a dI1%@6@ BO\f+eIm.@\!`+l$y&+$eB!  gHcg2E, bM``[` `'+$*LB!.I $$$lBB\!g $dH,"H IBH2IY+!!;  '`@`s?H 9 X @ #03I`dg~ @c$d[$XW$qm0WH l'xNe 0l ~l@<I\& K؀l!l2!"2~010`I@3I?vdX-6Wl#$6JDﮃaYaɤlQ:<ݿ[XoYΨ^_Kn&L`ۀA`d.!c $g6H`m#ɶ l@2 ` #mmB@I_(C3djO*1@ AjG?1/r//zЃO8fz=8vfZ"ӊ1i{Qjf}w6__ϸؙ-A( `0`3g,!! !Nfa2AH@)dF`l$y1I `@P16ti?&$m,d2E*]2)B@Kv("D":oڥ{a.dwvY!a#` Q"nv3n" 1mHu=LQd[d Z}sIlXm}r~MqM`A@DtnQuc2`,0rjc%#j6!lcے0 lA`+l$l c$6ےl$A2ANpZ1 `$$ N'-p2]ڟ^1]Ŵ&a$@ R]"%3[$3 B,dH]?‰L $#˄- , (m9s"|4R:ɶv[/,Z"Id@ ic66 m[RB6 @" QڒlcHT!ˁK>8qrEN 8 ؀0-0 KpRq~7$1lKy<3H6I6ϗ\a؀$@O<'<2$EA0  l1ٌA<$6@~< Hs ܌AY$AH< c!@e< 6H6WHOπ `\f$`  0 @d`H2`$!< 0 @{rY6mlGё a $$˟;{C7^v 22$ػkz) $KX'fbNNSF  A cIB`sH2- alH#0asIcH! IƶA066&]U-^O % *1L>}7zɍ_%2 l$tˬR 6!0Y) 6n6  aF2yn B @ oҳӧps]$Imh 1Vʒ+l#Fim\fec SrpKZ۠"U`"i@tl+_m8en7;d ;/11Ƙ(*23!A2vBS]5 2I*eqdIdzhݫ< " #0 %<@sAec!mKlI\&0`W9 恌e`M`m@d<7G2@ͳx+2χ @ן.w AϘ2a`a@ BXF $#  $a 01@BBr]Q0FkC+ $c6H`$@` 6#2$6 a"JYx.۔R( ̳[KrJ)uz}_ wDA4` $By#ʸbLnIHR2[*5 $$LP{ߴ>T\!@FI~ d$x&d`mģvے3s\l*V|εF !"h#}l_r<\hiZњ֍sZuZ,ft^]G ) d#M&cۀ$`d\f @F g2D 62aH!!9*|Mk[X 0<1` B<WH  2 @<_@` q @FH zmȑq5vۀlq-%cI`Ŷ ؀mH0a,S+-u_!EH8 qCȐ X~RM)*!Ҹ@Fg2 ̪;=57N0[Qg0NolW,,IJԚ7=o Cb,l–Ivnnn]pi8#z0g1L@6`g@ 1+s32e$! " Al e@ .1/< l @@e`  @6WH<0` I\fIx&c.3F+lsAg1B`<`# ؀%$ q?sW&g2H<_6WH\&al.3,6 $l daDO`l$.H"6`qy&' e6f2q 6y&$l`s%@ ,6 d[€H6f 2s خH~  FlI,`^ < 2A01W\!\,$ B\&d B$$.3 030< 9H_%K ipkh=7 `#!BJEc~Ywa:2-$TlqpiA)*A f3$2D'6<%a6JlK$cIX  ci,tAi%`IHF*Eټ}bISX'lce6<c,XHX\ad@ H\&0$0W0gĩm5{ˍSk mN2&A- liHۀ$a[!EK=Rh4B' $&@kyL}{.ߛR̴1BmAr}VK"J:%6!5Xl65Bo=ϗwEN $lwL0`$Bdb>{߽y$c  H B XFc?|go`-\)S dbcc,a!$$q8\#"Z Uu(d` lEI$ A6$ BKI0B6 ȀmzP0 HBl#a$Bs3#1@- d`x&I2 A\ac@@2f6+7aluӭM6AH6d[F\!00PBSoTI2@Z l'c'_#ZBAeb L F&l`Vwyt֭ ɶF`9Sӧ./}h=sN $.1`qc;Lm$1`Z~~Ӟ6@ a1~@39D`!`$@#0B\!  $< !aY\&!?,  $ ` `EF  < , g1d/2g,<1B$@60 3l 0` 2_M`^@x ˌLlL0` + A<' 6 q`!I6A\&.L6`I-aKe[kr a 0`6-n;=>1xn⒙dc[sgEmҨ@px~cA9}r(a-ɴml,!c AX$Dab=# ,ZlvJD0H`̳  c`I\! cd`aclc;M):I>Lbl(x&;|$a;76v޶^=6 `@a[ l  ,B cg3 dA a0 s6 l؀eH<Ax Ll @2<qy&\lgL+,@A<0~ 2xA $@1xI\f+3 # "qmȀy @A YBy L0`+sy+ѭm&TiImɶl@0`E`NA2 1 [@Nl! IF\&HDUL aF A` l$g ad6dd ȲLplxwɔn>lٚ`L6 l$ $j}hG m#y $72`D64o-_b;-6AZ`qLړغ~vK̶OErXDE@!6!4a#˔>VOt;?}cts<ڂH1B ml.  d.сeB+3YX$s2B e6d3 K`!q$l0\!aB @< e6l♄0BlL9` , @ll@6<  0` #M<7!e@\&`l0b I6 0`  ec H1Y`l x6 x d& @@y6 a!x2q? q1Eh`Fl$a0 .dF `lqm%I3 @\alXH@0  q\a$K 2 @0@`l$l',!!$ $\@\&$H!s?!@, &I9+$IH\!!E\!ELHBY$&xd@`se$I g@$0E$I<I2!I$$\ly&@\&IH$HF\&.$$ij6 xn$ ˄B<$3 0WH @B@# dI`@)t"w y&"dyoE~׷79Kh"m0BBBBAAB Zlc7/ =LkpEY$$&8AopCŸ^MB  mHB0i8w] I`$@!d3I`@1$@X  Wg !!! $ HIBH<_$!!!!!3I,$^I$$g2 $@ `@<$'LB@\& ,!!@!f@Y BY$ B @+@B\!I$$I d@$d$$$$#"s!.W&@ H @3I d@B !d.3"F @<$gc $$Ix gL$@y @<'I<IB !ͳ@$I!# ijgWHB B@H IB6 g!a$UH`cE$L@BH$lI$\f.L_#CH2!,H$%l,%V R~w+F)AKۖ %d+$.HfUkqet @$aHik٦"e:^sً[_TeP@@0HƋ|N 0 .6!ٽߥ\!~ +$ 6 L{˽!p0h{/mKE'c1@ AY-'!3 fs^7^S}5lTI둖F&CB’p!l0 2 (KzvRב6c`lB6 0!6^cs%a€$ E)䉶+'#6HX$x IyH 20\&d'0 . egƘ I6 ̳+ms_=iۖqLP'(30II05b;GDF!a#aH @2d 0WH2 @˄0LBXgLBI `@@`Ix6!' @@H`&@%LBB$!!l6WH< \3I<L $I!@\sxX< q@gWH2Ix$H$ mI\f< q?x&qB`.0`@B⁄el@H B9I$!Ix&!sg@ $$$@g sWHHH [B\&BB F @q@6WH\& I \$y&</HBB`\$.3!@ ``+lE@,H b0I\as1d 9IgޯW-b 2]L#ٌ$A D&-F.ޞ[D%#$ `0IZıc~OmgqYv&`02W+$l`V'W?6,nd $la07v5BSP$\7|7~'YNcl.,@gyk !\&B{\< #0"~c LW 3 q?`@LB< xN .d@daB+1"a<6& @ۀ/  Ffy& qLcx&$!' xNX`E2g2@O|GpbV:j4Y10`KI &SӄҵPy9R HHZs5hz"-6Nl}[~_?nf#cI< ۉ PDQk)b%B!ls1`s e65g9M͙ٚ 6`  p(#RЬVyDm\'is#",BJ/Ҿ&,@XE36w~i'1m00W,  ׼^y{7"LXA 夵fl붏uQZKB]O 0clͭtbEdr1;uw l .I6m0s! 2 `@9Y02dW<L 6We <BmHa0WH\&q?<W"L60Ag dg!<0BlH 0@cjzǴkOKƆd@Yl `0 %$YYcۖ4i2 Y3ud=q+4H H n֕Z\&@H Bmeve6`۶1` 0$!$IR i484it62R!% o#ohGGY -4B v3aHC`ckjdeۉl "Ɵiƶ ` lg mpŶ*;5b2BB aF^lֱ*6mYJ;srs+{&Y0Lv11X $Ibkk]) @`2F\&e `H ̳H` Oa d\f@H lHm ' Ad\``,bN ~g1 3I\a@c$gx Z! `؀ BB@,q6XilҤqvkrbsKSQh.&@lD)TIHm$ $ 2ccicm؀ABH$aKda;[Zj=`1*o'3 .K$ Y@gTL9imȶsbgS_k[ ̀ c̳!a8R*K+pvH I2뵹]6|; 䩥Sᖉ Ngo.4i,\!c!cIk_wNW`IeIsk{Ń):<0g 1$H ,1,@F,s̳X\f gF, FAle<3g@+lsx 6I`'``0 gH< L9I2d0s<'I\a$@3I s? H 2Ws  s?0@OLd^+$. `#mijg`yn qmWH lBgW+ls3 $qe$6WH<W 3$qa2`s$.6WH%3Y@`s q$. H~6``! cK2Ȁ- @@h@?8}:!e@< ;rR#31[퍍j<]`$0 0@Oj5N)a'6W\J t9,!K"[R׃nzRZ&$q(xt>OCU3H )l,#l#0K HDX"n)`}lWx㑷֦WK/FT$#!YX`,F6WH# @ؐi[IZ26o-$}=TBi VvڄRJB`i13Ҷ0lcs- !RRJ)J) )@@L`m3<8\^$$\Ԋ&}s?B=u!ɒ̀@XA$ Ȑ4662I[t~}6U,a˖ B`02`$hC_mƗvLS)ies.Ui ,ےԦ8=lw['v~n#0Ɩ$, m86w56lKs>qw؁K$0@ lE¶$! 1a,c!1Bd 1 ` `s? -X2ls?fMO26H 0H\ag2I2\asxNygsI23g2W\!q$. \!L€I2~yn $K2~ls0F L湉$Am@ B\! ـy.<0$,L&x6 L slsx&I~<L ۀ$6d 6WH\&6`s3+$g.3+$`B\!A6` d@\!d  0Ya  K@m% -@g @blE9$ۀx \f .\adq?,0WggH `#! `Hy 1 Hy0yI~W2$^I\a `$ly6qlH\&g1dH0`s?x W+lI%l@``#<$$mHI<,B+1 geBgb 6Ϗ$\a&011Ϗ$.s1&W  L@$9 #m@_"q0&d@9mXl/$p)uu<8 -00ƒӛ~.4Nd #1PT:EUN8i02v@bc$B$rAieئ^%뼔`UKH8)CD `A @Y @`dlB&>{&E 5IllEl?Q Rmi֦)nLҀmg cl0d@HD)ֈZZRJQ1i;3%ek{g9m &(-{_~iEڄea g2f C62maOnO#A0y #ɘ+@B&~kn2Ë+S`e9eT66cx-BFmilvl:y짾ru 27/f j}R*<H\a@`I<XX  A<F@ qsHcI<l `@@2$s?[` < I2 @XO 66亂 6f Ibkk޻]+  lK2c!l$lI Xg2+ų$ƀ@` `\!l6Aa.y&I\a sy&χͿ@deBe6 @\&6/ lB+̳ q?l lL ۼ 3@0`W؈$ g3I< lH +  0χͳ2s` e\!q1恄D0N<1`+\!g3`g,ϗ̼6A2`1ϗAXlB8`!R+-G=].]/6i70(XH RHiuA_oyl  Xx6,,eЄe Ͻ<[_Loml& 0F$@rjd8u;uK*L`<\~ 42 ۛ #Uc@@F 0c$A+df@`~@@< lI\!l$ `!$30<1Ha3 !̳$lB6b@@@` ` +0y 6/ 's?I<<$g+ 2dI` Byr߹.{O:<.LqeBröӶ B l%%($K;K?ιg, K`[@`$I\&lFe¡MnV ^ݛl{3MDKK2V`@ll9Y&9珺mb3m'6WH2#I\&a 6` mYl0WH<B-$  c!Aؖ0B8"#"S_%6>25mr)FL61VI` X `!d.3$jub~j:8y]W7vvs l%#IRMzP8YeA?~B$Y썭qg€xIm add[l F20`y&a@$lE`@<'a<`d. `I 0sij LWH\&\lsI2$l$qeƀ 0Y$.6W+$ls q?,@$ 0~ly!a0 02sB\ase6~`+d Bx  6I6W\!q+3 H2e I`$ 6 $.3H g12se6 6$ HF $qm$.Ha.3$.A ,a 26"@ H-I/ E%6M0<-ɀ\& 0 ds @ʽwI1Ia+Hsm@!l!@<' Ȁq ``qA<sxFlgy l~ldsy x~ye!as0 l/$#@`,󜄸1bM\!ao$dq q?`Ř 0Ƙ%m/:! $ˌ1HH %xNB\fI6I y ˘2cI\f$ˌ1x&s?x I<<lqxᄸsJ@lHH!#LNpǿgEEm  ZwN)A$dwl>CEE6`` FLX⺓Gis ~1I($$4cm"$$۱??#22 #.a(l<65I$ I(csҹնy6IW$aII6 Hs s?I1Hd`gge X2O<g0 $mMd`+lL B`L6 @2! 2B6y6!d+3$.2<H`c@yNB\f B -dlyNx& !0Ws<6WLI 0`mByN6I9I2c@smWH9_"eH 06I\&`$+ 6Wl` l$0`I1Wg~u\{zwƤ%pHmʋ.513B|1sC€;PDD g G^qXgkD U\RVq@, d#s?/1H<0WI+sH02<lnAH6,yH1d!l@+e60I, 2  2\&0`',lGm'46}p, %!$ @e ` `@)$k:ql.H@`@Ǐ}k I% ޽pw0Bl@- 0g2`$ 3I F c L$I`l@g1A<~@3$6I< y  YylEx!csy&q? x&s3Y2x6 @ c@+Ƙg3HXdg cd\$F 2ijWcgg21yI2c@`0`H2\a#@H`̘"a$1Fy!aya x6!dsy62恄̘ 26 a`#B+l,$l ! $6χ(: $HBB!d$ @$$I$@beYB   `/ @se @@`W+$lI$I`$ N< !!WB [@`I\&I$swET.x B a#g2` KBA $lq@x& $$H<d!.L22+ `I~2$eemI\a\$IH2s$ qĿijH\&$$$g3dW !93 ˆ+d J\!IH q$I@,B$g6qy&q$dBMq?I<WH WdH\&$$@yN$I@\fLH DH \!$$.3$$I  $qyH\a@Hijgq$ A@<F\&2B IbH$q$I< @B@l$IC$I$I< &Hl @H2 ⁄By&I6Ad 6& `0<0eؖx&g$  c@ X0dyH ! %6 3!lL$l$66Y@6Iyn2q0ƼHlE<7˄@ "q1g1@  y6s?@Ϗ$. `A$O`OGgoZQ0 `1 00Wg@$Xaya LlLI<'$$I2I<%@\!#IH<@\!$E\!IBs!IBB $$HHH\&b@ ,6WH\&  s?q@ d<@ &0 q?/y&@@lgxB2I+ 2K"gA+$IB{w.ft3)%c!2b&,e"XQ9AWHA6$ H\&!$@-@dx6@KH@$$I@W H\&!~BBd"x&MB2I@H"'$@HB + "&B$ B@$$"$@ @  $Ibse l6WH$IA$I% sx&I@s c$.$ B0Ax$I gL2#! 1W $I d@g0s ̳  0 IY$I x&\$.6WH $I@<WH9I<'IO2$<7!' IH@H`@ .s3W0$I6B` ٌ q?@@FF\&0!cY $+R 0a#  BXy&II@\a.3G `+3  @ `I!2Y\!$e, 2I<@0A$eyIxNL$6Ix6@$$.33WHd@\!I$–$`E,@ LY$0q?y&I g/@$qm@@B@ +x&L H +$.e ` $qx @#$!Ks캼㞃H Ɩ@ ! Hd˖Mm6볥Jzow>J 6 lP)̳x& BTpm`F`Yc[\&l6 sd$L\a#x@YlI0l$63$ $0 ͳ ! 3 I\f.s2<<1 aL6Cd`B\f+ yc@ˌ e0YH`,cd!lWd@ ̿L`@dsB<1m/xᄌy  @B<0 OALٰ m,$c!0IDP}oß9:@&։$ #II }|38I,$ I0 d $! 6@x&&xNBx!@H @a@$ $ @2ae $IBx&q $M9IH xI ̘g2 <$!@⅑!Ix H d#!˄x@2I  I\f^I`G I,H3F2Ie@ A`ll y!c@eH~y  dY$^!l/< ̳Hy&0 cqxۼPBYsdI\fx 0`2cx6$92,c '. O`I2<<!1/  ͳH`$^0Imx.2lH$$@`00dsIm K2;RQms?X A@# 0 l0!Ld$ `ɀB2 lH206$06e<da`@@lBH\a@0b$cg32\fy66`3lE6&,6Hy2eF s$. 1H .$$lKxnB+B0H c1`$^8y ˘ I~+llBO2l01W%<c!d#qm M0@ȘgB` QukA(%IHB0`(@ Kٱc[xq׿_ᾌK e0b #@>gln;EY5$!$$AAH#u3iO~~睌 c08?vd)& AIBvf}?[qmz\&!gIY,0B IB 'H2fA0 q$L@$ %HX$!q?edH$+ I@IBgI̳ $Ib$χ$03HY 0H<@OF@#b1 B$ ;E}Ӟ|W?SZ!!. x&aA$X fy|1o4yuꆗ=oֻPp`B,$ !,@H`"JlKa $I\! $ٖdPHPx6I<$0i=`$K H@Ȁ!.WYBB @A%@2#Y@B@<a q$IDH:;__vF9yF2 B $  ,, Hl$Hsq̓wweq[00 c ABsS֋s7_KDo7.0 $@`E)|VJ86d#l!RsEڒ0d̳ؖ60BB?ȩWl$ AqmA` ` ̳g$$I(exc!H I $$$dx aI ,@".,I\$IeL2HH 0$@ \H لe$ $I ˄x.9 $HB IB2!!E<@2IxI\a<ij @\! 1 WH$@$.K<$@ @OX6blB- [;ǎ.)3 Im/3d0 bgdxq?b ـ0`e\f0~湉2Y a+ ⁄dA\f!<`+l`L6l. qAd g,K%qx&IHHHҞg]?[/R$@~1TLyڟq˼ ՠ&l`IOH Rz5.lc6G|ʛ޼y]}ǃQ12d$ WH6NRlK [$.2$ٖ-ؖ$c$q$I\68y @LB q$!K2q?a!Mn~~+n,|q}8u}TA"d$! B@@X 6BL,c._'l ,S'iAH$@>vK[ H\! Kl$$ seA x6@ $$ !0+ I<7q+$$.$$.Bq&n"N,.^K'KͶlalgH<Huw ؖd#adB Y$6 xeb,gdg2g3B"0A\& x@y6cx~$1f q1 q?!eYy@g1y2a a` 2!B\f ,Vms?, al@<1Ϗ$6g20@<ͳHAEꐐY  @`# q3 q$ $$/IxB @\&@Bd"@B$L@ $'ab$H$g1WHij @ij!$0y&+XH$ ge2!x!s$IWHO`, s HB` IX@0dsBijHHH<$e2$@g2W$IB cI_d$$ 2 @2 ˌH LHH @<@@ q?!!˜+$qx.xijI`ee%W ؀, +s YWX@ IF1  ~˄@BijI mT0'OlI@6۶Lfv}z6!!$s?ٖpD߸ ̫4 ad  !!#3 ` $@"bW6v+u?f',ϭKQ$lH,@ @4qU6c[ I`-!da[ HBlk% @2s@ I@ L `,0pBf&eW:ؗz]bٽα H H2dc@622v;3]<]g$@`d[m0ƒ`1HHH2̶$ 6"GrjB< MAؖL0`$0 F`,@Bc ,!  A\vwʛ;X-ǃ|1zSn*+!&%€A+l2WH)Χ۾iG=6Y`K@l'cj-%LI\! 0=L)I l$csy&`$clddFl$Ly6H0B0 2yx&,$ɻ*lem@Ai6MVO^᷿lA+$ѕf8M< HIHإbq^Pt  !xl$.`Ƙ$X0$ g+c3g Isy!ll\&L\&$.y&@``$L [\&ɘg`s晄yna.,`@<'I\f$3 3< `,B< .33`@2H02d& q I1@\&lWHl\&q?m0WH2cs H ls3 ܌$  H` dF$a6 +lg@+eyN ls 02@<`W yH a `,B޵պ}lϸ_ơ( 'X6d.A!@u6f}D- g B@6H @D]˩!q,dgd `l` 6WHH%$Ij[^nyh\ڻ9=g;? R`晌`H;$mgnnu?ZD' B -f;'Kِ`ے0Iy_Kw D晄x & ͿDm $l6`@`&@6 qx< 2@BlHYlA<%@gg2H0`Wـ1 d@~F2`EYl2[ x  .̘G 1/$6m,cij d. 2H1`6@g2@f}DضFY 6€ ٖH@D]iBL2+A , `H$ .K KH\k׾ښY?Nu׹(06  d!02'ض|V6'ύg'H x& Q|cZQ%aIHlnn,N"l <¼@Xd$<$! x& @⹙y W@,~B<1y6`L2LH-y>$a@f@ˌy  xN$F<$2 .0<`x.< c@~@l0@dlH $gWHypm CwO#kWPbaal@6`! p! 9!d"  l7%$l$a ԭYܷsKa=5 FL $!ɢ(.ಱr}|O?lvmGgQRB,q,<4DD@H`B`$00q&-I .&@@I6,$f@ʈ,EiZSzk>n\xӗE}`P @la2!BXHR(65K~/Ze&K .x&!$K mlllSI 2VKbVjwmwg% HH I +l$ے0 ! H$^IB<I WHHB@ E@"ij$'IxQHx69,!y.fI2 x  d,  @  'e ,$@WH @qB2@ Bs1$$BHB~$ H2c$@ $M|H I$$xx@\!I@Bas@@B$I @$\3gA$@ #H+$lsB$~$@CdI B L9HgI@BBWz~vwo֘=?>/]Y#d7d@d@BI6"<$SS{ǻ^Lccll\!a#A;[Mg l$$ے$.*cI I``` !c# , @yNxN63$dAϘy6$0˄l@y eL< W@a\a 1 \&eŀd06` ` $^0X<1A$ ۀx6#0A`@؀%eed1H<s$lL湉g2I0$1M\&a`gI\ay 2c?L0d\aII2 H1b"1yH<$<l0 6/s<$a2lg3sϗ$.-l l `#Bl{/^j$$@\&a A" # 3M&/z5Nܐz\.-ş_;?~'d$I F}t&B:wk eBFHcx~l `F<"PmՓuknܼtaᑞgqئ"C" @< 6`eȧO<ݟi~Qzm `@1$#qV)1M @Ű6 Df!q19Hb6Ϗ$g$l `ƼPB1a l/ 9@ `Hyn9@<7B\! aaA`Yd%6@l<$̀  .3A2X0 `BB2$d#   A@ sI<7lI`$7+u.@Qfv@XF l62c0D}mrЭq ijـȒB@kk?UOՇz+;lQ狻n[=鉻9]HvC1d.3WȀ `066H,k?%`y&g1dI |Nhn l$RϺ}j1Y d$ L E 6/1#ɀ L6 L` 3l' 9H`y6HcM0 20lY x <y6 @g12c$̀ g6 0s @2# 2 2ql2 `g2$.y&q \&aBa2恄1⁄d eH@<ͳ ` 2x^6d ,0`K2By c0HYeH Hq1$\&<0ϗ$6gyqH~6q?B\!ls0H `ij6y6 0ll, $ls?+$$q?Fd@l.` 02a$ `@ 2`$<,l$0`x.@1eL6e6ed!6EA0clqe̘+2B!. `'2 0a$\aH2<'IFLI\f˄2IBA`[<' 0 L@H9< !.3H`$ s?!A26 @6M\asB0 m0<I@؀ij `<3$B1I`+2&0g2M<'L``2c@`e6Ib Ȁc I<<I\f,0` eFA Hm @OnlsmӴZ# !Au=o~;tpp8baAX`$lci`ۖ%4S6ofý宼dRE a $x6&BJ*!;tkb 0 0`hW;s_ekÃYp}S_;`F#@`K`0Ds~mwn)[6 €00*ޞo,5I mIvJTrOc{rXls `@ L2`0`@e6 1 6/l ~l$^I<mq$L\aI2 06 2 s`ųeyA3I~0^6~'.;]RlF0q?!$\a0$0a  @` @d@-Gk<2_ OHp[żç?pg鄆 x& $"Ƥ-狺=;w{?rŧ.^Q6v2`@vZt"BP:糙s7P$ 9 9I\a.3 x&s<x,y B9yg1AO6"6Ls?B6 sAeKl.33~@<lWHl^ Y$ 0`f1  ds3Ix ~YeB`sy&q?@2\a#0We"<'I6Ff[,^X?ttq l,s H6"H` @r(%PIJ@Lvu\ؘ/g咮d#c d` XBH1X5Ǐԟ~׎n&2 a3H6~cުd&lBQ0/ mE  A2 X FB X0x^Bs,B`6$10~ y#s``$ I F `$\aI2`x&K ۀx&se @  1 s2s 6E,d WXyNB\f@$0 `@B+ ƀ g2g2 qm0WH2c$sssijgb, #yqdE0 gAm$\x\!`eyNBB\!0`X`M B̳WHyij 3lsA$ 6W a`sA,Dl$l<@s0KWd 2BcFx6l$@0Yl̳˄m ^0b&<A\fżPlH$6b#B HI~y I ϟy&[iGJ"Ȉ B@ # 0HX'祛^Xe.0Fg1d.T|sLAB`!D-"f}t={.3y& ̿F@`"aA ̀s `3$!6I,6A m lH6 a\gټ`3L9I-@@s@ l@`$mLCO y 0 sF1`g23 m0 ,s!a+ l  \lHy aI2E < B<$ <agͳ!.A! @0IelBl$ q0$0b/xB2WIy !\fy !@y !.3yY9I`.A B qA`+l$@yN6  l#1" FOmB @\!qm@6F2!. y 6FFI  @`q$q,Huz6R$lc@m"ׇ",eFds@"d-n~co7\Ҷ;$,#.3mcl̴턔[vu٩6w `c0b  O@+l y62[0ˌyN6`\f ~Ƽ`2 ` . <7L`0&.<yBH`s$@e, ,Hx$.<7qddmHc@21!d6 d4>qd0 Nۀm 69ExǠI\f@ ` )D]ozop݌$\al€0lc6[ 2[*7fq5ۧOontiE9vrcbR>%]4[\:?=p\QpJ0HdHH  X6p 2g}lw DzB,$\feND1(RHA // + x s2@$A<K $1BmϟyNB< , Fe7_]QilC6$! q c612<DQ ǏϮ9sbg{0SiUE9wny޵jSԨH95 l-`.4駌 O]f^)[F qX 0c2-I6$I\PEfZjg:S* c0$ c 3gBAbBm $6`,2 . `!l`y&!cxceLm.# 0$ [K\al!x&g2 l $3I`,ql$3Y y>6$XX .3lA2 6dI\!\0Il$dL6 @9 yN6/y& H< s$a6E2y&+3$mB I`B+sse<I`@B1$€FX`eYex66I @m@Im^cHl`x2WXd`s0- aFe02@ +l$m a#6@@H\fsA~~@`!, X< @<26qx<$s1l sy&! @l0C@ `.$`d&<$<|I2K$m^I\f χ$.ͿDqm@y0B l c^(Ye'd `HOyy~$m . e2ag6` `#s? $3\f.3B<g3q6@$gB $'0! l ,.9Y IW/,o_(p`!d!26B(bcgNB6N#$qJƩսݽK9S+,BX`  @`Ad`[Bsm `#$  2 K` !g @/m0WHds?x&se@1B ~y&lqB#̳ l63ls`H <70x ,@dsx&sxA`@!\&lq` ـ0X\f+0 geF``seB$e\asx@g1@<7 xn6WHH\aI\! g$ ls @ ! s \!c$.e<+l$0 +$lB00B\!0`$c6WHe- s 2A` \f `g22y&s$.33`H H<$<a`3Y #@} #Es<`M6Hl@~BƼP 0I\fx9 lF @n~iVBTgbc0+ ~LAF)͍bHH̾兩tqw!mAAlXIhL[6H2`rwx   HH -ʹdKщW};ZG-e  ,L al02?kNQE,a@`@2؀m3ٸt|cg6AB$IRZ Il c!0Ydd2  $؀%l$0 L`gg29a sy6qe`+x&s$.sd. 2@63g2Y$q?L%@ ijˀ c` sX9Il# sy,#s gBl<Y `W 0`+2@~2ɀ-@Ye6E~6`$`, !. IX`@beyN\fg@2WX<ƀ3IyNxNqm.I6$a $ Id€H\af.L<g qx&sF\a !F! 96326Hh`#$\aK0 6$ a`sA$ \& q$ų0y6  .3+$ƀ`@ q$ls$. <˄c$0`yNx l Ll!e<'Im@`B2I<cf̿$.ͿD|9I2 ؀$s-lsij؀$6W H l/2\!6q`<6$I\aBWmYe̳HX+lsB\f3g@0@<G"01$l$qm/ /I<y I l|Iͳ ,@01Iy ijlijHl@~l9I \f$ 6 @L@B\!L~yg$.sIƀ `el`.x&s?,\! H0`B2<e<'qd$ņ,  $@ـyN0I2#I`eI` @<< @<!s06$ls q?IƘ%3! l$qm$l q1`s dqm,c!.H$3+lL@ $ImB2Im@`+ q !c$c6I ` $q 2I\f`,ldHB1"c !O,  ,+eL`slsxn6WH\& 0@6$0I"! \!3g \l$6A-0@, H62 Ba 0!ldƀ m6 e;vmZKB6"@HlPHp<" I!@(@ ’תϯs,R/"S6616'[<1`+}7[, mI-0ac;Jt]7Mr$6H6`H` 0W BB0~¶lmB6`!6` [<湉g2$@s? 1Llij؀AB6I<I`ss0H\f@lF`^ !˘ L6d$a!6$0A 6AmL <x@<< LH~ 2yl$@`gxY\!y `#a21"B6`x$l g3YyIy$_O0`+ la@_ I`E0Yl$. L\&ـ-@̳dc@ | Y x6y&Le2q?qmI` 0\a,lsx&@Bs1"0de9I<`@B<g2C x.2\a$.3`y~ $ xN@ qI @2\a@ YA10@<'s.J6@mI$)pjj{i\,I 6@9Y`@x 0WI\a6A`Hm^ H\a<<{?>ϺliII`ck)L[rutp6ْaI `#$ 3 \f|cQ.B-[ˆ$m#g I%@vڮRxZP 2s2g`gsx X+l l.0Hy&I1q$6b~eB` 3g `O`cxy 3ɘg3+$l@B$ g2 ,, s3f, 30 0`#`s?qB!c0yqy  `AFO`<<0y 06$lxN6/!c`!mB_f ijHg$<! ?q$y ⹈HA aI̳6 03`e6 B \f+AB /$ lK6K~ax& ?1 @xl$L m$ 03  !aBϣ2 ;% IRDƶ]Jiw/ %(0$d@l0AFl/Iy^6 A ƼPB !mM` eyn$$@y@`. Xs-< HO`.3l 2` ~♌y>yn``H0ƈ@\&q Xse2O ɶm$I6 )mDQ )bj ade 0WH $@`L cI `sq$c#@ A1b e6WH\&-dqdc6  H`2 ``$@<3,0W+$e6`$F<A s1湉g2&@2$. \&qA\f OA6, +,l H\fgIlijg<ds? + y`Hy&s`0Ř$3g3`<m$c q16dA c̘+ 9I2c0`s1Bˌe6$̳<'Id$0` @0 ɀ + qeI99IL2a<e6d`B\!\& sqF1 d  @ a$@lL  ls XlKb `B$0` `| yIy H@eB6/$ XH0ϗ1/AB`OI\a1@O+gs2H<'q0`7x&6`slmA0`yn,6H͋F@cH0$l$!l 9I2!@2xn9IH~lyn sI y !d 9g3$@6b B<ay!.<B`s0 @ 6A@2B؀xc@\! <+lA\&q?cc 6~2 `Hs fM77w픮M l$1 3"DiX ãl$lJl; $l" $I2%E ij{#l$ye#@ Y<-l/W؀l@< aG`.3Y$q?<-$6 "sχ%@\f9H23I6 @B2@X [3dl  Y@`9 `yNB<1 H~6",`$qm ijsy @<ͳ 0I``  9I2c!6IA1 `%2˄`<0 F!0<!l2` .6ij6$`mqͭweLI" @ d, 1MNK`l!)Bptp8. d@$@d @ @ 0ϟ$<$-@\f3#,l3 H`O<g$0"eFH ̿L<WlL$c@a6I\f@`WijeyNy&B2`@  e02`e~0$lo&d``x6`HK661y!$$^0Im^#,e6&yN9AͿ0L#̶ds2 `\f!Em @6"`I l.3H L<KdlB6 H\ax6K`Lx&x&,\a&6B?//:0 @gx  f@` qx< I`ɟ?T v6(EDDDDDd۶tӔqZ[vg~gV 6Ҳ LB⁌1W3I$HrW)%6Mk۠;G>oN:}ԉ͍Kv:3 s\!ci۶m;m$$!I$(٦KgqmxS~w.IO˶X0l `$@`E<l)q6p/b/_%j LH"$!cl1&0ds?e6". """"$əã{Ox>+liۙ `+ !@ c2 y& F(ܖ/b/i0RkWڕ gglgf66__;l6 l$6Ws0`$$ {>^^}GdB(lE $ ȶ^IGd:mX` @Jimo^ Y_J@J,BED̴Zȏ*4~2  0@2qm ϒxny  y OfcF |#S+(%B $sm1m I L 6 m ˄H H$I `۶A$۶m 7~[el``@\& xN ` H<$^ x6 `%.Y[] o_OED $ETEKܔm:'pD찅3+$@< H0`$!/@do|􇬧 O|'; E723[@FX x6I@` aMDƃ{%$I ـ1 I Ͷ-3?_(ZH6EgI0%ADi_xL۶3m۶L$I IRHB¥>5MMa WzWxwے;Ӷ `g$)$Ixl))OzҏI\!0Lc# l@<,dsW0,"oor/2؀`@Wa6  s0$0B `. l6g2FA9o&Q@`l@@c.6I1y|,BlKE#0I2 ȼѼ۞~]}P9 @p ٤2¡"]wj;qdA`aW0 BȀe6< B1B(2"$|:үq߅eޤ'vbRNHRX!!,۶3$2Y}/C@q  a0 d g.X`B~BJG:SmHL@x B#""""$6 B2` @<'dI` 11`lV=jj("kkkSԯorCCF0@ $,YslIgB (! F-!$IH X1sW q?LlN34\!g2L|Hؖx6d#06vɴ e,d%l 6vLI Y ,$,WH Halx&G9 LF`0H@Ȁyl.3g1g3g6 @<,#6`Řg2ABH` ~c\a0$ls1m'$lx&aٌA2< c'$6ϗ A9`! BcLeFH<晄 \& e<s s0Y\!33<$[<_`$ <'g2Wؼ~ FO$l$,9s"`gc 0d0`$@ Ix q$IBBB< $2̳ !@a$qy KH^k=ZQvffmc$HH+l۶ B$ @BB@ m66B@R ծW;oVoMJPjR @x6!@H$I!IB22lc۶1F %$$$dɒ̶mYBB$$!I ms BR)QjUh=o~dvX($Ya ! K`@BD(6WH$I$$I\f`@$!$#`!ƶm۶122m$Im۶-IBF< +$$ID$$9ɔ  $!@@x 6 IDH!IR IBB361lms?0 3$KHH@@Bl6IB2 ƶ1g$'g۶m۶1$@$$@< B$@B$ $$Kd ɒBed˖-`c0$ $$$I$ &$  a,$)"$I$!l0 6l`lllll,,0m`6W 66WqycK$I_ d2L@B$!(cR2I F,!alll $ $s?RJE*dOvp 22-22زdɒBBB (B),Vc)(ˆg110@A\a0e#F $$ 66m۶ BT"EFi%22adRD3-46$lgc1WHH " dEr!@"$! d d"--ҤeW F0`$$@ ll,bs>;[~洢P$I2a I$@`ll`03lc@H6d۶ ۶-$$$%$@HH26m۶m~$$I$DQщ'{++g݌l*=( $@H 0llla#Il0$I$6sH۶m0ض3 `lllMF~2&!q? @i6`$ $IHHB<1턴'N`0L9y6I$I$IHHA2606$`l +$$m۶m66@6IB@  0 $'<I<I$l0mcc6ضAH$laaa22B2!l66W6$I$I$ ~# $q W`MB!B IB¶m0ضm+l$I$I 60@q\aB Ic0y@X m<I,,[<`ca@ t2˙ ecˀcc@ 'KI[&lrVţycbO m0&x ȖX < 0 I 6``Xrlc'$$IH0!AI I 06ƀƖtZy؀F l۶mc IxN@`cl``lly& $d۶m.$ m$I$IBBBB$IBB3>a{zXg&FHB $$qx&ۆ4ig6c;6`lvi 2"\Kv?xcqtt$IHƶ\ffg$$`0 x s?L`g1`^I$H$Z@8ۿ}w~+3.B@ `Ƙ`H0$$NH`q?0 $q@ <W+d@BHHHgL`@ 晌$`l@ !PRD麮Mm^G~O;~ҭ L``cmI6 ` g3ɶ3m۶m6 yNBBZH  #$$K ؀B rioFp^`CB"%.I,la#`0d0gI$ll0&m'Nl0`1$I!X<`,cl + Xy&#@1`yBB  晄@m`x^66A $'ɶm۶l`mƶ-[ƶmK$+Ɩy6I m۶m0 `e XX m۶m6"@l0@H,c O`۶mٲed l!a0<$6fے$@66$L0&ll@<_l.lF @xG @cyN1˄06$@ a Y `6W|@H`c @sȀ<' $I(!ZO[  0$m02,l @ d^+$ y&6b.H@<!itmWX <L I1 $!'!W$ ˄"D(}l dL;3mijYF q0X2d0ϗ-[I̳$$0b&N0J~o&֭)[&2$63 #2X2I\&yN$$H amgS8i5#f3 d&F\&llY31 B ``'  + gia$ ! I,L0I$IY$$sH,3 ijg@@`6 d03  H `lg#  'Iy&~cc  y `206$B$)x.ll0,`I%`y~$@`0#Ni;me y&s?,03b`6H<@_Ks12W"d"!@y~0üe6dccL0 $ @6j-kͩC&0\&adl '66N8i-Joy;ݷI]fȈgl.3`0` `A '  `0~9ym@ 013 [ !0sFm[a@B!1@`<eId6W\a~66ijHH ~q?c"I$ F<+3ـ^^a^R۶m` 02qsI!<q? RbŽ̰$AX%U` F<1ضm6m۶m6Ƙ ضm۶mNgڶӶmۀ$IB$I msm "3[[%JP @ $!$A$ !I@ !H!IleL;m0ضmmN;333L۶L۶mc1$ !$!`۶Lδmz=˼˾1JPHlg3l@`$$ 0A 02s+ls3 BlYeIH`0g0 !q@ d@ .#`6@B$I` e0,$$$I~ij<`YBByny I$I$I,|$m$HH$I`i۶mضmlll m۶ƶm۶m۶m۶m۶m۶m۶m0Wضm&mrB\as16m\&,Hl @Lm۶`m66$EBB1`0`$ d1`0fq" # 6 d$@ $$3Ig"&yzn,Hi 86 ’d g30l Ikn{x ! @ # 1 c`ijɈg3@B 6`0bؐ6cc, 0f0lyl2@\B\!$@BqͳHH<%`۶mEHH+BBB@6m06WH !!m۶-K@ GBBB $`@BBF`I #y^@\a02c3g2WH966ByN,!!I$IX<'1~62B!I2*Wl1@!0`BD<Iy^ m$xIc^ $@e晄AƲx$ld \a\&g2C0g3H0#0`$lK$4ټWnQMZ&@0d&0` !1  'a֖~K~ʧ}8MH\!!3Ionl:s4N L n~ŗ__RINB裞A H ̋D?oOOd 1`$$q? ! .#HSS♌e3 l -cl~@, Oif:%Ju @'+HBx>l$003 `@`E< x3e0dc۶mmg3Y B<AH`l'03f <+@\&0"+2 %lg0/؀/ L+s1 Ed$xH؀0_"a$a`/ A ,ss2 $!!`ccpi`l<3y&!B < lN;imm666Nvƶm۶mlll04660i85SwxLYlK)%$3 `00 $!)a^^#>QI!I$Il mŀömd0L3kiie !!lS@__}=.-K˒.( P@B`al8`MHHHH$I$ 41N[mol .LI`0$$$$6`c0-,1B\&@06NlcvBJ,Ys06 sLBBTP! *$Ȑiqq(g%_e}O\!۶%ERDxЃ$!! 61~l29@  \&0g1$^09 <y$BBB` s06 $@H  `0H!€X<L!H`l0E,c`0 s2   y 20W̳ "H˖]3/;^K͒%`ͳ HB28mزXH@(D@@ IB !:l|wMt͌L<@ c0g0 ` B<BB  0/$aI$@@\&^ms`ؘg2c۶'1W+@ sx&ijIOI`g1#c@ H0 B$H_"$""$I@d $`d g܌ $6"g$IBZ?{QiS )g`6 `'2ƀ8tT—v?""$ $ 93Imm@2L6`2$g3&`cc#Zeډ   @ `lll `L8mgIpw~w؞ә8y H IR ! ˌxmsx2χ@3  l ^ K#I q2`06lll # f <e6W$IB0Y$`MBY\f ,x9%^$6@x,$$1♄Y$$\acceۭ23-[gH ijd, @la@HF0",$IB\a66+lL$q?x `9 ysB\f0€ƀx3 l6d 666@0`&`0d@<` 6vuo~ވ’\!`M\ap"T?GK7%cܽw$,[66W@ IL\GkW|3nKE%Ha@<0`0&^̳ ~csy!1 6`,LO dXB @ !YBgH`0/@`F<$I6,$I9g3I\&$$yH y`3q? !`0,em.3Es=I,$@ `N9k{ﻭkۭtg 6a@26   `$$<' #x6@<HI ##0 L۶m 6R)y s !@ d0 q?qyl / 1y,A 6 @$ q? y&@Ws0Xb# 6B!B@-2 &Y ؀y!$@@xX\aH IRDHB`F@`<#@6y$ `l L`g  Bg q B@`y" s?I~ 2!l.yM`.K<Bc 13Fx~ x!06 d晄 $lqg3sxYxn<' s?y B?˾䋻nF0\f,`l$% 67㸎$ $3I mj'<ɏy#i2l  s02x 2ll⁄"$q `0A!AUJ8m4 a@$ Nۜo3/. Fy@  +l06@ FR2 06 Bm .W !l `0dce\fp F``1`, BlAO` /3 g2 M@L<$\&f˄cy>1lijd$@E,LyI$ @xQHX-#`0FH#6W01`0Hl#q1Ȁq̳ @`ddHHNd{il# l0`2l05O}nsw!T $MN?gΡn c,YF0As>F$$$ $$@$LKV믿˾E$Np mS _ ,$`0` Iؙefffu{{>S> CkӶӶml@HH$$@ij @Y3  $? |ؘgBylc<晄+1$ I0M<0yK \&$$0I gHHH<10l`c6xN$I\!Lll ¶ g2@ 60 @xn0$$s1f `I<$\f۶ q?I̳g2@lLs,,,ٶH, Y ˜L` cۀ`066N,@x& $$>)O~B76ml۶m|g ~WayQ`!lNOW@ 0yA@<3 ##$@ ̳NۘgmO 2\&I!q% Iij s0,`ij@ lf0g26@Hƶm`a. 0y~3̳Hc> I$IB $I ƶmc/0eP"I6X.""JDH$3ll`0!0|36cl l$$g3 !\ $b.I#@,RDBtv}t} D($ @mҶmQ|֟;w'~gLSevf 60`LL<' '<```0̳0M<' l2qy6l /`€\!<16ͳ @ !.$I$m266bHH<'H<IH RJ @\f<d$ `ϟ`ll0666 `l $ijc,6  ض466m2 ` 6<_6g $@Ϳ,gBⅳ\asL<$I< #x @B `Y ey$'!g2I` $/ "as@<qxA \a<IHH $!,B "+l.3H<dcض3ضm۶m۶l!H\!M$ )$I $!Bƀ`Z__-ڸKKZ*)ʯ3OJ)xlc۶N{ZD\xC?qER ;@BBBI<  @<0b00@ y><0WH,x&AB $ ``aBx&s mclll00q? @ E~` ,0~BHϏx @$ m6"q@F IHH9)<晄y&ly+ 6YB @,gm[ .x cH♄`sy~Y`0$^ 6 `l 09 d3#!! 2ss `6d$ 0mll,$$'!q?۶m,6HHm۶m@0`EF 6@ ,l qBBB[F$I$IHH116\as@BP @H KyFq۶m22 dL"! m۶e $Im+l.@ض3+$ 3\al0 ŀ md022&`0d˖m۶ `,eB^Y$ "dd0!@P::_=s;0!a_?%Bec06` !Z/]|w.6BH ``s?[$`0/yalHll`l0W/x ccc 06fAF0 0Allllll.y&! ms? x 3 s3+$ym۶ s-@ mXHH ,lll'.3 K sijHlllldd,, m$I$e`۶m !HHHHB$I9IYe6m۶m۶` g@ Elq?I<3\&M$IHq?Il qyBH$$.$ ,I1~l0`g 6WX<ͳ0` `gfE x.e\&IBRDIR"m~w !I 6s06ض 6˿`yr=Lc01e?y7~;gD%"s`0 @ZЧ~>_0h"m DH!I$$I @ /3ۘl. $$!$@<@ L6s6χ@E!@`L!H&$@'`@<l eBI\& eF<' ϟ@0F $g@c06lFOBg #c'Y !<<'ad@`^ IWHx6` I$I2KH MYs`0W+$ͼ 6`qy,mlc0<@ q?IH\&$~WHHl$.Hy%q?I?8;33eiigN+@MFoANs>yytfm۶y m.%.}"Zk6Ƙ+$g0l0g/@ò mclH 0  6 !|g2H<@<`&ˌL@yq?qs?29 $ < 0fRa"[<\ <136f0d$2cl!06χ@B L0WH$q?L 0<7`ٌixNL 6ϟe6d0 y6a < lA66/0I@@ lWH l0Bq?#`y> l@$~66W<_s<ٶ0I d@- $#, @  XBea0,+ L,,!!BTB؀@`06bIx6 @\a l $ eH @ `@< mccc`Ɖ Iۙcqx.ͳ `!B $0@3/R~Rc`1B6؀,la4My;.4E4)@ (P@B!&N{IٌF6q66d.lYv];zc덯!Ꜳ,0 lL<̋6gϟeb0!E(B!I!)P@!h*eԧ|ΖR2Ӑvi\acl`I$!Ia|Ƨ|ė}3i666mmmd??(}WJ)2v 6 6 !l B\f0d`f2 xAx&AXBBBBax>`@`~ij 3 0d0g$IB lE @<x2+eH 0`06g2A<_a0W`^TWs?s s$$I 2,yA 6g1gyl慑`M2!@H#[D{\;t3!CHd@`lKX&1mo,~G/L', [6Iij0хwy|y0 H $0d0m.ȠiytFth&,  fŀx`0 '`I0m.3I``/!<l E\؀l`@<  B s le~ FflIlHI\! @y.K $@ql 0@1 ,.s $x6 `<3 m0f$ Iy\&I& !@`sX `3sB gc3W6b<q$IF<@$\mM<_y q#L '\0 Bm[k4eB*( I @ .%Ix00E B!!!llcmͳHWYHOOH  NBBs0 % `y H @ 2 66`lE`y qc0+l0XXllAE#gg\a@`+ @B \&l @ mf@ ,^D̳IH؀@ mxn$ @@B< `l˄⁌y&<,`0;m.dbx.$I\a0!!,$Ille2ϗxn a@+`mۤviN`0m̿慰 BBBB̋6ә̖4NS 6d m, ijX\a Il@`l۶mmyN0l6##!q$ijgl Mmll[3`0@<`0l۶mld2 `#DW{c(0`l6N0NHӶ=M;tBMJH8,,3 7pBhPwMGS mllemm۶qF6;4dt|3xɒ0WHHd `!!XXXۖ d`@lllyF\!s 06$ijXFF @\f@`616Wضl 6B gχƀ @[W $.Ylٲ%``gLX mls$$I`$$$$L@<$$$ 66@ aƶm BBBlx.sdg!IB KFF!ͳ!`l۶@ȶm۶%lm#@$+l۶-m` L66I ijI<$$.,0 \s$`l.#$`066ϗ y>B\!I`@<gqg`'gxn~2B留@Nv6ml2 0l`0I ~q?7~o 1(Lx&C <hijȀ `c0\aA̳Yye0 `0y  ̳66c   q0I,Ȁg1`@`I꣖uH I$!1ɘd+0`H6d~_:_sL*` $!I!@[0B`\x&  ~~$F$L3 ͳY`y~$@ 0#Ec0%q?q$$$܄@fbsAO<sDHLOٹsˈ>1FcA\!I a[B` AB 0 leX @<z|#]=Ex&a̳@B1&E\f.3m`0 A`€ ` Y< ~m؀$ 3ـAض0dlL:mll eBO$ B¶  ƀA ,`9 B@[ c@ @q?+O0 / X#? DĶ`l<<' lc43mO훾^'6X `06`lc`$'!!!-! cc6`l~$H$Il;m 2>+I϶mۀ1WI<'3I6`AlrxxAQQd$ccc lۀ@1mx6!"2H `$Hs?!@$.- 6K m a0Wllgij $H )67JBxg1`&igN;qJl!LB<!eA62`@Epl+ey6#I@` @@Ҥn;Op -Syq?c$srڀL ~` Bd0BB"T3  ƀ I6`6cͲF`%e#6 c a#0` ms 0` .`'ɀK`mL6cc܌ +@lH  Im@B#Lyn yA`ay#FX`mmېi `Lygy&\aij!X  !3v: s1W`0g`0@`0ˌm9 l 3 F tkB g1 $$m 66"+s6ms\!$H XX6y6@<`۶yY H0O Lm0@H~&ӶNH0\ H<$2AH 263, 2̶` l6ضLgm'N`.@y&`c  s̀@ xYe`e 2"#RQ2"#2"#A."䐥Ȉ"B-"#B   .3X gAHDӋlM q?clcc۶ !`  @ eH5)^4NNl0N0$Ic0NLڀem0c@($Yg2 $g#$B 0 y&`06`۶`0`.3 #8džW|kQ"#RB `<~Hg3`L ƶm0fel0 @<8Iͳll@<'qq@L ~~\ay&x^WHH< &$Hxx6sy&l@$ $! 0$ ̿H\!,66< ̋tB l# BWH$@`ee~`0Wy d1$ `Ix6g80 2`H€3Y I\!`0FXXHH `@<@ !#@ $s0<@,  6F61@P(TWtzv>3 H0y x&+3@, HymA<HHH\ac`2;$aml" 666e `0g26#\fl@2cc0 `0 !g0 + 66 ~m湈02 lF L2[2` ~XijG,2W 61 0  H<0`<0 "$Dn=>_%u)+l !mcl1sg~F @ F8\YR @ H$@v:{x?Ca<)d+-0`6W6|a@HaE,!0`@<4MmjB y`0s̀e, 2c es1``3`l``syA2H@$6\f 0I Xe@`' A0g1d., @<0g2a `e $ Hz78Jo}~w :)&8qqR`(s~܋փXls?c0 s@dôGOy l$0ض0Pk^5 00WW؈"3}S0ȶ3 l `q$I2 2#@02sF1 l, 6FDQKݽz;?sU aB~B$ ˄1ɀAs2A9g1 /y6aA6X96` lg\!00sy/ͳ!-!@6<F<[xNBg؀A@2&$x !\fǙI`B6xN[~n$2A C"q  y6!L $`{{|w 2%A0@1 !<7e!@H,!Ew}w}~q%~Ϗm$0HJ €yl !cllF,@ ssl@Ȁ,!P<0eB\&y@x lLq0".A$3 !l$ ¶̀- !l# @"$2!IM<f2 @`  x6,m @\&0F@`_l֝͢E(VXN@@rDtucO.Y̴ <c L&J'@AA` $ `0 6\!!eFFF6A_E_b}4Mے@ےlK0$6%hyxy A3 L !!e6~6`mlR2h 0H,@`IHBF0Fx BJz9q0K`Xl#$m8ovh`IqyN6aY˔ !fM}۷|[{3j?K7p $  F0<de BI) \ UGM% " ۀ B60` a[Ĺga Ie!cWg13 %$iV* ! mKg0<_x6\A`̀$sͳiea.`$H+ `@A$$0PRJ 4d0@`B00~,@l  IFLS^,?C?qLIRF6  $vPJ{!-W @Ox6@ـ0 8EY+JMͶy  $c6 Wض՚W㺔]+kO à(602s얥Ο뎻%f[F $ Ν{3 B<c `^GUD%K mPxQdl$I"B48՛÷}׷nl.i*Q1-ac`[0a?v*60dLq$0 c 069 A`g#)J ˵( 6AĿxijIؖٚ $F$IIBHs emI $Rjul2i '0$0+̳  Ag3 L5< ,PYI pH$!H੭^MN?a6Jk  # L&49P^Jot>% l!x6 c`Kp w@e00HRJ霫_r㡏ݺpߡ\  l, YBƀLH$6gY`B03g1`1y  ,cEK{g^|?]Ff4 d$Y !H06BO bx&smH sBl.3@ra(ETqK[ x&@< .1fc>%i@6 66`@I'? (dRLq yn0q`x&sLi9M6`03a^8c^(q?ݚ!$, $@$I$ y!IJ%9e&N;mc x c0A00y$@H@`[ؒ@HB!"uJD!IB2!0 a[ `Vé/^sjd&m0  +EA`cgfak㩗~cR,cd+ l`8b:0glAOx& Kf~30ҤbB @2c$ I!JBm3Y$l!, mXm`#ɀ@60B Ert͏2syL9 1 X  $  0 晌A\a2 ;3IiLc< IH @vLWij &cys66c@!$! !m۶mmH$5,Q I $$ +GT%gHH$,d9w^N=ӲeӶ0X`,@8@@ [)q?cŃ_jbmt珊: ؤ$Y$ @AلR7L <%l!cl,,9{1/}ad B@q?a6`0` dM2`y6c`` ,a#g2AlB`Ʋt_??|(@X 0d%0 llƶm$c2,A`cg^ <$a `ls2 0c.3b1ZeVԲؑ @( @ @ 6i l$)@@l$#2r" >Ӕ8%d6C $0@\&$@ x^6 ضm`$ l!ab"҉A @ R xZIRO?vqIlgI<!3tftl-[5me!000 `M@6$65\$ɀ1  Lp63 @$I!eR=2BAi .3e$p 4 Afl!$ 6d +!alӜ6 CHBA)aT<9\lRDbd$![ll3 @"$$[XA$ bn2sxpQV,$1 a[ ,$$aT1vƶmecIB$ ؐq0 ,+$cI @`e6+,LN#dJԋz;n g BH b<s 9+`'0 s,B2 I6"'ʹ(SI8 `am'  ,#, lF♂+lRH$$$@׋}HB4F 0Ŗd cؖclxlƘg12Yij  a0`$6Y3I``$y6<@ b 0υ0~B2xN6 H0`#.$.20`6 b1 20$^DBO\&q `#LW yے$a̳\!q_f@H<#6AK K<'23 0cY$4 0`.3S77v"ؒ@<@#llHg 0lI<+A+ `€ 0 HB♄m $d[؆Y_H}fb# 0cs?sy&H\!a`dH d0@`<,0`  `M .`Il$̀ X(B!IYl6 mLB`H H~ƀ,ٖd302bL3dsA<06@6lm\a01DVFxr  !$$0 \f`[\fe!,e% $ ~!HB8A c `X FD!6 ˌ`sH(p|k8p6+%e2a -ۀ~syq87,lam0Iy !$ 0nqBa$@`0`@Nj#_}牿q)iS0dLv:<1/x&qH@@`< e B%@`$@ 0+l .3+ a  !0`yeB`$<_y !#0@\&$ˌ3ـy6$@m\&$0 +HA l$F2H&0e€XgyH m6W<@`!|gaa$^0cs&HO1W`^A~BB<@Y̳ B`ۘ/ ` `<'L$s$$Ivfڶm`1/Ȩ%S4yZŷ~/|> heKB E"$!&kW|G|ٳS6yjd0H  H !!g1B`l`0ƶm0y& d6oow}Rd:3mll@Kl۶mcc $$$$Ismlc0"I$0&$g3&I HgwG'ЏÐ-3m' @ cccs~~ HIB!$@ \&,[H\!$ # `$!! xd$$<Nh); @ !!HBaMSIO__]ʹ@H  @@\&,!! `;i۶mi۶@ !!!!! B$ vڙN;m`0 \a2`KR!$#B94022`06@2$<0b̳ `@H~@B$qm۶m1RH$I$"\& $Ϗ `cm۶mۆNض0 ~$\a@3 6$Itk͙v5HH0X$6%]-EB$ ``0@X€ 6m%######-#s0 @@016` cdU9/BA663CH($EH.zݷfy$166[,3$ 9+q½L9`R(5FԈQKQ"TE(QBEQTE((%(JDQTJE'wY6rRJ BB+lB^]¨I ,B`cۀ1``1`HH \aHH@`\f0$`@qFH  alŐvi۶a2l !@ c 0$[@ 20 I a I`csy l0/y&l cLƘg1!^ .3yn2 0I ų X2[< `'Ug! q%q y aY$#x,BH l\!Bg3 &.0$! $2# 2 E6H<I\aͳcB d ' I3g2+3\a@` !ʭ}꫽XVƘLlmN X,~G~GKmy lA`#$d6d0~s?16`L#  @̤Cf"Zk_5گRc<$.  `$ M< Oχm$ls-a,Y$lI\&< H`XGQ75; X<`# A`0~ٌYsd 2A `ijy~$ƀY`6W`Hb`X l#vz>=IO(BNl e2€ B۶e}ooBH  @ qij q?Fm.$"@\&g#00Hl ! mYߟ?"j 4#@qy B<0%@F ɀ$6d̳ !0`ےm [`$`%AN2d6 I  0A`Im32# f1H\!$la1Ll geBˌL'XX` 0` 1Qfw>aup.nkI`!e,0`a0@Eas? '0 s0I<$%ԕʆl 6B2@n~7>^o 1 2d[Xi1Ϝo11d.y@̳<33ɶ$ @NowWa +d#q? ll%ZfiuCnyғiWe$ H l602¶x $a $   !l`6d2لHa%Ax&c`A<3 q?~H#g1ˌlbH<'!mxNy!$< .I\f 1H$` Ag3dW!ŀ `l@B`',<BB\!c y$ŀ/ͳH cI9%$ @ `Řg0$ggBg2`@H < y2 d0b1d0`g3x6+ 9ȶm 66d032 #v Ln{~W|"666676777766bX,|/|6f.^OjC2e0$̀x~ij ƶ1/m ؘ%!35eLd~w~o6Zsڶ 6d͘x !``0I$I`ccXs0 $H*"B2O|OGr 3 @H`06  2/y&#$q1``0d `0 s?`@ضyFL$v:}W|}}_RB BBaP.ilo.s )$@  LmF60~2,p!6$Il٦Ioۻ~Vk`ll0̳ B$0 @ Y0 `06 d<_m6` LLWv:3N;gLBBB!!!ͳ$IHH !| llll 湉fd@6L\acl`yFOg$$H c04l` 6„]!"Կ:6'RB0y&@l!, $!!!$`0,,#HB<' $$PXV?$,$$e@Bv$%-W]7OrÆ) 4 )'m2ec)j!۟(#NƖ0SLH-[illllllllٲe;lJ-[e-#d+#.6ĉmc~\a^::zw8fLl @@< @6i 1y  IBBH L0f00`3 2 \!lldd0~~ +~2 @BB@<KHH($!)gB y$BId2by&,y!l yly3 9g2  $LL♌ c<'$@l|mM !` 2#@@ y6qm 0x&2@g1y&A\f `H[ l#dG:d  l0yAx&$lasB &0I`$HFmI2g%IR7 $,.F<H H#E_eگ%$x Yƀ1`2!`g2`ee,cG $`,H !""م Aꐱ 6   @\a.3  $B\a `+e0`!$IOBb0 $ ۀ$ۀllZm,c6Jm @Fmm@  `exN~m0 L2Y$@@<, c$@<' ,Ia62 9 ᅗ3D#a Ș+, ` dl,.,Bijlqce2x6 !+e?%pey eBWzK/ Gcs2g10ƶX=-_郢2W`ee F0!Ds/z׀2-,`.\&y&c[Е`xo'QD y&<03$I06̳`%IHHHL I`<1Ș 1l@`@,gdH60 0`x.1πH< @ $!! d  @3$l@m@$.e%I `6"a 20 , ` q 0d! 00d#y&q`<ijZ"!2/ qxcy&@2!!0 e0x.ۀ%IHB鴅bc7DF(3D1W+؀ `lcۖ0cMl .x^$ 0`,0<E sA<$@ $EDa>>uV.ZҲ` B<$T")o;;E R(eϏey6`@`Ig3 $ $d x&,ij@LEN>s-8It:A`B 0,H KFeIg\f<  LB< <`I`[y$۲ im;m$ll0A, Y `ɀx yN `H  0f@dl$e 8Il@FF RQ6nӣ /tx)c1cg2 3I\&Ic@\& l̳20B1H!@D(]}}nEQi c,yNaL:oz: rX0  dl@:EB?y90 X0`x60Hl@`$@ @`T4*}ؿѺ $ a `ɀ N>V.7g?UGcW# l0mc v!/=tqO.&H[ `-@<1 0?fx.3 02c0`f3Bc+lA*=6/yj@H W+l`g1鬥ۻtrW4_Ble3 XA` 6 sy !A`cl +$  A101` EfeB2L˄<ͳ 9 y$f$1F @\&'0` <1@y66~l  dl2WX  ijy! A+ ,,@`H< @Alla H66Y 6l@<@ `#0b03H#Iy&yyQ #Ig$A2!!@$)Ovl))bdla!̳IH@\fll0 ` ~Y$I2bll<ͳ ?ä,"!ґ#$@q\A&1 !c! l!cI0 H3I <H@<q?a02ls1$p83|p=~6ZNN#S6`06d WH I $I$<A`e€yȈg !"l022 c@ۀ 0  fv??g~GUf8%cs?I6<<$l.[!ie_%O~ScGefJJ60A\&W@<$L2ۖ湈g@B<`̳eZgO~OK4-F\fE`$@[Բ׃A cI\!I#6 6<!l6`0NDO_l6`6`d0 eƐ&dL\acsŸq,,A#y6`2 `  $B\f`$qA!s02}OYΗyR8mccl `+!@ d8,kͩrՊp8$! dqy&c 6;-hicy&L a`sa F2ـB`hckVm! gNIȒo|7t$del#q!A`,, H0gA`ɘg1iv&d6gxnL !@ $@L@` !A2 B¼h062 @dFB< + 2y&q@`%lle2YL$a!H2x~ \f`e0`+  `qsy 0 Y @@~!xl6ij˨ 03Lc@`l6ؖ2l  1 0- e 0 _$}=b{l-3xa ` 6D`ij @OYcc۶ z}7|w}?wL곍F6!.3Hc@c`)l0y .\a,d<ϗe c @ Hal!YƯXLؙ9-c$Wl,s g d1{~?>o`֚H(%Bml`˄xl|`#$qmDj)IOyW3@6s0d@ N mO<'Ƽ` L<,<恄I\ay&c! 0̴e68 q$AqfNR6$d 㩫ygm,0" `0dH`F0 , '¸ =Μ_21l,2B"&)zcgQAlg !RsB!106BF 嘀  ,dM\!.3#q[5eB`@$. 0W\!03H$` g1`.3` 0$0`# 0 a 6 F`gB0d#$0d ~q<7yI`+̳<7@s0@<9s1$l^8\a Lq1A< THA\&H `^ A0@g1Wؒ,@€$0 d .3 x&s1$+e g1W\s3Bx&LW+$0x6 $^<,,.3yX !N!0  ƒ@ ӆ Ce6II<gdH<' a, $h, c1`C:3sjS6 dE<pk(E){/Y__6|l8`x6,,0LB< -HlvZK-1ٟ}w/^ܽO1nd A`\a @ Lƀym3fmA@Oy&mL!!d̳\a ̜2#SI2ƀ1 61x&c0 0 02LƀL2c 6v3sƩ5 0 `@H6Hm#Mcs:3H, B @$y&`@`@2ge6`l `.6`ۀs2f al` KI~j5/}^q{Dq[љδ6WLl6 @FX@\&I%T;*9p>mxҟ7GP+L+l^(`E<@ @rDG/nzIТDlmB60N;;>Ρ" *,l@1FlB$2!`.yc03 aSJ$H@`^ ~BA\a$ gqs10 63@6$l|s,y sx@0 BHXg@A[n>ybU`lc `H `#q~b6>Jl$@mg21ƀ1 I q\{.\;Ã`v]PLg&L@$ 60 @H02!)x٦]]@b@BlyBB1$icLBrGG˽K{Ց .RdkRN @` $@2$ 0"0e 0,,9JPLliM~{ă|_w靭bv:33e˖iA$$!@؀mm6`[zãΝ{݋] 2mm.fIHB\!g`l` Xs:sa|P$ i۶$$,!͒Icl662 0~6`\!0 H~$I@ $ 35m򔓳 # mAzT(BQBRDDH $!$I$?I!0``@C\!eƤiI I!I I [Zk9?)H-F< @ I `du[eDQgRH y-@ BHX4$Ӳ-^W4%)le Xƀd.d q?I @(uñY(mc06B@B@ hӓ:yi!A@B\&0&^0 2d x~c<$.d G!l+m lBQB i0F]){;WRuڀ  ƀ1Yr  mr4d3w=~ݖBF@H#,+!\6V`# PH m4\fg0@9I 1H F)dlH,0$ij\fB@' mc @HBc4 0 qH0  X&l&x~$Ed,/$0K 6 L<$!q$X$I9I9 K2qA6<$6/ afH2a ijI`#Lyˌxl2s0`E`^ @ƈ@\&l<$ll0 F0WyLcM2Y3g2  @ij& !!~\! /02cg$`\f.@`^xod aY,\f<$ls? @x `ll@ 2~BBg2$'!0 x6 qyN~ &a0χs@F &ynx^I$/a/c[B<g2<Y\!"L 2+ 0 3/0 @ `@   eHM`!# ~A\f,^ x6 I`I6 <s1$ɀ`$@ 0 0  ^# X@`xs2Ø+Ŀxyd$'l$x6qA lWsWB9+ @3gWdM!00$ 0Wgy6d"x&+0<12 s3g13I`0$ \!./<7g13&\&.3W+2\f'F 2湙B<3 ̳0 #l 2 X2FA g1 Al @@e@3gEbF@ $y K6ͳ e!6$ <c IH$H `! $$E\!@ @$$!I #yI@@BY sB! B Y@"B I BL 0E6,HH2ag B$ IضH$@" ! FB0  !<7B($ H $ @f$  "N;[L2Nll I( $alX$B $$l8m$I2I $!1`@IIe $ˌ@ضme$IB"TJ1` شL.S$`Hx&!.! $%$BH$ $4@ @H@[6e`@ $ !@H@%0`ccـ%$E @lΆm@ $ E$IP $ $m9¶LBme5H $IشL9€`cl&mm0BR ! Ngbcccm@ !e6  & `6lŠHC"IBil@$!ldI&6Iδmx&!g $`@ `l04Nl !!)A6X[#6sEHn͙dx6g$y&I\f\f,LFyLsxAl$g$ H6 lg2@  ij 2%! X dFH0$ #x&!@ @\f B6BH@ %H$.@!@2#I@ɶ%0aY 2!ɀ HX d #dX $c4,I@ @!$D@#Y` @ ` I$#@dK0 ~B ll B<` `@3 FH D@B!0HB01F\a$@ $!@晌BB  .I !@HK؀$!0HI `@FB 1@$0♌$y6 HB< 0 0D@I@IHY I2`00 1`@ $ eƀ0H ae `0@@&0 0`b 0HBaH& !g2(F X%` 0Fl[@,dB+0 B 3FB eB lB`  ۀdY` @14`,0I$Il.3 @$HX-0 0+ B@€ lmI<$l0W˄3020 dK1ƶA<`0F FB `l@g3a $BF m`,l$ Fs11Kd H$ cEA2`cm` c&`mc8mcelcll0 ƶe0'mm66NcasD&sȶm'e ij06I  d.3 d $! lc @ 'd $1 @B vc@XB )0 B !K0B#$$IB3 B Iy&c" @1`  m@HB$`$ IB+l1leA` Ȁee6`LBqAH۶10$X\!sF$26XYH@m!F2A` mƤ1`cc$I`€1611W€1F- d ``0,0Bd0dƶ@ `B`m \a ` s BFOY c 1Ɖm;$BB~ 0 ۀ1$$! `IH `A66`mclc  e9 ! 0%0l'ƶe6+lq0` qblL@m,,2611BH<1ij@eOl3C<ͳ!gynAy3 0bx6L$d$ ^ yc +,/x>$d'Hx 2<!HȘg 0 <!y.d@ ̳dy6 q s1"!B @ g\$$E @ cy&@<'s?sf,,@\f1$0@xA +sb@<`I\a<$$0# .d'K \d<7sB  '|g32`<'y. s3/2W!g`0 6``^ ,  $$3+@`H $$B `6b\`9I`gl2sx&d0ijH #d0`gAX`!0W \a Hl g3`$6 a\f\eq @g3aM`3 @g2/0WH0ϟ,'<BL\!0`H 01H 6$ 0@b` 00`B<`$y&@0g20"<a0H !H0@c$.lsA 0Bm@\&Isx6\lI<I!y> ~$I $0AgdIl$g1؀g2χ,@0`#Fl q?qms0e2 3 ~OyNl$@ 0$s̋DYlH0 0H`0 ̳! B1L $B! Kq?q2K ,,g ŀyI d$! F<$x&!|g3$cgχ gx q?@g 0f<$#l<@`&0Eͳ0f'^9ijA9d$6 asy6K< ̳`/$E, ,@ ijHg+E%HB 'b0HB #aB2$ f `$^0 xsy a H`fM\!^0a` `sqAqdyge@ ^ d@<@`0yB q?!l'$!!3s?#$\!l  a@L9ax a_fIx@y +B d0d0 " l$!`q@< $xn@@$.@ sd``ij+ B`EXXO9@`l'0BB G s<0C 0`e@\&#$6`g# e@< $l$.lij0Wg3$`1M3\a'0em^|@q? .20 9+ !\!@<'L6 ̼ `#@<- 0`Lij W@\!c YF`a 0A 2|$.0Ȁ$s6` ~~< 2dg!ͳe6I 2Cys? d$@0 Lc!03 ,+  ` 0` ` d# @̳H ,0B lB @-g@` q?sA@yn 0y^y2f #Ȁ\!@a.3@c@2LBO<1y6, `le$l$H3?SHd@(@MAe\O8 @$L '_* )%ld@6 e*zC66BQuhy'O~l +6Rm޶ngr{l9ڷ~۷Z?҆1+a4k-z=w=ggvwZ%2Z5O_ HB!DKK?ǚ?#?^ 2@"sxW|G=1jQn=HF-Cr[^wz:\~ROƶoo7Ͳycc~WRPj  )"Z[O>m!p__z0[[?ز!6e)ڴ⫽J=__paWBɒF6tWy̋=vssFS?ZΖ X!)ZZ]>^lڰilSӶm$Z"~W~칳T@ن?/r/5i(R;/oWK""icB  ac6,$ [M7=x\ďDP___꾻mnmg~';dO'O{|cgZ 6h57G _<쑏xcxWB`V8$||{W:\gWY  ;_^T4v˾??;@PQH ƂS7G)CQJDED8{^ H€)ܖ7?wxۿ;zFlضdFNXǎ_?.m[6 oo~ır{"hLl 0fa0eֿ;" zG$ٙRD_ϫ@ ,BH,>^^eo/]&lTk;~woSJ)L  yN03H^֫e|7 deL_ᕾ[hxSJRFd%6o9CJy]w*z9 6lH,l(n~yxw?<ܟ7~w A/mvawx-LaPOG>1j>x7wxw6 ; \M_U}&2mQC?C֫rFa/R_yo.SH IV>G׈(v]ڈ?_s"6Hd27>?䉓8٦ B i' lֿsJ%|zͯؽthdp$Cpzw؞~7}OďTl l00 `l@DH"SG~؇˿o7??-Z\k||Kұ80D"' ?{ss;f6)6v&dmCk=R /}x̴$T(Q޻ٯ_] $!EHM۾.|~7A ",>S?_Uw~A!0A3'|W|4Dieٙ zK'Lj_{[oo%*dc 2H0$!5?/-'=副zo|tx 6`!ZfW/~W~cǏO{#I&A& G)c>n(jSZJeZ*=:8:@`|CdHZv;_ooU6δA`R#|'ÓOw=#H HP$F!گ/s>4~H N#5,ж|}+M2NI" I !gA)l% e^e?>^6ֲZ(Jg|w|˷ C,l[ -a!cFl '2#!.3$/ds6c9I qAW HA< e@6`I0WX\f#6<ll`I  0"@ <WHI<[sH<c g3 I\!a`~$y~$! $6bHϘg$ meD @F`^d !cFm` - !I\&e X`I<0d#B`/gdMAπx ̳l$6 9 sؖd$ + @`<_6AĿD<gy^6 l^x G`.x 6dd$'gA\&aL@Z 4\.AvLBB@ A O}}W|{{fEdf]B3s>ȏз?߮uL64>?w/ EX9 eQگ{mO҉IR֫i\zJiIuoG>>z`ϩ@ ~wW}W??:#'ܐC%??گzwuM7/rO~?(JJz{xttp?õ\wNE M47cN}=OݿQ]Bt|= ]Oy G(&Hi}V@`ad[y&0$K8}xja@% BqoookcqttBB`;]Wv/Λ[d2 I"DDPj'L& x\p1),Ҳ $IHafkB%3C<::\ijSZ|xo/{W}פRd j}}Tf 03J){G,Rr}!Zf!B! 8Z[k 5??p/f&lA`  $h:88\-KIP JG[^%_;2sn|_Ds; @iʃUkr 6&3霦p4&99m ]$Ԛ-KԦbqQ>M`!8_.v ?O/ϋ2/j)ˌ@i{P- Ã865H9lˀm̴ju\&t\s D l["Dpm  1gprh |#; y $BR嫼>1jr%Re(Qdku~{ǻVG˥- )B)FouOt!0WL-w/^\tb ! 9AofۿXXN`rjŋ}7@,EzyJJVK ;AK.%ZD6ƀ’ۀ[(-2S8%wG("JXQfID7~֍bor4d3%R!tQf0 s0#6``H`ĿL ds- Bx @` ~y@`dA3qx! ,2 0Hm@_2d@\a g 0WH6 d 0f'l Eijg1H<'1Mwvԙoӧ=D2ãijNZαks+|﷾[E3вR$™/W}W?SR(]N]wykm=Ǖ"IANj?RDqHXIxSR/rø꺮vk__g~䇥*eȒ %_݋]?} l PW*v]=<_?$$,ȈRTvl# s2`HT.YO % ED)T" `))ѕ3>W~{E5(@BQJu5Ka dgLGִm@R%[!>#?>c.cN^t}.뾫%|1:}k)/EI@2Zj]^:(!pk٦D2%@$I]?]DITK7-n8qf}NN]߿}h;v&i 0\fAdIQj-}IH4iuMl{=3?Ke*HZKLlmJN;[dH.i'")P)DL&`#}Xl:ʯ*_5_n^vH(I2@އ~oo_&)ȰQSa' MݐjQ)z6NcK2[L[ Z&6`$|>S)! ĀA2$.3$'@J Ij??P@ml@iaxi(QmcC,!YH/{߻ﺳ뻭cw}Ѫ"G"ӵQ__"2"l'28RJ,+&e6(*h67/y_{÷7;_24HE-QJ$ "vQjmH @QgIBRHdC1؈3Y% C^Wacl@j /:$AH%K؋wg옲wp9Eԭk=w7{{Otd6eƘBBm.l<'<$6ϗ ˄Wɓ'>K曾[A}?_oo >3&8'=IOz싽˽K~\GDHXb.¶k܏ $/mӴ^Ol;q(0R øuo0 (3$ T(  x&as?cdcl`AXAl)IH$c%iLaxԧ~'}֧|RD)%K @d0dض"[f4e:e$`[ @ [-mېHRD<{BN?c__{ϽL ԲЏ{%}G|گAll0J 7v~T1SCa T $5*X,>> ٬9%S+u1k?g<-'j7s a sPBQJF&жO|w7xn~'뾡lnY3Bm'/g0Nmj-%B"$EEa$ 2=M hYy?q SJY,oigϝ}{zR6&F$$to:JPF$ $ Lrچ&eNcǎ/ʧ|g4MԸB{PZl v(PB(Tj)aAF<@ellctfw_~'ˣm[Np[KkkRaLE8Ԃek^U={/fq??(u}'cȯگ/b/1bWpKIN:e_L]}W~޹p7).a;Ӏ@"tDHB؀ضݦ)[)ә4؀vH2@(,$m 84?O13eÒ9]n\, IY>?ac8wNqckӔ]Wkk}~݋{)fl~@A`/x$ 9ٖ :?{wvN{^^яylk+"""J)^_!y''?v{V/o~/wۼ?`5 $ &;Mioswmmm-=( BL6NmG$Z=g/\x¹v^8t҅ s//O3)||PkD z=LpkkqjQ$Ia|Ż{q]g˼䫿k!\jbX׏xG-DHQʛ(\~\/uI汗}>>gsZjo*TQA`4vp KKw]g]NiNdv`/.a[/a^^<7WRkuoo %D$~VIJA` 6`vt&n8!q -[mӚMݿx/]XA[~[MKB[]XҲERE I$@ HH@B `ijYۤm;m4DY?[/a ;L1ER"]W4 l tom*Gjqm{/λ{^t{Q#B$ID~v/wKw/~]v/]x}G?ŜG8"ZjIq͐!3[ffN64HMB $!@A!I $ @1Lpߝ҅w/{˃pu:&FBنgy~݋~v뭷}_;{ G{.^x;>?g{k{͍W}Wӄ-[0"ij+16E؀xnƶm۶mm۶y ۶s`$<$,!IHHg f@l@<ƶm0♌llll@ $I%`0 mۖmے2ƶm۶1 L@2266 K$$$g0M\!fc!^  l0زeLa`$IF@ %I&KFF HHHgij\fLWg$$+Fs$I`۶m Yl0gd"!y.` 9ale$qy `@~FB<Yl6ϟs?!,,3a-I~H~<_66IH&̳g0M K$mE< `,̳Y< lA m,l0ϗmD2 66χysK HIB(P @ 0BlN7nomʯ~7nϺZD֒}e>ż۞\WQ/X@"IT_%Zv/]P(LJw[~ dLRXJzJ__vٮ6۽۝xzt[Np@u@1@~Cň'h0d2n6؜onnF__\˗|1H'^Vgy-~p6nxwpԮ BlD.%JOW|WuU%4ٙZK458K`x\! l$R @ `[ JDIghjQkw)~_iY0 Elgڶ3mtKc@  )2" $@$Vv?S?;MS[NeÉ3el_h5g;'Nb7.& N[J0+Y"pK@B @"3Ⱦ Rml//l,6/K< Ck5lE 2`q@JRJAvs'}>"e12ٔI!I`;ӭ5`85C(M( n€@P}jjq߱w'l6ЩS'Cm $"Rj]G|=" c9(L{r6hrjmZF :׾/]P(UG" TST)BUKD@ @<!MęLgNSDDR^U__u4E pzK:6aͶlc||ծ.jL]i]Uוu+'>绿kkk{뮹~d-$ @2ˬsQ¥~?wYVǏ{AR(%KBRQA)%D2AنlSf4Mٲ-qBBfZ˴vfRH((@`P; ZjeGEJiebtl^J=Z.¯i(E]4{]? x҅(N]wmfLS KA 9I% f,6`^8\Y$$.3Ϗy6I⅒xn o#my& c` +L~6g2 b4z(  e6gN*J i2ݲMF;oƶm JK{J=zCiXllүr2|K>&Ӷi9=19v8M$$ )LTJ??|g ̴Mf8 i<3 B$IR$`0$6$`0؄ Rc ;g+v3v__?IGH,"H2Ӷm `IX<B*%$RP"]_C8DG1~~5_M^uαR) ض!u*%JQ` i(fk2$3e&aLmǏҙN;qÉ `. $IQKJۘi^)z3n:8Z˻ųϨ8j $Zk9'܊DpR-Hќۈ'ABy#I2 Iȭ<:8Z-Rk%JR((""B/]Mל>S$ JDBdql۞ fmԦYA0c^lVg-Ywuily̋CN2[|ٗ}Z.~d̳ؠ]"H//n{zW}yCE5Le˴3m;A x B$0Hi7hР i;3 $RH%Tw?3>΍KI>\9Z%ƸNgv:`e9 .$!3Z.ܲ,Ouw:::'>Iǭl.aci tD]WkWkWZjRT`mcvi$SY4Lp31٦iyqan0 Ov&\@$B ]WHzz{>{lu|]Կf]Ǫ2Lvtk-6*֮ݬZZTĉlIhLedFRj[HVBCL!(:*u~S'y۷|7|ÜJ7+-qL8p6W[keӦ%J]ZRR(5Hљj*T($I`#ly6ۉ 9g1Wq4^|q{~Wz%媖(AD)sG[z 0N;s:8o)[k)i2jLa5`HBR DR"$JPB̖ٚjIfNiizΜ233A6YX"I )@`6mg3899[-33[mc.2 "QR@RKJKj-P `;3^cG=-kw>JE&ә] ~2̳ Ŀ@$y$q?x&`!q`# @6B}zk{;qtD!IE )"8[]W?#?h9l~ڧiZ˩n4ek9y6Z N ii4eklT*(B6N;m۶m۶m ##ƶmCN0LZkήGoovW|GE6ز]_'O|?KB;3--t66F!!!I(RRJ)B )$6`6mpk XB0`,B!-PH )P ;i̳v6l-֜ӶB! T"JRjTs4f26O0I0ضm6*v/ã7yȐp\/ihͦ(:tE7 'Nl0 2F%`R/Cߣ|%_U??9j KAX666$mcVٶ[bwU1Xll@~EL٘v@)]FR53_^kgj9d0NT%aK c;[bc7z|{k!xt\O0lv HR wNs4/Fm.67N8u T @BXXq:ivff8ec # @`y~'$$$6`i^omn,[c67zy6Zjlӧn~wxK'N)"6Z$iR$$666HP$R"R#"$!`HH4 L `c,!j-!HH2i6 2i2Zk` L"J-]WK77S\ԩ흓'~Sͭb`gڙR9yj4N_y3 'O\g[S^Mqu0 kAL8  Il< e@ .m6ϗy!,x d^sx6d&I  0/dU 0Ϗ+`0 ~0χx6y~ gyf ,_" '6I$0K/*0`<'-@<1g3 ,KB`e6χmL@?(iJi m 0ce$IV e2mc 晄lK J(&`e P"@E}ғͭMkk|?ƿ+2}ǿe/{5gzٟ"Yl$!$I$BzI7xyx;{)t@ ,˄F2333 H#HH)HLgfflL` PDSvmX~ ?77뮮¤ vڶ BHalBn $$E Il$@FXip^<9?Swϝ?_j}w||ww\^t…'?7{GOyYnccd!__t]gI*O4M7}w|I)PJۙnΖSk`{ ĉ$24g2$c$Pd$Y j^=!o'fOݙj @0Ɩ )RM_58JN)R>"$KK@d4kTҥѧ}'gZ`C'e$2mZ-ofo*{}?_'H["3Y$""".Wo&oZlVҐv`_|g|/K=FXȖٲ4LE`` !.l3 AtfY?>y8A'Ȁ؈__P)ͭ֊@(R14%; Tk EH @F"BRH~O???WQg$B$̳@⹉gylY$m$L$I!.$6ͳ $.e/y&g1`g3`f @Yll$s ls3$\&.9lsH<'!X@\aͳY 0sd!0y$@`, '66+lBzЃK]Ys(JT ll6 T"Bᰕ)(Plۼ;||?X-lonnml>W.^(ـ `0NHn77wvEPkdk%s $E$@:Z-KLgIJJѵyWy5E^pɓO~ߟIC2idi-m?c@Q~_%ooav@fH! "!Ifgc' PkK P83y&g*3I$ l !< <~5Ԧ4;㻾>{y7~G 0dI< gd,m2`/ q?y. @B`A@`H0K 3¼lKd$x ?yalH`A<Ly66@HH~@ @  sز`d0x6A $ I$26`0666 cc@ dM !qmE $I@<2cc۶m6 Fƶ3IBBsII Im<1cy\&$$$IHH,!IH۶m[I`ll۶mI< ,!I$Y ƶ@BBBB9 YB<@bccH#I<m2󰱹L !,`c x&BB! )ij6$4p3 e+"yH\!l c0v $' g3湙 F(w|wQ22i&g~rԾM#$4L N;mH@@HHH $$##D"!)!Ŷ Zfm;m;'N;em0`g1&*%B!.3TD-6)pu7tsേx??=tt??6/R/>9A_Vՙ<)O;J-xOOS'O_yJ- H@B @ $'adcy&m2әؙLhvbcc 6Fus諞g?yꞻz~7x7^Z(mcEIP"$0 )$I$IR"B  v@ixW;O?u؉-~Gt eC cER>sΉcN?v퍍 < 8tk-3!q'pbs?I !,L!@$!$ k{}lq~wz…G=QI jE-DiNHBslcc1-ڗEbYsaq*!>U*m"PDRK-Rwv?~c;;[;;[;[[٬}WFH!f7923g<`02 022 yq?sZ;٬;;p|w?yl6뮻{Ou, "I PDB*<0 dlm۶m HBHI(($"I+$1Nvfff̴m۶sJ@c @< i !`a@cǎmmlllmmllngZkRJoo▞p '9"_yoo/y ۼ@<x 0,0I`#@\!g$!$IBBHRi`d`dIB$id;3ma# @B m'6Ӟqp?.g|{{Kԝwr/!M_ԙ8#6`I EJ($+$,i;[LmJ; -hvJ43Ӷm+ijdZ IR a$d;ayzCgN/b.]~&xn|W}_8qni҃o?hӪt[NBa L΢Smďk۽o6?s ?cR#L$`$, `H 6$ۀ vh-ҙim  FNd/I?c?<A7^K̋|7tC믽ws#o{xiyT:E !L&$Eg'>IRiLLbM6-r)<$۶33[!1F6H`F Xg2vL{Ʈ ΓOz׽λ}~t \p` MčBȰ{?S?? J)6BK=Od%$! $Iv4Bͻ~c1?wl֗RZ|}_՟nfdL3ZCξFW|׽[ŃS>SW~[N̺ϴ$Pp)*i{kw~'vskPRPgii#N)eig:mcl$dL6dH2!fG.w|wڧνɷ|˷ﾷx7{__s;ViC(ly, d060nٲeffffڙ 6 R I! @$m dfKֲ, 2dH 26,D"d. mYvm+Q~qZ˩i28fb*Ŋ_~_睾_sG>G>7^᥻S_u_6o}~#0`)*s \! e0Q"gB@Y m!0mwGx?~«ڬ֟fo6+ٜ F i I[u_}׷T@`d `IBD)?zZ֫zuztj}_u_߸:ث<= aABBڲ9ӶLOOٟ}绾+*LP`P-5J`fnJH6F\f*w'nض̴qڶ%-'Bqm ll#aE( 뮻]ꦛo|:12A cm@e-!@6lΖN23mf' m$@$*]WkD( ؞2!.y6,E*I!IHURD$!`0` 2%ۀOxΞ@q|Wȏ뮻h|G~~GD#!e 0`$qaF2!Fl#Il#q?<70 0f$^I<2`2d 6ijs6 ,@@~\a$ qs~'__nƵϪv6%!T@6@ PB褪(%TKH!$07ܠٓsqlL[liʩLL @8KDH%HR؁-O~ӟzjzxɘ_VC'AwOl~xxR/^_bjSŋgJg2sZkmj8Ώ_E_sf\9u0v]-$I @`l I("BQ  `#I!cgeDLj))u=]w񗺸{iPk C u5R(B $D(BR!ILSRy7ߘ-|^ u~}b1MKFrv&n{|cm~u-VDA@x&!ah  $I (P"He +l6@-ϣ;7ٟu |g|48E˰'<xɳ-evm;yǎܚ/|>_): Rl [??~Iq~vuׯJ7s*E i7&gb0;3ݦo}w|ӧ޷x7y`e 0 `$`IOBƘ\&&fĿ!"."! 3 f9؈gWdc 0|gDHH Ɉaa@B`.`@HX22HHH l$ B $$IHHH\f3 `۶g1+$qem\alۘ $dl+ $!!`۶m۶m۶1X6\[ LB$IHƼ $I$le9Iij@@ $I_dc`llg1$ɒ2ϗ$ ɒ@$@ !ycssǨg9}rZ.5f}'(%b *(@@ɀD)*%7H"$26䴢 AcaV8dKxGď]ؽ8;m+3-Wi4mSNSNɭ9m,R@!tHPDF%BYfBRTDض mmۀ[lq7[]w]woou""RJf[2 li[z&mrl͙$B*RE*RH IN ]Ϻű?SNsٷ|yyao7'{ 'ijRB¶Igf _g]ܸqtryw5DW*Hll qqi11ir6H0$I@}߁BHHHHH$c`0B$IB( !] ?Cð%N:/1jiٜN3+#2;B Id"!i g1$ #BXr $ZKWKEDDp?R$ I﻾F)*"B T)jZku]E(RJ)hr OpBBN֚mgamMSNS)SZk-Ć,!2֦iq[M٦6 m\g4Ʊ{n}nllLΜ:uI IB"H Fy6!!xNg$I $ ۶%ؘd۶lٲ@HL$I$I1 $+xg0XXHHH$Yd%!!!   `$Ix&0ض POs?^u^hjUJ@\f0# KD:BRZ"J"\¥PP(2[("" @PP L̖)=Ct??}}O{_5^>V%\"\fPZvY}b$$IKƉ,$.WW//T$lͶ"na) 66 ɜ2)Nijٲef22Na! *HZ+(a%$BR$͍MD]?CauCT`0؞Z̮;~~ZZahmq=v/]37iRkRBI` 鴝vZֲl-[-KkZP"B $ ȶӒ8A:G\E_~x,>>38:M6 I@@viʤ%߾t_򅟿5MSfckP" lHHHL3D54i6E)L! I )QBda"E C`@`2@(P BPw]_6Oɓ'Ӵ]s}ӷ?Nm6e:3 ӒRKZJD!qzhӘ-% al֚+)6ER-5+ P"q5zDARH%@**BRTP DTkQEH!DM4ID ln٦6 dj:nʒLeccRX"IvP˾~|~XV&ٜ9i?8 iZ(`TR(ZT\f ^4s$l0+l#I +@< lsx0~a0L6$ y6 c0ـ@ ` F @`03  @9I`0@qs2/2ijg!@ al H<̳"`.3<@O M\!$,x(TPQ~pMah(!V(m{ۓ>?oT ;˿hudJ I!!qXHH$IȴPQZѩ" "׿~0-cYanNM`V(( Q^e,1LS"$LBXjW"}ot}aw?;nؘc|6R_߉P s?$$!ZkEPBOƯ3g tKK:J(BjRJ Q3k!(P֒%ZDP?Ӿk>޽}fFEBC ̓Of=XRk @s6Bm`P"(EDPEQ"""""DD*BPPX(V$abc'}7|zZkRJ)) @ #cm [K@WRIv߸y]{M7_٪533 0B(UQ*VQRUjNREAQlAHxS7}{ıýG>oo9MLۆFBRj)@6&EFnC?ÿ~|W}#9km1$4ĈliKp"TA).RUF )BQPAU*Zj)(f"J()B`02!!!I(@HPP(j)[w/o}ף[fl۶ I!$u4>[j$)UQX2x>R:h6@Ht]PT(QTJUDDyװ]B2`EQ(R-/2@:HdP)"ګ+Owj$$IIRW"BTXEBH(PmLlK("$$!)H++||G| 0h&3Nԇ>!﻾RST*UD)RJEHBB<qm۶mO '$I$I۶my^@ $x&Ld 266%K66dal c ll۶mXHHHHH dalll,!!Ymllllm۶m   ddm`c0EB y6cۖ-IB @ c$K$I`0d`l0ض1F$I۶B<`0 I2 I6666XHx!!II$$$$$IHH`0AHWHHl l@<7ˌmضmlll0g3mcIl$0`l b0  ! O!0ϟ@x.s3χͿ`@BB<|IHIH<`@$/2y&"0n0`. HsyA26`'66Im3\aͿ<6χ@\!x^ /L2`1X66X)Bh<0Mc)[6ekv:[6NR.b\.~|R&zl-Z5MÐ᛼[V$EgˎL2mr?C_7=9\i5zVq\[kk?w{Cm-lp"$JԒ|ε\ww鑏|} P' LH  LriX-jXa=NÐӐZe_U7try+[DdkCw}yg}g8h\is4Mô^|§~QUG Eo{F)u>i{]R)!grKð2<<]jՕjc([/j5Lwyl?xt8S4a^~onlKwy76@mEZN-n-Ԗq0kO+JmMJ" IR4Skju6^-__GSn=wBFeawubW~WcgJ>~/ !9"$%DxG<06 Y%K-aH`0 %BBXal[dN]wG>GB(B $B--[Q웿[>?ij-3[t6&Ih lǷ7GmmmS""T$H=iOt jә&B!Jn~D֣[febiO}3F2@ $a#$EHP0N[|G}ΰ^mi-lgr $l~~MW~\{/_xi&@]?{C5;;ϝ˿wlgؒ"$FqN;ۛ/2/g1NM`c[oVo!A.37|iK۟_{;3?E_?3tpx^K]y//ܿw5?s׎EKclixcֿKᡢfft6l(B@$E;ۋ4MS͙Ngkq{Ȗ0_5_c:|__gܞ9֢DWO+g~֧LtB?p&P"q/ٟ؉;>.]$gB\! 01Hxc,xy6Ix !a, 0YC0$Ye|H/ۻ۾[ǡMj{6u?;?uKZ)[`6$[[P//vJPD?]mS[K#J`egfE˖.Qt0e RNS[ۿ|:+BvڶmY؀` ٢ԋyYvװ{_5^_ww/JƦZ6p\^ݵ'_5()e!tbir&[I` ?s^_i6B]JH cґv`EW__?.]뮻^_ۿ[e6]9\:} d;MLi˿ KoFot9.a=S)1l>ۘ6ӧkD  i+ʫүJDt}Zj#^u#z0_EN; jmRD9~X˼plחn雾~g^ukj,lLc0&D $teŗٗ|y7~g|GA2 B$%77~7z#DzP6viB ۽__2 m a6i iKԉ?pP@!,DTJd6tdœHzxW{W{!m Jgf:kkvZJ7J)E2gKg{{/RWcvH)"ҦS>}j:;qX"WxW;ؿ!I@$@!$(#ۙI:٥/'X9Gɨ3 YB?6OÃZdcc /?˿F!il@K)ooovRP)ER-uw]W={Ԧ='>3>Z"U%Zh Ryjqu7^<~'|rk"j'N:Z;s/2o llSa}j-"3ƙZ?ɟۼ;D$drxxʯJ?3?F Rvk;3ۿӻo%Ręj/r/7rtF=~ĩ;.[-gok* B([nMi.GY_piwW!la,@޶mpOS~h9ezWsƄt=t:in٦0Liv;}|Ǧi3RH0$$I$$,2pNȏͮ=}zwwwg|u>֧O?w=ڿHe`tfN4Ӑ`l;M'}|ӧKBi;3"Daj3_}Ϟp\Wp{~ڭO𤧼{1e֔If*l_'Nv/,G٬ZKw/9y~7}~ag*6ƒd"Iחҕtr}V84Z |tw<lVaKdZ4il8 S9Ns?}//4 JGZ6`0X3 ƶ6fj1avffff گ_՝퓗.w|7yaZH$2i\GG/a2+lAӶ FM204AHŊtd* $oo^< eeز93R;iiYun0`llAHefkRpNӸZ./-VKvtx a)KAB(TDRBq\j>Z.׫4HRJ0660 Ȅ (RJc2t*:bFtD!bj9fK7@d˄ ;@ŧ||w}M7޴qwZj-Dk9\ڻ>eoΉǽ׻Qg x&e#08K/^p܅sw{=g\l^{?y}sݡpږ&L۸3nnX_8;qssĉOޚ?c^j\zӟ*t7?;>`6(z}s/٩M8yN6$!@۶e/m۶m6@\fl066m۶$I$m۶m A YB 2q@`۶m$! !!!!!!!!ccc!!!۶m m۶mg1xy&|y.BBB<d$2mc0/,$$I$I`mccd 3 $lW+,$ BB`0+$$$$l۶m !!a\$ q 6I @ $ q? !!!!I6mE $$$$$s"A6X<7I⑏j!M0 1)Z<:<uXlƬ}Wk)Q-[N̖@Nwu9aCsil5^u>>񰇆0Ζjj/}}7{ r 6c͍Wd6ۀ0N\}eʙCj)[EkYkiM  -6vbS _O}7xyQ6mZ8s[ wc* k;%3  H<l\ E&b dy& ` Y 3,cI<7`@dOm 0  `H0Wsy&,0gcI`0W2#clH lI`y uCR:9,!R PX9Kfk\0cA0#.3Fᶄ>Q/bUb\:Z8{=70^a R|؜Źw3ms>/{|Y8ʶ=a~x)4'p\:g:,Ӷm8!qJ-dHTd_eO]{mnYKq¹\=IOBJ])VLH/] ZKQ0ldEDyʓ^ؒIV\w-Բ֌mE;߻ uÀm 6$1FX؀db/qęa\_*̴mSM|vwNnQ:]{ck㑏~8 Bi2dS?XG "T2SRO}}U-e(4j=k_ 'wRP"J=kk_gjY2%94I Ԧg~ٗ(q$|^RR$@&SuK$(v I# ln-33v:m'p@;@ $ HD9\Ӎ7xKkS)g™Rq&%$ c^]oqg<)G *@$J~\Ca5J\r Q%. [`iؗx%Npn{w~GFζ c 0p1-^^uu$hGOޥÓv*ml#BXs|Kc;5;Z3KD6w_ڕHMZ^e^J)ƙ28mB|ׇU0es 2I\fl6 '$6xIyNy` , @0H HH ['`$.3&y&i   $Hyۀ3ٶ8H gX$$ 88axn\&g )P+l `$@$@`vC`0dL $)@H #I l166 `c1&I%g2HF@%H @A\aaۀ i 2I $@q1ƀ` g2+B$%EB`L@H ,< @@B #d6lijm0#.3$ gbHې8El d pE`6 L@ \f1 e @ $ 3 !$P@ MbC!q ! I$d$ \l6', 6`l. 2@RHBFl@ '` `lc@$$`$$̀LB2N0N01 $.``01bI!  \ `,.l@y&@HddͳlB16q`+ yI\ay>$ B€- @ͳHxN\! 0 gH6dHOd<'!ƀ$my>%@ ͘&!0y`$ ,xn~6y. s%Iy ,B1ABƼ xQH2<$@`AlLlK1`ij `/xNA2I`+l$@<3Yl3s @X 2I6ɀ-x A1f "<$,ls?I\aلcx&s Ld!csayNllH$2`̿DȘ ,2#y$L6`E l$@ 0A!@`1b0@d$ 00♌yI L`y>2<e csχA\a0 ' g2 `xl0E02` @ y&qA|`Y$'@⹘g0@qij&$de2 H< # ` `/@0 @\!! @6 ̿g666Ϳls ex&eB\f<$@<ƘlL` @33g  s\&C`<@♌ ⹈b+ L9 \ <$0@ `3HH$c̳qxsA`0ƈg23 IY `0I0``$@ x&LAH<̳+B\f0/ `03 #.Ylz~ƶ%!q`,6eBO0_b3#<1Wx` dوa3 <!mI|\!eB$s6bs0 s?/ 3$$@0ll|L$ "lyNg1Ϗ% ̳0IOĿaKy!ll/3ˆgy>e0O <'`y6aͼpYb 6 ˌ1A€A$glx6`x$@3d @0Y$ I6x6K2I,H` ey~$q?<'!l g$l,@\&̳g3C0ƀ@W  yyn [\&9 $a1e0eWb29 l<'I`&@6Ac!' <'I6`$^!`dWx30 aH 0 g@ad H6E˄  y&$ ` 0Yl e Y 0MȘgys32 @6!<  @y!.A,y 0LAF€L<` q Xl'd'@<00!`02 0WqA ,&^Y 63s2 \e&2\y&x F <+̳<7ۈ dsy$I/BK2lWH<_ lA`, ^8 ,̳  $`0+3ٶe q? $!@ X@s6c`d22#EHHH m6`@ Ey  `L \a\!@X  0 xNY`0$!L2`ijd@ddl@H 6< `  $"2/0\ax~̳`^ W,6+  0ŀ0A<  2I<_6`F`@ȘIx&cy&q1!l$66 ,@<$<$6Yl$@ly^LmgHl@B <l`H0$q?L 6Kd `.3˘3IByIl.3Y<sy~Bm/I`g$@0晌x$`By!l$. HJs3Ř2YlGW3~B$0l6, s<#dI\ayN `#q3 P 7}7>qdmj-(jdF]Oy/ŒQz6X&@($a;ۅKJc?VJv!R/r/JݔPu=A"H\!&o;v$;{w20K=!yW;n5g2ٴlls?1x6 @6C`mXcGr|' UEH@C )G|UJNB ya Mb}Z7K9m[m@ӏxKmw8+ݹ;;v,w<On].̓]R(qb@| e<@a B2q÷6UFLC鶿=MbFT&X%ˇ׮&Eզ5{'b0vkN)ն6tvqF@FxGlyh2*EwOZFb&%$airz'La!lxխnz_\ʬIbWX2O=$/AAյsv֜16`W_xcM$f"`lfOtB I<慑`,y9s1ij~B6Ϗ$l\f$ `#qxf#B63IW\fI6+ x&c `$ @6`@dg3 . B1 A<.mnn>> LD 0$"dJkKkcoYn"#ld)6؊܇=^c %.y 0B`),gZz!/)M) Pm:.=7:ϜkGzR6 ICVk|DYk69iYdw~x}cpLyc~NߨNۂ) 9~oר81%I%sOyoADXdnxC?;IM6g^MwBg+@bHct??˱J$%,R!VpGr)q`Nl)6x_mlA`\f`s2/A\a/0ƈg20 1F$<$yx  Ix@lF`x6 0 _$$00<He%Ls/yQ\!IOOF7$`H)步!J"j]WWq[$_Q*%$@:ZGrL)$#Ad[_{?߷s߽>}>S(6y&#@ ]t㫾I:GT3hmS7=rtz)z*-iZѰ)Rd=mr5(!% ۛחsv<;AN?b HPHUz|~o_ԋs>H0W~ϼƭz?ŃbW der>(p[7!; _>$\&BBek!)OMNB A$ALӺ4]*A`a(r˽a=\"U1Hq6o͟r]" $ V4yZ"Q) dIXX]jHzX&-U,@`5ݴ4"(PRM4Һ1wz~fyZdH$pX0:H28pAilkZKN0"l؀ij 'X< 0@6$6<ͳH' IHR@Dڴsogx_-m ix6 d 09 `$ Wy.Ez{1ND`>F7c\K駾6'-76a,L*ɩ`5=N-\.mq9NΖmHHEJ &|rl+>VSmN/ BRD5=ϼy׃׻AF-5[}v/c}OFe.0+ `6n 6yzņ|>R1 7ҷޓۀ `:cf*`EPy2S J`ɥayTIHFd;%Wy/xg8aݰ¨8FI?tno P( FG4 Hl02ئM1+0ؐ€ .CժbMb{عRj_f$b{?17isd2!HL7hleZ4YT\0H ̿0 a#, mB^%.?{䙏z,]-eKw}g|쯔zh7gBRJ ,ladlg3"Jϸ|]]--{i/rp7|˧}'RH16 0G~>yGws5E(7~|M^Gm !P "( l"گW~ŗo_O1 l#I`e26 (jxj}igs.ݷd ѩcXu q^-_նW1Oz|7+]R3jxw:o9U |j+ٔ}nN)q*q~즗ؙHE%rՎ^5Nwϸ4A0$P}n4Aƶݒ6[{?玃ru3=F  fze}t~#:?u2[˽uoNݷwK3|?4;68BQl34M ,ۉȭ[ooYDUccQg;⛝y9~޹KN;„*6Nm~ҐeQiKxN29H6I`H%:D^Z_xͷ~@+w۬ܫ?cl2 @A"#^~yxXCêϺ]ZFv{{N\.,gt8ENr\o㑦 `gr2 )eqyxۡHnn.nywھǞ9YAD$YX`hXla0X6$`8MmjiF\& EnSV'qr9VrǞ{[`n YUSLd  LT $a 0Iy6Hl@6$0$ A<'c!cIy  ax&0/$ۼP6l%;d!1232ƒۼpY  B F<لB`0yg21/*! <$m`M<1d2&^0 &^Imɘ0@<@<L`$ls0&B A 0 XLg1d @ضmag366I$ yAd0 $dlض$m۶mcI$I%@BHH H6lc|HHH$ 3I@6eL$H<, s?`06y6&,Ycc~ `06x !!-[F !!Y$I$mK66`l۶1 $$ij `mc0y&$ ضm۶m?{/]xrZ09&Lo;r"DjǝsvNm6i )'4hi"hcךq4ܠA\&</Kw<ǭ66id6Ng6MO~}YīwQvt^pj:) !sbOP#vMlTJQ-"c0c; +0s $(p@NH+\ `F>`}ju= ȖI964p#'ܰy&[PPTJQP Ǣ1ic;Ɓa4p4:< iv)n )zER":T @ IHly6bc#!\l ij sle6y̿D9Lxz=_sot]ڜw?'i#\a {k\.WG/o}x:72%9lQAA vCBHHQ,I - eBHC0 [i08  K TB"TT:(֔e#+A>N!G ~& $IAThͭi,2WH 60d#<3+`N!1W0"$Efg#a@6 ad g<70dH#q? < W20_ŀ9H<' 6"q1$q#dw\:Q !$K8LMSmZsKc;]?u_!IEQk PH%JH' c "+ PB a v' hmr&A gm'($##cll NjD EeQ^aAw{:{ݨe@@@0 aIJZ.vs '>#>%_j-gϞ}ӟ$BE8 ض d80Fwk;]u{^%^_q={n˿??&63SefszXn8]Mx#~otmZ;m sw[b ArHcFlɉy #d g㋽N < K?;xuQhZ\qc# 㦔\n}c1zԃ.==cwaijB ` JbL퇿楋v8^ug[:.σOsw:C~6FNy>ɳLAmrVmO;<d!ac0<``$!YXI&mds43`,@@EF!I(PGgpKg3۽ Ǵo[`Lx=,*^AApWg QzXw^zI3̘+  @`@`FA0B؀@O0E!a$/O,X$ e#@663\!xalNlA!f ^0IyJF H 0M`g9g3$`l@ cI67j-gNЏDO cNZӋ|ęV)֦; A(R 2 RDR"" !m06 a!KH@!$DH0+ @b%lB* u"$03LF 7|-Zfkv ŋ48QH8l a2@ BHRJQۛ_U_qxp@hV0N:R/<1횓|'K] g:vͶm66p)w}2!/n_W:7H63fj; _ 7?>>T$(0WH gLH rmO->GІ5Tnvlt7˾ɱK'G\NaРc2FVa^!$ SxYMۛq]ӎj_Ójs}ԣ/ۿzLlHN0j4k{x>q:+|5l/g_:6B%a@HRJ*9Ǿwě'\M\e2,f7>~x ]ܵT#D F`.3%qz-)tU%2BXB, v#!0 , @F\!0$$ri @`KP P +$2;|xpP(&Y774?\v0`eǶV JR։su7f_ܹ o?C]ʦy!\P@6`Mv=BN!EhV@&!!IK-3Ab@ l"!H ; 2l#0χ(QEQ BN$arWiʉmTnXW>{~[eDPXEM,AAA,lm\aI` @<, ",H2xlKdĖd9H<7 Ƽ 6C x0@`, 53 gH<0 bIc WWlL@`|!^4 q!y^1x#nay𩓧λ8v}ݗ[>O||)vH,0H! 3#jyx_vw/~_'DE``s"060BQ{'GwɥnzىS M-Wwq̩Sɏi,۶m-!!qIl,@,Ǿډ~E_ٽ=E46~zGD%^S~᜝&cA -~z؋mncGnKc0` `K@0H #YRfN/]Cgg\{H9k۳͸t}[|CWv2 tgsDiLfSJb`  tINM-iFH`FH  @@( 1X<)$@(BmZ8F£4Y-bs_?OQB $BynҺXQB*vptV[, $g1$.6 \!0&!clH m@+y\fM` `Fy$񜌅@`H,<, @<$gms?  # yA<q$< 3I<m!`c0EH@69IYl$.`IL`.bI0`es21 lM<$<sWHl#I,+̳\Xe@`b,#¼0$ "<$@1k$l+$l$MȘ$.3eyIy6`ؖFx^~E!asmIo_u{fkOQ![0W   @!a mԸwx,Eoѯ|j N_ǫ?OTq6 Զ~B bn Dip 7Zf69$6 %)P #!Ha08m `, T5a`l6 qZ8vwq=omaN<R`W~ߟ4e @-O?{fBS}mcY <0@\&0I9~6Ȓls?!c\fg̳X _`Fx"l ̳ F@ G\&`  ^0LdgBlF2g 0C<< +$@`IȘ .W `c70@!dؖ ̋<͋D<`H lKd3geeF0dij<02~6f̀j.33I\aH\&qy&aL0` cx @Y` q$@dX^*Qp2k+3Q$E.,!336 i'dERBBRJErD/^8?W?N88:x~g.$Hax}q^U/^_u뻾m 060y6q@@ dBdH%B[;}5 ˃$X6JA@#KA Bؤ\[˳bmlM?JAв0mtG_?`d$#!ý,.֑U= ㆄ%c1 A2B@  -H8Ƕj{'?zw.n^mQi%+$L%bcMڤA-"fa0 " H{‚@3Q`i@l! 6WqQ(6 m*5&C' sf,$Ƙ+$ !,<$! ~y 2` ` s@<`0ly^2!3`0W q01H\!Fyc@IYlsd66`dL@ 2Wa2x$q?Il"!/W@``0 y2`l0/ cI09+ %I l eBB0 6Cy6x6 !1̳HH\! lea.$@BBWHy@3F⁄Bc$.3 @HR(JQ`v6b{{c'N8v_q=p qC66L#y\6Mv:[ֲMٚp m$0DD6iδ7Dr^z-yaaUH&G(Jf]B l8&y& [ko^^_^(6`ipmt66e2lS9A `0+l"VukS?ڨүK{αj͊* v-ahz\/4vFN1=Mʡu[??fSB!IBB iO2n18gݏ~#A;(%$$$6$$H)E,la@ $I B#dڔmtԕ[FiiB`-  ``IҶ@($`M띜\0 ]?%ڃ<_MkBzۤgb0 H& PHRfLuacc`a0Xb!*I,!:4Gh4MS1=HCߵ([hWYIĬyLd!sJ;4l!)Pa!(BBBԤ&bW:rosKٙ[^b'b4ӠfҙlA QQ "0&LgÓhxr:r!Og2K])a~7cVWxQNl&'vzb8fk8N8 4mss=x 40  dE`0`m̿D<$I<@<Y$@`x '?"0g@晄x!'/Hly `gFy&Ȅ1% @sl͘g13a?,6Yl I 1/mZ*$RB˜Zښ-6(B$\lxVjEʖER(%""BT:Qz@n%⫿_Νu_ >kk,l@ HΣw.;y'wZDb2*ze)Z@ 03F-ݜ AD @M/y"/4?؛ԑ !G Rb휞.g^_< 68v6{r`x.~ @!٫ko}ޅc'nbI2–qH:qm0E&QPQŶ8[`dH$X Ս8[:qasJRjm{)ԝg+W#f֎.祝\?$"EryC6[qx>SjlHrc\4ZrnPF(U~kw+Kd,7ˑEi&c MD&NB!$I؀-g-  ♄cFBEdg3\!A9HZS lllGtS[+A  `  e)w}ppqK?{}H|䫞>nwwܚ/MLly&"ۙB\fH(䫝𴬒#_z?IKX5CrQ/{/~T0 @d&qi @\faI s0.ܻt;辽Gv( N&K\7KɪDJ`lLyJOCٚBs! YwvRSjon7ߚra¤yxж7xƊihtjw{ulG_S~BSW -;[ٛ×]u%% Eⴱ ikjn 6XΏn[o_x<~o+bF6ِ P(ø58L m@Hc3 U2 F R3b9alB< + B0\!x6Fx^63!.3M⁌1 <6sx&L2y y!\  <6%Ȗ0<7<lg3W+ ` HHsWc1H$? @$ag L`I\&.I$W< 0/y^$0 c0y^yIy.B\f,lc`#qAͳgfs2W g2 y/)[N [!D(yʓ2MM)[qf /Y|^Oxr(km}7a?ܭ-/~_^}KO|7~SԽK |?u ?C?xҥi\|-__{]nLm!4;K?}[oA?#W\M\KzcɟkrͩMZ6R [48>89Ӷ3$N[$I*`ll@ q@gLș t*3ozw{IC>C~Wu&a62ll۶'Woox}>}ۿ Oy8(Qlm=QOZ-^s~FLO!I"j)vnv[g~˿+>>pgkc{{_yy& 0FْX>!/sѿ'=ٻ:۔"oz7[VR.*Dd dlfj6 \!4{.ٍ{ o KPXJv7{򚛹Re`ldsf[mq 0$ I>cQ4;[!lv.66oxה 3d6 >iٟwyw޻^^u^u~֙$l2@Bl45E_گ3<7?[[qlSF];;w{{'O;᫾."B)R IFBv(1/zW}}|o7)$ XzWy~:?sԵםJDM70$  +ڏ/K׼m_AQQ9]4Sqsp't)` fBF@P z _]d2eK%$Y!uOzSPǼٿ]I `8!inSP6 [\!$<$gٸ_쑋AвBͼj;w< ED&u 7SKJTB"d7w/}ӡ@)={#wG4]}:,OvD(s\soًGnȀS`u/{즗<<ܯ~|7;6h*A8[e׿RSY0@QdNK1;krpS˽xS-`U(ŵѸך=*}aVk(%"X~{=}IRDD6׮{{y]w۝ 6"a ` .3c%$gH<_63ccs=oZk(M<)y_}2kmr1d+ӞWyď{-7RZmiZoݳ f ۲l63l[NLfn~IEm!@ 0$ Au>뺹*5"&=Y~-~o4sI4<1McϷN҈,{~=w݆0[i ۭۛM|Jt ) Ǩ۞M;_po4X nsoN0daL l#$N_yr'c`~p__9P̝ ae `ώ]_uے  6\G.=̉egfFdZ#7=_-{uꆍGp0P鶷)Vp0 d!eJ$l~kf<&ie"J%ͤw׿69]94#ŬZۺfUp &!my|>ş=Oo7^t"'ԦໟƟ]E\f ,@SY;˿~;g:Yxrhŭ_Yq%,p&6‰}QF5ѯ;_>Ξ{O|z@paN fڇ jHH"J3w]>Qt$Ap2:gl^ڈC  1~1ˀ  a ` @ `#q?I<sA6 , a"'E0~$q?63I`$@`e`B< @` 3 #62sx&gL,IL6I<H#ax&cqmy& 1`$+$E2I\a[!ŀy.s3ag20@\!2 ,9<c @B2dy I I`Xdey !l$.e H,,63<B x>lc$q1yI1dWijd.lcq?`!@ym1& B1 6 B$I` @1 <  @6``.yA<3y ,e♌m^Iƶy.χy6 .yb< 'IyHHHH H6y ij ll@\&lI`M(J 0ϟ<!' y.χ2O_\&0A< ! qy>l clE0A<ijHH<@ @ LE!!as?0ؼ$/ms$~1A\&M <\ @<@ 166 I $g3g2ƒx$l^0,6e,6g`| g̳#<` Y I<' HxTȀbBWg0 s? l@\ d `+ cs0$I#1A  H~y # <ijH6ey.l, ` gg9\!$x6mI$,/`o#? $ `F<` ac@<@B\a .$g,6ŀ@<0 "IH_`.0$M$6 <<Ip&.3$@$H&H@@$'CEa2W˄x>g~y^sxYY `19ijHlcmx!E̳ ̳Hlsdb[ 6 q + ~xI g a,H`c,B 0dc< ~626`6x 6 `1Ed ̘ < 3IB6HlB@y&!l $AxY$lFx L `^!E!M@ g1&g x6 g@ ij2Eb0$ `x 6W _dyY\&$ gHIyAm@d   16`6L$ \&06< lH !3I€ a[x&6+ `H<< lx<L` Hay6`<$@<1W@  @ x.@ l39I~l$6 s!B~ `y>$. Hm%sY3@<_d # qmsdBH<1d$g'q m$lEl s< B\& @2IƀxB HxA, y   60`m$@`6 0 acIdH<'!2Ϗ/: gl2HB1`+ c@x<aB$晌B` @ ̳g2y x.1I `@@ 6 +$@6x6@yc!63`M Wؼqy x&0+3 @Y 06 a3 ls 0y@$ 0$s q?c $@2Hq1 ͳg& A6 0B\f+̳`y2 c0BX`,g1dI  a,I@ l$ \! ,9g2g`0A<|3y6s̳3l2/ l!^ɒ$00`0&0ϗ@<c x6 #x` @ 0+ `@#H gAلd?g`gx>< 2`̳< l3/x&l 9 0d1H0@9ij`agy& 666< ! "y\acH\&^T$sx~ 2s@!21K,0+,ec qxNyπx^9e@ 0Y  l9 y9I6A $!< F$$@H YijXLJ~̳ 2/@BH<s$`lE 0d@@s2H\fW0d+2I &2,0Ϗ0B\a+$L1@W̳ qdL`y sy6\ls?#A9Hqxls$\&B`a B2s?qq1H@\f` q-H x9!<7 Eg@dMs3W|<`ABO\aH H<L2~ 2g1 02` @\fijIH<CFB $ijY `$B <@B<\&s0A\&0 2E l/ Y\&<fxx! x6@q !MgHesW ~`#!@H0@<'g Bij @%@ 慐$y"`g !0 $$s13L s0`!0`I` Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted. THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. ---- This LICENSE applies ONLY to the packaging recipe in this directory (packaging/aur/), i.e. the PKGBUILD and any supporting files used to build the Arch User Repository (AUR) package for modulejail. The modulejail program itself (the script at the repository root and its supporting tests, man page, build scripts, etc.) is licensed under GPL-3.0-only. See LICENSE in the repository root for the upstream license text. jnuyens-modulejail-06d8d74/packaging/aur/PKGBUILD000066400000000000000000000045011520651617500215410ustar00rootroot00000000000000# Maintainer: Jasper Nuyens # SPDX-License-Identifier: 0BSD # # This PKGBUILD (the packaging recipe) is licensed under 0BSD; see the # LICENSE file alongside it. The modulejail package it builds is licensed # under GPL-3.0-only by its upstream author (declared in license= below). pkgname=modulejail pkgver=1.3.5 pkgrel=1 pkgdesc='Proactively shrink Linux kernel-module attack surface by blacklisting unused modules' arch=('any') url='https://github.com/jnuyens/modulejail' license=('GPL-3.0-only') depends=() optdepends=('kmod: provides modprobe, which consumes the generated blacklist file at runtime' 'util-linux: logger(1) for syslog integration') makedepends=('sequoia-sqv') # Source filenames deliberately avoid the .sig/.sign/.asc extensions so # makepkg's built-in gpg verifier does NOT auto-trigger; the sole verifier # is sequoia-sqv invoked from prepare() (per AUR comment from Velocifyer # 2026-05-24: use sqv, not gpg). The signing key is shipped in this AUR # repo as modulejail-signing-key.gpg (sha256 below) so verification needs # no keyring state, no network beyond the source fetch, and no gpg. source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz" "${pkgname}-${pkgver}.tarball-signature::${url}/releases/download/v${pkgver}/v${pkgver}.tar.gz.sig" 'modulejail-signing-key.gpg') sha256sums=('d0bc12bab98f481191e06d39d2df83b11d67556319d1428a4b15a731afb4e6a8' 'SKIP' '5b4f8bef3957b8d8f91475aeb40f398dc87b550b7bdc8458b72661112b033433') prepare() { sqv --keyring "${srcdir}/modulejail-signing-key.gpg" \ --signature-file "${srcdir}/${pkgname}-${pkgver}.tarball-signature" \ "${srcdir}/${pkgname}-${pkgver}.tar.gz" } package() { cd "$srcdir/$pkgname-$pkgver" install -Dm755 modulejail "$pkgdir/usr/bin/modulejail" install -d "$pkgdir/usr/share/man/man8" BUILD_DATE=$(date -u ${SOURCE_DATE_EPOCH:+-d "@$SOURCE_DATE_EPOCH"} '+%Y-%m-%d') sed -e "s/__VERSION__/$pkgver/g" -e "s/__DATE__/$BUILD_DATE/g" man/modulejail.8.in \ > "$pkgdir/usr/share/man/man8/modulejail.8" install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md" install -Dm644 CHANGELOG.md "$pkgdir/usr/share/doc/$pkgname/CHANGELOG.md" install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE" } jnuyens-modulejail-06d8d74/packaging/aur/README.md000066400000000000000000000147721520651617500217070ustar00rootroot00000000000000# AUR packaging This directory holds the canonical `PKGBUILD` for the Arch User Repository package `modulejail`. The PKGBUILD is tracked in this repo so it is reviewable in-tree alongside the `.deb` and `.rpm` packaging. The published AUR git repo (`ssh://aur@aur.archlinux.org/modulejail.git`) is a publishing-only mirror: `PKGBUILD`, `.SRCINFO`, and `LICENSE` are pushed there. ## Two-license arrangement This directory has **two different licenses** in play, which is normal for AUR submissions but worth being explicit about: - **The PKGBUILD itself (the *recipe*)**: 0BSD, declared via the `SPDX-License-Identifier: 0BSD` header in `PKGBUILD` and the full text in `LICENSE` next to it. This is the [Arch sources-license recommendation][1] and a prerequisite for any future promotion of this package from AUR into an official Arch repository (`extra`). - **The modulejail program itself**: GPL-3.0-only, declared via the `license=('GPL-3.0-only')` field in `PKGBUILD`. The upstream license text lives in `LICENSE` at the repository root; the AUR package installs it at `/usr/share/licenses/modulejail/LICENSE` on user systems. The 0BSD applies *only* to the packaging recipe so anyone can vendor the PKGBUILD into AUR helpers, mirrors, or templates without friction. It does not, and cannot, change the modulejail program's GPL-3.0-only licensing. [1]: https://wiki.archlinux.org/title/Arch_package_guidelines#Package_sources_licenses ## Publishing to AUR Prerequisite (one-time): SSH key registered at . ### The normal flow: `scripts/publish-aur.sh` For a tagged release, the entire AUR publish is one command after `git push --tags`: ```sh ./scripts/publish-aur.sh ``` The script reads the target version from the modulejail script's `VERSION` constant, verifies the GitHub release tarball is reachable, computes the sha256 locally, updates `packaging/aur/PKGBUILD`, regenerates `.SRCINFO` via native `makepkg --printsrcinfo` on a remote Arch host (default `REMOTE_BUILD_HOST=archbox`), clones or refreshes the AUR git repo into a scratch dir, and pushes. Idempotent and safe to re-run. Flags: - `--pkgrel-bump` - keep pkgver, increment pkgrel by 1. Use for packaging-only changes (e.g. adding a `conflicts=` line, fixing a dependency declaration). Same release tarball, new `.pkgrel`. - `--no-bump` - publish the PKGBUILD exactly as it sits on disk, no modification. Use when retrying after a partial failure where the bump already happened locally. - `--dry-run` - run everything except the final `git push` to AUR. The script regenerates `.SRCINFO` via native `makepkg` on a remote Arch host because `makepkg` is not available on macOS. Default `REMOTE_BUILD_HOST=archbox`; override with `REMOTE_BUILD_HOST=somehost ./scripts/publish-aur.sh` to point at a different Arch (or Arch-derivative) box. ### Optional: auto-publish on tag push If you want AUR sync to happen automatically when you push a `v*` tag to GitHub (no separate `./scripts/publish-aur.sh` invocation), activate the `pre-push` hook in this repo: ```sh # One-time, per checkout: git config core.hooksPath scripts/hooks ``` After activation, `git push origin v1.2.5` triggers a backgrounded polling process that waits for the GitHub tarball to appear and then runs `publish-aur.sh`. Logs go to `/tmp/modulejail-aur-publish.log`. See `scripts/hooks/pre-push` for the mechanism and recovery notes (it handles the "AUR push happens before GitHub push completes" ordering issue). ### Manual flow (if you ever need it) The script above is the canonical path. The manual sequence is preserved here in case the script is unavailable or you want to do something the script doesn't support: ```sh cd packaging/aur # 1. Bump pkgver, reset pkgrel=1. Edit PKGBUILD by hand. # 2. Refresh sha256 (committed PKGBUILD always carries real sha256, # never SKIP). updpkgsums # 3. Smoke-test locally on Arch (or in the container, see next section). makepkg -si # 4. Regenerate .SRCINFO. makepkg --printsrcinfo > .SRCINFO # 5. Commit the in-repo PKGBUILD bump. git add PKGBUILD # .SRCINFO is publish-only; not tracked in this repo git commit -m "release(aur): bump PKGBUILD to vX.Y.Z" # 6. Mirror PKGBUILD + .SRCINFO + LICENSE into a checkout of the AUR # git repo, commit, push. First time only: # git clone ssh://aur@aur.archlinux.org/modulejail.git /tmp/aur-publish cp PKGBUILD .SRCINFO LICENSE /tmp/aur-publish/ cd /tmp/aur-publish git add PKGBUILD .SRCINFO LICENSE git commit -m "modulejail X.Y.Z" git push ``` ## Container smoke test (no Arch host available) The primary publish script defaults to a native `makepkg` on `archbox`. If that host is unreachable and you have no other Arch box, the docker fallback below produces an equivalent build on any docker-equipped Linux host (the old workflow, kept here for the genuinely-no-Arch-anywhere case): ```sh # Stage the PKGBUILD into a scratch dir on a docker-equipped host. ssh some-linux-host 'mkdir -p /tmp/aur-smoke' scp PKGBUILD some-linux-host:/tmp/aur-smoke/ ssh some-linux-host 'sudo docker run --rm -v /tmp/aur-smoke:/build archlinux:latest \ /bin/bash -c " set -eu pacman -Syu --noconfirm --needed base-devel git pacman-contrib sudo useradd -m builder echo \"builder ALL=(ALL) NOPASSWD: ALL\" > /etc/sudoers.d/builder chown -R builder:builder /build sudo -u builder bash -lc \"cd /build && updpkgsums && \ makepkg --printsrcinfo > .SRCINFO && \ makepkg -s --noconfirm\" "' ``` A successful run prints `Finished making: modulejail X.Y.Z-N` and leaves the `.pkg.tar.zst` in `/tmp/aur-smoke/` on the remote host. ## Notes - `arch=('any')` is correct: modulejail is pure POSIX shell, no native code. - `depends=('kmod')` covers `lsmod` and `modprobe`. Everything else (POSIX shell, coreutils, sed, awk) is in `base`, which AUR does not require declaring. - `optdepends=('util-linux: logger(1)')` is a documentation gesture; `util-linux` itself is in `base` on every standard Arch install. Kept because minimal containers may strip it. - The man page is templated (`man/modulejail.8.in`). The PKGBUILD does the same `__VERSION__` substitution that `packaging/build.sh` does for the `.deb` and `.rpm` builds, kept as a single `sed` line in `package()` for inspectability. - The committed `sha256sums` is always the real checksum of the referenced release tarball. `SKIP` is never acceptable in this PKGBUILD (that pattern is for `-git` tracking flavors that pull HEAD, which this package does not). Run `updpkgsums` after every `pkgver` bump and before committing. jnuyens-modulejail-06d8d74/packaging/aur/modulejail-signing-key.gpg000066400000000000000000000033151520651617500254650ustar00rootroot00000000000000-----BEGIN PGP PUBLIC KEY BLOCK----- mQINBGoTUM8BEADsYfRBphgplokENMo5Sv9eEOtBRM9AkI4mwNA1uAh3gsR/zqTK rRfTNTzqTK0z56TS1C53Zzq4WNLMX6SfiWB2brYYE2LfpdMl6QJitBgJz06zyBbS 4mreL71EGjMHtDPmPPm8KegtigldJJQgCrPSDFB31juu++zUPXjhqQgeVkYRcQ/9 ueEagBbLzHWW7gI2dXRgfFHyUMQgVN9EAzSSyRSSxLGiRgUCTba0pjy4vVDyDhtk 22kNSj31FJXpCWziR9NaA7UZ6J8y12KbYVkpo3XYM1MmeWBqNlqHmisGUdBF6suo YUkcGuwFjQndqXHyGR6anWFU7iP3NWrpHm7QW2MpVWfQMfA03EvKXJLfen9nEOVy Tlb/3Z5Mt9cUUZt1Gsr19SgdsS9nC9FqXD+M5Yb8u8EJ3FjT7P75nDGCKXeprt/7 AyABaOKlRAfBxqWfTC7Rn0OKRuf3+aORBsDvMmItNXoA0hSMzfHgBi03bEXSDKUI eiuejB70fb0mKu/xDnVWe7QV5fQYYT9Q4whzkvnOr2W72LQS1sfAZ1fYWmLbKJTy ItJb9QkDHCITuEdH4/M9CpyNUQ8xgqCRqgYsXLBqWSsmmtns1NExkvn6n1G1DBU9 7ZnoA2slN2/VTUJnt29WinASOom93XqKTJUYIyyCVWlxruyDsXOFYMfwSQARAQAB tElNb2R1bGVKYWlsIFJlbGVhc2VzIChkZWRpY2F0ZWQgcmVsZWFzZSBzaWduaW5n IGtleSkgPGpudXllbnNAbGludXhiZS5jb20+iQJtBBMBCABXFiEECV9cizmvAQ57 YVzUSHvADWnCqVUFAmoTUM8bFIAAAAAABAAObWFudTIsMi41KzEuMTIsMCwzAhsD BQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEEh7wA1pwqlV1/gP/jGE4l0w e6zQ0Limp7fJIBp8Nv1BOSG0yAqYyTa7xaTARE8RzCTsbRA7aWjk3HZcEkXdW/aq mr8R8ghowMRppir88FwK9Xa2jewhU7AjssBOfCYasDxXiJ7oaWEb465WcwUqz72t 0gmrzznjz/6/jWnfsooXdZ+70AQnbAGbS+yByEb1lfKwabNE5jhXRj0c4Uk4JyFa 1Zf6q+DgljbRWBQ3cgPleXpg+dlHCjg2PgaRNaWOcijjwNdcxuZyoyOVCrVS7MbA pEYKJhVc0LYpoQeU3Z/6hHPnp+0jlvlqljGN/KBDxnFi3X020+i7mtlV0c0eDmSI 0GYuM2xSoU267fS7CXtZPsBRFYX2N6oYoBxmizh+ddfgq4qU5g+OFDZqhwCBS1Xo tPrY8m1BxiMVmpqzDu2ROPC8G6XA43HFtnPxDIs94PEqrL0PprkK8gCwWb4cKgb/ sbzss5qFS+mV5fSI2f7Cst+xY7vrqyvvTXiL22mZb+3+toI83GHRlR0WRDdhBAU3 RkwGuzO6+vbIPz0rHTJwOhslEGLfcdjaK+vPZ58gOhhclRdb/xBYQzus8NmrvAWF L5jfnoyvmAyeQS9UM9CgOLCshUBJ49VHTONhLTE7vDj9XQ4r+/POz8YjVNFrzgKt WCKo7KT9K8/guZMufcvBdWDTzFimcvucVGMg =Zi1Q -----END PGP PUBLIC KEY BLOCK----- jnuyens-modulejail-06d8d74/packaging/build.sh000077500000000000000000000126041520651617500212670ustar00rootroot00000000000000#!/bin/sh # Build .deb and .rpm packages for modulejail. # # Reads VERSION from the modulejail script (single source of truth) and # emits artifacts to packaging/dist/ (gitignored). Skips gracefully if # the respective build tooling is absent on the host. # # Usage: # packaging/build.sh # build whatever this host can build # packaging/build.sh --deb # build only the .deb # packaging/build.sh --rpm # build only the .rpm # # Tooling: # .deb -> requires dpkg-deb (Debian/Ubuntu: apt install dpkg) # .rpm -> requires rpmbuild (RHEL/Fedora: dnf install rpm-build) set -eu REPO_ROOT=$(cd "$(dirname "$0")/.." && pwd) cd "$REPO_ROOT" VERSION=$(awk -F"'" '/^VERSION=/ {print $2; exit}' modulejail) if [ -z "$VERSION" ]; then printf 'build.sh: error: cannot determine VERSION from modulejail script\n' >&2 exit 1 fi # BUILD_DATE: honor SOURCE_DATE_EPOCH per reproducible-builds.org spec. # Used to substitute __DATE__ in the manpage's .TH line (IN-04). # Falls back to UTC wall-clock if SOURCE_DATE_EPOCH is unset. if [ -n "${SOURCE_DATE_EPOCH:-}" ]; then case "$SOURCE_DATE_EPOCH" in ''|*[!0-9]*) printf 'build.sh: error: SOURCE_DATE_EPOCH is set but not a positive integer: %s\n' \ "$SOURCE_DATE_EPOCH" >&2 exit 1 ;; esac # GNU date (Debian/Fedora build hosts): date -u -d "@SDE" # BSD date (macOS dev host): date -u -r SDE # Try GNU form first; fall back to BSD form. One of the two works on every # supported build host. Silent stderr on the failing form (2>/dev/null). BUILD_DATE=$(date -u -d "@$SOURCE_DATE_EPOCH" '+%Y-%m-%d' 2>/dev/null || \ date -u -r "$SOURCE_DATE_EPOCH" '+%Y-%m-%d') else BUILD_DATE=$(date -u '+%Y-%m-%d') fi # Parse mode (default: build both). want_deb=1 want_rpm=1 case "${1:-}" in --deb) want_rpm=0 ;; --rpm) want_deb=0 ;; '') ;; *) printf 'build.sh: error: unknown option: %s\n' "$1" >&2 printf 'usage: %s [--deb|--rpm]\n' "$0" >&2 exit 64 ;; esac DIST=packaging/dist mkdir -p "$DIST" printf '== modulejail v%s ==\n' "$VERSION" printf ' output dir: %s/\n\n' "$DIST" build_deb() { if ! command -v dpkg-deb >/dev/null 2>&1; then printf 'skip: .deb (dpkg-deb not found; install on Debian/Ubuntu with: apt install dpkg)\n' return 0 fi work=$(mktemp -d "${TMPDIR:-/tmp}/modulejail-deb.XXXXXX") trap 'rm -rf "$work"' EXIT INT HUP TERM mkdir -p "$work/DEBIAN" \ "$work/usr/bin" \ "$work/usr/share/doc/modulejail" \ "$work/usr/share/man/man8" sed "s/__VERSION__/$VERSION/g" packaging/debian/control.in > "$work/DEBIAN/control" install -m 0755 modulejail "$work/usr/bin/modulejail" install -m 0644 packaging/debian/copyright "$work/usr/share/doc/modulejail/copyright" install -m 0644 README.md "$work/usr/share/doc/modulejail/README.md" # Manpage: substitute __VERSION__ and __DATE__, then gzip with -n (no name/timestamp) # so the .deb is byte-deterministic across rebuilds with identical inputs. sed -e "s/__VERSION__/$VERSION/g" -e "s/__DATE__/$BUILD_DATE/g" man/modulejail.8.in > "$work/usr/share/man/man8/modulejail.8" gzip -9n "$work/usr/share/man/man8/modulejail.8" out="$DIST/modulejail_${VERSION}_all.deb" dpkg-deb --build --root-owner-group "$work" "$out" >/dev/null printf 'built: %s\n' "$out" rm -rf "$work" trap - EXIT INT HUP TERM } build_rpm() { if ! command -v rpmbuild >/dev/null 2>&1; then printf 'skip: .rpm (rpmbuild not found; install on RHEL/Fedora with: dnf install rpm-build)\n' return 0 fi work=$(mktemp -d "${TMPDIR:-/tmp}/modulejail-rpm.XXXXXX") trap 'rm -rf "$work"' EXIT INT HUP TERM tardir="modulejail-$VERSION" mkdir -p "$work/SOURCES" "$work/SPECS" "$work/BUILD" "$work/RPMS" "$work/SRPMS" "$work/BUILDROOT" # Stage the source tarball that the spec's %setup will unpack. # Manpage source is templated and pre-substituted here so the spec's # %install can just copy it into the buildroot. staging=$(mktemp -d "${TMPDIR:-/tmp}/modulejail-rpm-stage.XXXXXX") mkdir -p "$staging/$tardir" cp modulejail README.md LICENSE "$staging/$tardir/" sed -e "s/__VERSION__/$VERSION/g" -e "s/__DATE__/$BUILD_DATE/g" man/modulejail.8.in > "$staging/$tardir/modulejail.8" tar -czf "$work/SOURCES/$tardir.tar.gz" -C "$staging" "$tardir" rm -rf "$staging" sed "s/__VERSION__/$VERSION/g" packaging/rpm/modulejail.spec.in > "$work/SPECS/modulejail.spec" # Suppress the per-distro %dist tag so the resulting RPM filename is # the same regardless of which RHEL/Fedora major was used to build it # (modulejail-X.Y.Z-1.noarch.rpm, not modulejail-X.Y.Z-1.el9.noarch.rpm). # ModuleJail is a noarch shell script; the dist origin carries no # technical meaning here. rpmbuild --define "_topdir $work" \ --define "dist %{nil}" \ -bb "$work/SPECS/modulejail.spec" >/dev/null # Copy built RPMs to dist/. find "$work/RPMS" -name '*.rpm' -type f | while read -r rpm; do cp "$rpm" "$DIST/" printf 'built: %s/%s\n' "$DIST" "$(basename "$rpm")" done rm -rf "$work" trap - EXIT INT HUP TERM } [ "$want_deb" = 1 ] && build_deb [ "$want_rpm" = 1 ] && build_rpm echo "" printf 'Done. Artifacts in %s/:\n' "$DIST" ls -1 "$DIST" 2>/dev/null || true jnuyens-modulejail-06d8d74/packaging/debian/000077500000000000000000000000001520651617500210505ustar00rootroot00000000000000jnuyens-modulejail-06d8d74/packaging/debian/control.in000066400000000000000000000016551520651617500230670ustar00rootroot00000000000000Package: modulejail Version: __VERSION__ Section: admin Priority: optional Architecture: all Maintainer: Jasper Nuyens Depends: coreutils, findutils, awk | mawk | gawk | original-awk Recommends: curl | wget Homepage: https://github.com/jnuyens/modulejail Description: Shrink Linux kernel-module attack surface ModuleJail snapshots the set of currently loaded modules and writes a modprobe.d blacklist for every kernel module not currently in use, minus a built-in baseline and an optional sysadmin-supplied whitelist. . Aimed at Linux fleet operators who need to harden many servers against the wave of AI-assisted kernel privilege-escalation discoveries. Every additional loaded module is additional latent attack surface for the next disclosed CVE. . No daemon, no continuous monitoring, no AI inside the tool. One shell script, run once on a steady-state host, that writes one modprobe.d blacklist file. jnuyens-modulejail-06d8d74/packaging/debian/copyright000066400000000000000000000017571520651617500230150ustar00rootroot00000000000000Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ Upstream-Name: modulejail Upstream-Contact: Jasper Nuyens Source: https://github.com/jnuyens/modulejail Files: * Copyright: 2026 Jasper Nuyens License: GPL-3.0-only License: GPL-3.0-only This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, version 3. . This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. . You should have received a copy of the GNU General Public License along with this program. If not, see . . On Debian systems, the complete text of the GNU General Public License version 3 can be found in /usr/share/common-licenses/GPL-3. jnuyens-modulejail-06d8d74/packaging/rpm/000077500000000000000000000000001520651617500204245ustar00rootroot00000000000000jnuyens-modulejail-06d8d74/packaging/rpm/modulejail.spec.in000066400000000000000000000102121520651617500240260ustar00rootroot00000000000000Name: modulejail Version: __VERSION__ Release: 1%{?dist} Summary: Shrink Linux kernel-module attack surface License: GPL-3.0-only URL: https://github.com/jnuyens/modulejail Source0: %{name}-%{version}.tar.gz BuildArch: noarch Requires: coreutils Requires: findutils Requires: gawk Recommends: curl %description ModuleJail snapshots the set of currently loaded modules and writes a modprobe.d blacklist for every kernel module not currently in use, minus a built-in baseline and an optional sysadmin-supplied whitelist. Aimed at Linux fleet operators who need to harden many servers against the wave of AI-assisted kernel privilege-escalation discoveries. Every additional loaded module is additional latent attack surface for the next disclosed CVE. No daemon, no continuous monitoring, no AI inside the tool. One shell script, run once on a steady-state host, that writes one modprobe.d blacklist file. %prep %setup -q %install install -Dm755 modulejail %{buildroot}%{_bindir}/modulejail install -Dm644 README.md %{buildroot}%{_docdir}/%{name}/README.md install -Dm644 LICENSE %{buildroot}%{_docdir}/%{name}/LICENSE install -Dm644 modulejail.8 %{buildroot}%{_mandir}/man8/modulejail.8 %files %{_bindir}/modulejail %dir %{_docdir}/%{name} %doc %{_docdir}/%{name}/README.md %license %{_docdir}/%{name}/LICENSE %{_mandir}/man8/modulejail.8* %changelog * Mon May 18 2026 Jasper Nuyens - __VERSION__-1 - Add --whitelist-file PATH flag (closes GitHub Issue #2). Reads a site-local whitelist file (one module per line, # comments, blank lines ignored), validates each line against [a-zA-Z0-9_-]+, refuses group- or world-writable files, and appends valid names to the in-script WHITELIST. Operators no longer lose site-local additions on .deb/.rpm/curl|sh reinstalls. - Add --no-syslog-logging flag. Default behaviour change: when /usr/bin/logger is executable on the host, generated install lines now call logger with tag 'modulejail' so blocked module loads are visible via 'journalctl -t modulejail' or 'grep modulejail /var/log/syslog'. --no-syslog-logging restores the v1.1.4 /bin/true install-line body byte-for-byte. - Add archived v1.1.4 regression fixture under tests/fixtures/v1.1.4-regression/, exercising the body-identical invariant as a permanent baseline. * Wed May 13 2026 Jasper Nuyens - 1.1.4-1 - Add project logo to README. - Test infra: update container fixture to be version-agnostic (was hardcoded to 1.0.0 strings) and add four new assertions covering the v1.1.x update-check surface, including a static regression guard against the v1.1.2 busybox-wget bug. * Wed May 13 2026 Jasper Nuyens - 1.1.3-1 - Update check now works on Alpine / busybox wget. The wget invocation used GNU long-form flags (--quiet, --max-redirect=5, --output-document=-) that busybox wget rejects, causing the check to silently exit non-zero on every Alpine host. Switched to the universal short-flag subset (-q, -T 10, -O -) and dropped --max-redirect (the GitHub tags API does not redirect). No other changes. * Wed May 13 2026 Jasper Nuyens - 1.1.2-1 - Adds modulejail(8) manpage; ships at /usr/share/man/man8/modulejail.8.gz. * Tue May 12 2026 Jasper Nuyens - 1.1.1-1 - Documentation: swap the order of "Why?" and "What ModuleJail is" in the README so the motivation leads. - Packaging: drop the per-distro %dist suffix from the RPM filename (was modulejail-X.Y.Z-1.el9.noarch.rpm, now modulejail-X.Y.Z-1.noarch.rpm). ModuleJail is a noarch shell script with no per-major-RHEL semantics. * Tue May 12 2026 Jasper Nuyens - 1.1.0-1 - Adds .deb and .rpm packaging. - Adds optional post-run check for a newer release on GitHub: silent on any failure, 10-second hard timeout, only complains when reachable and a newer tag exists. Honours MODULEJAIL_NO_UPDATE_CHECK. * Tue May 12 2026 Jasper Nuyens - 1.0.1-1 - Documentation cleanup release. * Tue May 12 2026 Jasper Nuyens - 1.0.0-1 - Initial release. jnuyens-modulejail-06d8d74/scripts/000077500000000000000000000000001520651617500173715ustar00rootroot00000000000000jnuyens-modulejail-06d8d74/scripts/cve-watch.sh000077500000000000000000000252071520651617500216170ustar00rootroot00000000000000#!/bin/sh # SPDX-License-Identifier: GPL-3.0-only # Copyright (C) 2026 Jasper Nuyens # cve-watch.sh — companion to ModuleJail. Polls upstream CVE feeds for # newly-published Linux kernel module vulnerabilities and emits a report. # # Designed for cron. Stays silent when there are no findings. # Sources: # 1. NVD 2.0 API (keyword search: "kernel module") # 2. linux-cve-announce Atom feed (official Linux kernel CNA) set -eu LC_ALL=C export LC_ALL VERSION='0.1.0' EX_OK=0 EX_USAGE=64 EX_SOFTWARE=70 EX_OSERR=71 WINDOW_HOURS=7 MAIL_TO='' NVD_API='https://services.nvd.nist.gov/rest/json/cves/2.0' LORE_FEED='https://lore.kernel.org/linux-cve-announce/new.atom' UA="cve-watch.sh/$VERSION (+https://github.com/jnuyens/modulejail)" usage() { cat <&2 usage >&2 exit $EX_USAGE ;; esac done case "$WINDOW_HOURS" in ''|*[!0-9]*) printf 'cve-watch.sh: --window must be a positive integer\n' >&2; exit $EX_USAGE ;; esac [ "$WINDOW_HOURS" -gt 0 ] || { printf 'cve-watch.sh: --window must be > 0\n' >&2; exit $EX_USAGE; } # --- prereqs --- for t in curl jq python3 date mktemp; do command -v "$t" >/dev/null 2>&1 || { printf 'cve-watch.sh: missing required tool: %s\n' "$t" >&2; exit $EX_OSERR; } done WORKDIR="$(mktemp -d -t cve-watch.XXXXXX)" trap 'rm -rf "$WORKDIR"' EXIT INT TERM # --- time window (UTC, ISO 8601 without timezone suffix, which NVD expects) --- NOW="$(date -u +%Y-%m-%dT%H:%M:%S)" SINCE="$(date -u -d "${WINDOW_HOURS} hours ago" +%Y-%m-%dT%H:%M:%S)" # --- query NVD --- NVD_OUT="$WORKDIR/nvd.json" NVD_ERR="$WORKDIR/nvd.err" nvd_ok=1 if ! curl -sS --max-time 30 -A "$UA" \ --data-urlencode 'keywordSearch=kernel module' \ --data-urlencode "pubStartDate=${SINCE}.000" \ --data-urlencode "pubEndDate=${NOW}.000" \ -G "$NVD_API" -o "$NVD_OUT" 2>"$NVD_ERR"; then nvd_ok=0 fi if [ "$nvd_ok" -eq 1 ] && ! jq -e . "$NVD_OUT" >/dev/null 2>&1; then nvd_ok=0 echo 'NVD response was not valid JSON' >"$NVD_ERR" fi # --- query lore.kernel.org --- LORE_OUT="$WORKDIR/lore.atom" LORE_ERR="$WORKDIR/lore.err" lore_ok=1 if ! curl -sS --max-time 30 -A "$UA" "$LORE_FEED" -o "$LORE_OUT" 2>"$LORE_ERR"; then lore_ok=0 fi if [ "$lore_ok" -eq 1 ] && ! grep -q '/dev/null; then lore_ok=0 echo 'lore.kernel.org response did not look like an Atom feed' >"$LORE_ERR" fi # Both sources dead → noisy error so cron mails it (real outage worth knowing about) if [ "$nvd_ok" -eq 0 ] && [ "$lore_ok" -eq 0 ]; then printf 'cve-watch.sh: BOTH upstream sources failed at %sZ\n' "$NOW" >&2 printf ' NVD: %s\n' "$(head -2 "$NVD_ERR" 2>/dev/null | tr '\n' ' ')" >&2 printf ' lore: %s\n' "$(head -2 "$LORE_ERR" 2>/dev/null | tr '\n' ' ')" >&2 exit $EX_OSERR fi # --- parse, filter, dedupe via python (Atom parsing is fragile without a real XML parser) --- REPORT="$WORKDIR/report.txt" if ! python3 - "$NVD_OUT" "$LORE_OUT" "$nvd_ok" "$lore_ok" "$SINCE" "$NOW" "$WINDOW_HOURS" >"$REPORT" 2>"$WORKDIR/py.err" <<'PY' import json import re import sys from datetime import datetime, timezone from xml.etree import ElementTree as ET nvd_path, lore_path, nvd_ok, lore_ok, since_s, now_s, window_hours = sys.argv[1:] since = datetime.strptime(since_s, "%Y-%m-%dT%H:%M:%S").replace(tzinfo=timezone.utc) now = datetime.strptime(now_s, "%Y-%m-%dT%H:%M:%S").replace(tzinfo=timezone.utc) LINUX_RX = re.compile(r"\blinux\b", re.IGNORECASE) MODULE_RX = re.compile(r"\b(module|driver|loadable)\b", re.IGNORECASE) # Exclude other-vendor kernels that happen to match "kernel module" NEGATIVE_RX = re.compile( r"\b(windows|macos|mac os x|cisco ios|fortios|junos|solaris|aix|freebsd|netbsd|openbsd|esxi|vmware kernel)\b", re.IGNORECASE, ) CVE_ID_RX = re.compile(r"CVE-\d{4}-\d{4,}") items = {} # CVE-ID -> dict # ---- NVD ---- if nvd_ok == "1": try: with open(nvd_path, "r", encoding="utf-8") as f: nvd = json.load(f) for entry in nvd.get("vulnerabilities", []): cve = entry.get("cve") or {} cid = cve.get("id") if not cid: continue descs = cve.get("descriptions") or [] en = next((d.get("value", "") for d in descs if d.get("lang") == "en"), "") if not en: continue if NEGATIVE_RX.search(en): continue if not (LINUX_RX.search(en) and MODULE_RX.search(en)): continue items.setdefault(cid, { "sources": set(), "desc": en, "published": cve.get("published", ""), "nvd_link": f"https://nvd.nist.gov/vuln/detail/{cid}", "lore_link": "", })["sources"].add("NVD") except Exception as e: print(f"NVD parse error: {e}", file=sys.stderr) # ---- lore.kernel.org ---- if lore_ok == "1": try: ns = {"atom": "http://www.w3.org/2005/Atom"} root = ET.parse(lore_path).getroot() for entry in root.findall("atom:entry", ns): title_el = entry.find("atom:title", ns) updated_el = entry.find("atom:updated", ns) link_el = entry.find("atom:link", ns) id_el = entry.find("atom:id", ns) summary_el = entry.find("atom:summary", ns) content_el = entry.find("atom:content", ns) title = (title_el.text or "") if title_el is not None else "" updated = (updated_el.text or "") if updated_el is not None else "" link = "" if link_el is not None: link = link_el.attrib.get("href", "") or "" if not link and id_el is not None: link = id_el.text or "" body = "" if summary_el is not None and summary_el.text: body = summary_el.text elif content_el is not None and content_el.text: body = content_el.text try: upd_dt = datetime.fromisoformat(updated.replace("Z", "+00:00")) except Exception: continue if not (since <= upd_dt <= now): continue haystack = f"{title}\n{body}" if NEGATIVE_RX.search(haystack): continue if not MODULE_RX.search(haystack): continue m = CVE_ID_RX.search(title) or CVE_ID_RX.search(body) if not m: continue cid = m.group(0) it = items.setdefault(cid, { "sources": set(), "desc": title.strip(), "published": updated, "nvd_link": f"https://nvd.nist.gov/vuln/detail/{cid}", "lore_link": link, }) it["sources"].add("lore") if not it["lore_link"]: it["lore_link"] = link except Exception as e: print(f"lore parse error: {e}", file=sys.stderr) # ---- emit ---- if not items: sys.exit(0) # silent on no hits src_used = [] if nvd_ok == "1": src_used.append("NVD") if lore_ok == "1": src_used.append("linux-cve-announce") sources_used = " + ".join(src_used) if src_used else "(none)" degraded = " [DEGRADED: one source unavailable]" if (nvd_ok == "0" or lore_ok == "0") else "" print(f"New Linux kernel module CVE(s) detected: {len(items)}{degraded}") print() print(f"Window: {since_s}Z .. {now_s}Z ({window_hours}h lookback)") print(f"Sources: {sources_used}") print(f"Checked: {now_s} UTC") print() print("───── Findings ─────────────────────────────────────────────") print() for cid in sorted(items.keys()): it = items[cid] src_str = "+".join(sorted(it["sources"])) pub = it["published"][:19] if it["published"] else "(unknown date)" desc = " ".join(it["desc"].split()) if len(desc) > 360: desc = desc[:357] + "..." print(f" {cid} ({pub}, source: {src_str})") print(f" {desc}") print(f" NVD: {it['nvd_link']}") if it.get("lore_link"): print(f" CNA: {it['lore_link']}") print() print("───── Triage ───────────────────────────────────────────────") print() print(" For each finding above, check whether the affected module is") print(" loaded on hosts in your fleet:") print() print(" ssh lsmod | grep -i ") print() print(" If LOADED: ModuleJail keeps it — host needs the upstream patch.") print(" If UNLOADED: ModuleJail blacklists it on the next run.") PY then py_status=$? printf 'cve-watch.sh: python parser failed (exit %d)\n' "$py_status" >&2 cat "$WORKDIR/py.err" >&2 exit $EX_SOFTWARE fi # Silent when there's nothing to say [ -s "$REPORT" ] || exit $EX_OK # --- emit: mail if --mail given, stdout otherwise --- if [ -n "$MAIL_TO" ]; then # Subject derived from the report's leading summary line SUBJECT_BODY="$(head -1 "$REPORT")" SUBJECT="[ModuleJail CVE] ${SUBJECT_BODY}" mail -s "$SUBJECT" "$MAIL_TO" <"$REPORT" else cat "$REPORT" fi exit $EX_OK jnuyens-modulejail-06d8d74/scripts/hooks/000077500000000000000000000000001520651617500205145ustar00rootroot00000000000000jnuyens-modulejail-06d8d74/scripts/hooks/pre-push000077500000000000000000000045551520651617500222160ustar00rootroot00000000000000#!/bin/sh # pre-push hook for the modulejail repo: when a v* tag is pushed to origin, # automatically publish the corresponding PKGBUILD bump to AUR. # # Activation (one-time, per checkout): # git config core.hooksPath scripts/hooks # # Mechanism: # git has no post-push hook, so this pre-push hook detects the v* tag # push, returns 0 immediately so the GitHub push proceeds, and # backgrounds a polling process. That process waits for the release # tarball to appear on GitHub (up to 120s) and then runs # scripts/publish-aur.sh. # # If the GitHub push fails after the hook returns (rare: network # blip, branch-protection rejection), the tarball never materialises, # the polling process times out, and AUR is not synced. Re-push the # tag and the hook fires again - no manual recovery needed; the # publish script is idempotent. # # Logs: # Tail /tmp/modulejail-aur-publish.log to watch progress in real time. set -eu REPO_ROOT=$(git rev-parse --show-toplevel) TRIGGER_TAG="" # stdin format: , one per ref. while read -r local_ref _local_sha _remote_ref _remote_sha; do case $local_ref in refs/tags/v*) TRIGGER_TAG=${local_ref#refs/tags/} ;; esac done if [ -z "$TRIGGER_TAG" ]; then exit 0 fi LOG=/tmp/modulejail-aur-publish.log URL="https://github.com/jnuyens/modulejail/archive/refs/tags/${TRIGGER_TAG}.tar.gz" nohup sh -c " echo echo \"[\$(date)] pre-push hook scheduled AUR publish for ${TRIGGER_TAG}\" echo \"[\$(date)] waiting for GitHub tarball at ${URL}\" for i in \$(seq 1 60); do sleep 2 if curl -fsI '${URL}' >/dev/null 2>&1; then echo \"[\$(date)] tarball available after \$((i*2))s; running publish-aur.sh\" cd '${REPO_ROOT}' if ./scripts/publish-aur.sh; then echo \"[\$(date)] AUR publish: success\" else echo \"[\$(date)] AUR publish: FAILED (exit \$?)\" fi exit 0 fi done echo \"[\$(date)] tarball never appeared after 120s; AUR not synced\" echo \"[\$(date)] re-push the tag to retry (publish-aur.sh is idempotent)\" " >"$LOG" 2>&1 & echo "pre-push hook: scheduled AUR sync for ${TRIGGER_TAG} in background." >&2 echo " Tail $LOG to watch progress; the script is idempotent if re-run." >&2 exit 0 jnuyens-modulejail-06d8d74/scripts/publish-aur.sh000077500000000000000000000163601520651617500221710ustar00rootroot00000000000000#!/bin/sh # Publish the current packaging/aur/PKGBUILD to AUR. # # Idempotent and safe to re-run. Uses this host's SSH key for the AUR push; # defers .SRCINFO regeneration to a remote Arch host (DEFAULT: archbox) # because makepkg is not available on macOS. # # Typical flow: # # # In modulejail/: # # 1. Edit modulejail's VERSION constant. # # 2. Run the rest of the release ceremony (CHANGELOG, README URLs, # # commit, tag, git push --tags, build .deb/.rpm, gh release create). # # 3. Then: # ./scripts/publish-aur.sh # # The script: # - reads pkgver from the modulejail script's VERSION constant # - downloads the GitHub release tarball, computes its sha256 # - updates packaging/aur/PKGBUILD in place (pkgver, pkgrel=1, sha256sums) # - regenerates .SRCINFO on $REMOTE_BUILD_HOST via docker # - clones the AUR git repo if not already present locally # - mirrors PKGBUILD/LICENSE/.SRCINFO and pushes to AUR # # Options: # --dry-run Stop before the AUR push (everything else still runs). # --pkgrel-bump Don't change pkgver; bump pkgrel by 1 instead. Use for # packaging-only changes (e.g. adding a conflicts= line). # --no-bump Skip ALL PKGBUILD modifications - publish the file # exactly as it sits on disk. Use to retry a publish # after a partial failure where the bump already # happened locally. # # Environment: # REMOTE_BUILD_HOST SSH host with makepkg installed (default: archbox). # Must be Arch or an Arch derivative - the only command # run remotely is `makepkg --printsrcinfo`, which # requires the pacman/makepkg toolchain. # AUR_PUBLISH_DIR Local path for the AUR git clone (default: # /tmp/aur-modulejail-publish). set -eu REPO_ROOT=$(cd "$(dirname "$0")/.." && pwd) PKGBUILD=$REPO_ROOT/packaging/aur/PKGBUILD LICENSE=$REPO_ROOT/packaging/aur/LICENSE SIGNING_KEY=$REPO_ROOT/packaging/aur/modulejail-signing-key.gpg REMOTE_BUILD_HOST=${REMOTE_BUILD_HOST:-archbox} AUR_PUBLISH_DIR=${AUR_PUBLISH_DIR:-/tmp/aur-modulejail-publish} DRY_RUN=0 PKGREL_BUMP=0 NO_BUMP=0 for arg in "$@"; do case $arg in --dry-run) DRY_RUN=1 ;; --pkgrel-bump) PKGREL_BUMP=1 ;; --no-bump) NO_BUMP=1 ;; *) echo "publish-aur.sh: unknown argument '$arg'" >&2; exit 2 ;; esac done if [ "$PKGREL_BUMP" -eq 1 ] && [ "$NO_BUMP" -eq 1 ]; then echo "publish-aur.sh: --pkgrel-bump and --no-bump are mutually exclusive." >&2 exit 2 fi # --- read target version from the modulejail script ------------------------- VERSION=$(awk -F"'" '/^VERSION=/ {print $2; exit}' "$REPO_ROOT/modulejail") if [ -z "$VERSION" ]; then echo "publish-aur.sh: could not determine VERSION from modulejail script" >&2 exit 1 fi TARBALL_URL=https://github.com/jnuyens/modulejail/archive/refs/tags/v$VERSION.tar.gz echo "publish-aur.sh: target version = $VERSION" echo "publish-aur.sh: tarball URL = $TARBALL_URL" CURRENT_PKGVER=$(awk -F= '/^pkgver=/ {print $2; exit}' "$PKGBUILD") CURRENT_PKGREL=$(awk -F= '/^pkgrel=/ {print $2; exit}' "$PKGBUILD") if [ "$NO_BUMP" -eq 1 ]; then # Trust the PKGBUILD as-is. Don't even hit the network for the tarball. NEW_PKGVER=$CURRENT_PKGVER NEW_PKGREL=$CURRENT_PKGREL echo "publish-aur.sh: --no-bump set; publishing PKGBUILD as-is ($NEW_PKGVER-$NEW_PKGREL)" else # --- verify the tarball is reachable (the tag must already be on GitHub) if ! curl -fsI "$TARBALL_URL" >/dev/null 2>&1; then echo "publish-aur.sh: tarball $TARBALL_URL not reachable yet." >&2 echo " Did you 'git push --tags' already? This script needs the tag" >&2 echo " to exist on GitHub so the AUR PKGBUILD can reference it." >&2 exit 1 fi # --- compute sha256 of the tarball SHA256=$(curl -fsSL "$TARBALL_URL" | shasum -a 256 | awk '{print $1}') echo "publish-aur.sh: tarball sha256 = $SHA256" if [ "$PKGREL_BUMP" -eq 1 ]; then NEW_PKGVER=$CURRENT_PKGVER NEW_PKGREL=$((CURRENT_PKGREL + 1)) echo "publish-aur.sh: --pkgrel-bump set; keeping pkgver=$NEW_PKGVER, bumping pkgrel to $NEW_PKGREL" else NEW_PKGVER=$VERSION NEW_PKGREL=1 if [ "$NEW_PKGVER" = "$CURRENT_PKGVER" ] && [ "$NEW_PKGREL" -le "$CURRENT_PKGREL" ]; then echo "publish-aur.sh: PKGBUILD already at $NEW_PKGVER-$CURRENT_PKGREL; nothing to publish." >&2 echo " (If this is a packaging-only change, use --pkgrel-bump.)" >&2 echo " (If this is a retry after a partial failure, use --no-bump.)" >&2 exit 1 fi fi # Update pkgver, pkgrel, and only the FIRST entry of the sha256sums array # (the tarball hash). The remaining entries (SKIP for the .sig, the stable # hash for the signing-key.gpg) span subsequent lines and must be left # untouched - matching the closing `)` would corrupt the multi-line array. sed -i.bak \ -e "s/^pkgver=.*/pkgver=$NEW_PKGVER/" \ -e "s/^pkgrel=.*/pkgrel=$NEW_PKGREL/" \ -e "s/^sha256sums=('[^']*'/sha256sums=('$SHA256'/" \ "$PKGBUILD" rm -f "$PKGBUILD.bak" echo "publish-aur.sh: PKGBUILD updated to $NEW_PKGVER-$NEW_PKGREL with sha256=$SHA256" fi # --- regenerate .SRCINFO on the remote Arch host ---------------------------- echo "publish-aur.sh: regenerating .SRCINFO on $REMOTE_BUILD_HOST..." ssh "$REMOTE_BUILD_HOST" "rm -rf /tmp/aur-smoke && mkdir -p /tmp/aur-smoke" scp -q "$PKGBUILD" "$REMOTE_BUILD_HOST:/tmp/aur-smoke/PKGBUILD" ssh "$REMOTE_BUILD_HOST" 'cd /tmp/aur-smoke && makepkg --printsrcinfo > .SRCINFO' SRCINFO_TMP=$(mktemp) scp -q "$REMOTE_BUILD_HOST:/tmp/aur-smoke/.SRCINFO" "$SRCINFO_TMP" # --- prepare the AUR publish clone ------------------------------------------ if [ ! -d "$AUR_PUBLISH_DIR/.git" ]; then echo "publish-aur.sh: cloning AUR repo to $AUR_PUBLISH_DIR..." rm -rf "$AUR_PUBLISH_DIR" git clone --quiet ssh://aur@aur.archlinux.org/modulejail.git "$AUR_PUBLISH_DIR" else echo "publish-aur.sh: refreshing existing AUR clone..." git -C "$AUR_PUBLISH_DIR" fetch --quiet git -C "$AUR_PUBLISH_DIR" reset --quiet --hard origin/master fi cp "$PKGBUILD" "$AUR_PUBLISH_DIR/PKGBUILD" cp "$LICENSE" "$AUR_PUBLISH_DIR/LICENSE" cp "$SIGNING_KEY" "$AUR_PUBLISH_DIR/modulejail-signing-key.gpg" cp "$SRCINFO_TMP" "$AUR_PUBLISH_DIR/.SRCINFO" rm -f "$SRCINFO_TMP" # Remove the previous-pkgrel .asc filename if it lingers from an older clone. git -C "$AUR_PUBLISH_DIR" rm --quiet --cached --ignore-unmatch modulejail-signing-key.asc 2>/dev/null || true rm -f "$AUR_PUBLISH_DIR/modulejail-signing-key.asc" git -C "$AUR_PUBLISH_DIR" add PKGBUILD LICENSE modulejail-signing-key.gpg .SRCINFO if git -C "$AUR_PUBLISH_DIR" diff --staged --quiet; then echo "publish-aur.sh: no changes vs AUR HEAD; nothing to push." exit 0 fi git -C "$AUR_PUBLISH_DIR" commit --quiet -m "modulejail $NEW_PKGVER-$NEW_PKGREL" if [ "$DRY_RUN" -eq 1 ]; then echo "publish-aur.sh: --dry-run set; stopping before push." echo " AUR clone is in $AUR_PUBLISH_DIR, commit is local-only." exit 0 fi echo "publish-aur.sh: pushing to AUR..." git -C "$AUR_PUBLISH_DIR" push --quiet echo "publish-aur.sh: done. https://aur.archlinux.org/packages/modulejail" jnuyens-modulejail-06d8d74/tests/000077500000000000000000000000001520651617500170445ustar00rootroot00000000000000jnuyens-modulejail-06d8d74/tests/cases/000077500000000000000000000000001520651617500201425ustar00rootroot00000000000000jnuyens-modulejail-06d8d74/tests/cases/dry-run-json-interaction.sh000077500000000000000000000034601520651617500253700ustar00rootroot00000000000000#!/bin/sh # Case: --dry-run --output-format json emits JSON with dry_run=true and # output_path set to the would-be path; the would-be header still appears # on stderr; the output file is NOT written. # Skip (not fail) when jq is absent on the running host. set -eu CASE_NAME=dry-run-json-interaction export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM if ! command -v jq >/dev/null 2>&1; then printf '[%s] SKIP: jq not present\n' "$CASE_NAME" exit 0 fi OUT=$CASE_TMP/would-be-output.conf "$MODULEJAIL_BIN" --dry-run --output-format json -o "$OUT" \ > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" || \ case_fail "modulejail --dry-run --output-format json exited $? (expected 0)" # The output file MUST NOT exist. if [ -e "$OUT" ]; then case_fail "--dry-run --output-format json wrote file at $OUT (should write nothing)" fi # stdout must parse as valid JSON. if ! jq -e . < "$CASE_TMP/stdout" >/dev/null 2>&1; then case_fail "JSON output did not parse with jq" fi # dry_run must be true. dr=$(jq -r .dry_run < "$CASE_TMP/stdout") assert_eq "true" "$dr" "dry_run-field" # output_path must be the would-be path (not null or empty). op=$(jq -r .output_path < "$CASE_TMP/stdout") assert_eq "$OUT" "$op" "output_path-would-be" # stderr must contain the would-be header lines. assert_grep '^# modulejail' "$CASE_TMP/stderr" dry-run-json-header-line-1 assert_grep '^# fingerprint:' "$CASE_TMP/stderr" dry-run-json-header-line-5 assert_grep '^# Do not edit by hand' "$CASE_TMP/stderr" dry-run-json-header-disclaimer case_pass jnuyens-modulejail-06d8d74/tests/cases/dry-run-writes-nothing.sh000077500000000000000000000043001520651617500250550ustar00rootroot00000000000000#!/bin/sh # Case: --dry-run leaves no file at the output path, prints DRY-RUN summary # on stdout, and prints the would-be 8-line header block on stderr. set -eu CASE_NAME=dry-run-writes-nothing export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM OUT=$CASE_TMP/should-not-exist.conf "$MODULEJAIL_BIN" --dry-run -o "$OUT" > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" || \ case_fail "modulejail --dry-run exited $? (expected 0); stderr=$(cat "$CASE_TMP/stderr")" # The output file MUST NOT exist after --dry-run. if [ -e "$OUT" ]; then case_fail "--dry-run wrote file at $OUT (should write nothing)" fi # stdout must contain the DRY-RUN summary line. assert_grep '^modulejail: DRY-RUN: would blacklist [0-9]+ of [0-9]+ modules \(profile=[a-z]+\)' \ "$CASE_TMP/stdout" dry-run-stdout-summary # stderr must contain all 8 header lines. assert_grep '^# modulejail' "$CASE_TMP/stderr" dry-run-header-line-1 assert_grep '^# https://github.com/jnuyens/modulejail$' "$CASE_TMP/stderr" dry-run-header-line-2 assert_grep '^# profile:' "$CASE_TMP/stderr" dry-run-header-line-3 assert_grep '^# kernel:' "$CASE_TMP/stderr" dry-run-header-line-4 assert_grep '^# fingerprint: sha256:[0-9a-f]{64}$' "$CASE_TMP/stderr" dry-run-header-line-5 assert_grep '^# install-line:' "$CASE_TMP/stderr" dry-run-header-line-6 assert_grep '^# invocation:' "$CASE_TMP/stderr" dry-run-header-line-7 assert_grep '^# Do not edit by hand' "$CASE_TMP/stderr" dry-run-header-line-8 # No orphaned dotfile should remain in the target directory. Use a POSIX # glob loop rather than `ls | grep` (SC2010) so non-alphanumeric filenames # would not confuse the check; the glob expands to its literal pattern # string when nothing matches, and the [ -e ] guard handles that case. for orphan in "$CASE_TMP"/.modulejail-blacklist.conf.*; do if [ -e "$orphan" ]; then case_fail "orphaned temp dotfile found in $CASE_TMP after --dry-run" fi break done case_pass jnuyens-modulejail-06d8d74/tests/cases/emit-install-line-sanitize.sh000077500000000000000000000237521520651617500256650ustar00rootroot00000000000000#!/bin/sh # Case: defense-in-depth regression — emit_install_line # input sanitization. Feeds adversarial filenames through the full # pipeline and asserts the generated /etc/modprobe.d/-format output # contains none of the adversarial characters in any install-line # module-name token, under BOTH the --no-syslog-logging form (v1.1.4 # /bin/true body) AND the default logger form (where the threat # actually bites — unmatched quotes in module names would break shell # quoting at modprobe-eval time). # # Pre-fix, the universe walker only filtered by .ko* suffix and did # dash-to-underscore normalization; it did NOT enforce the canonical # kernel-module regex on the basename. Adversarial filenames under # /lib/modules/$KVER/ flowed unescaped into install lines: # install evil'name /bin/sh -c '/usr/bin/logger -t modulejail ...' # ^ unmatched single quote breaks shell # The fix added `if (n !~ /^[a-zA-Z0-9_]+$/) next` in list_universe # (after the gsub(/-/, "_", n) line) and the same filter in list_loaded. # Adversarial-named files are dropped from the universe and never reach # emit_install_line. # # This case uses the open-coded REPO_ROOT/CASE_TMP/trap pattern (not # case-env.sh) because it needs adversarial filenames that case-env's # standard fixture tree does not have. set -eu CASE_NAME=emit-install-line-sanitize export CASE_NAME # Locate repo root relative to this script. case "${0:-}" in /*) CASE_SCRIPT=$0 ;; *) CASE_SCRIPT=$(pwd)/$0 ;; esac CASE_DIR=$(cd "$(dirname "$CASE_SCRIPT")" && pwd) REPO_ROOT=$(cd "$CASE_DIR/../.." && pwd) MODULEJAIL_BIN=$REPO_ROOT/modulejail if [ ! -x "$MODULEJAIL_BIN" ] && [ ! -f "$MODULEJAIL_BIN" ]; then printf '[%s] FAIL: cannot locate modulejail at %s\n' \ "$CASE_NAME" "$MODULEJAIL_BIN" >&2 exit 1 fi CASE_TMP=$(mktemp -d "${TMPDIR:-/tmp}/modulejail-sanitize.XXXXXX") trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM # Build a synthetic /lib/modules/$KVER/kernel/ tree: # - 3 adversarial .ko files (single-quote, $IFS, whitespace); # - ~13 baseline-name padding (a subset of BASELINE_CONSERVATIVE); # - 50 dummy_N modules so the universe is large enough that # blacklist/universe stays under 99% (sanity guard at modulejail # lines 560-566). CASE_KVER=6.99.0-sanitize TREE_ROOT=$CASE_TMP/lib/modules/$CASE_KVER/kernel mkdir -p "$TREE_ROOT/fs" "$TREE_ROOT/net" "$TREE_ROOT/drivers" \ "$TREE_ROOT/crypto" "$TREE_ROOT/evil" # Adversarial files — three distinct adversarial characters per the # threat model: single quote, dollar+text-that-looks-like-an-IFS-ref, # whitespace. Quoting carefully so the *shell* invoking touch passes # the literal bytes through to the filesystem. touch "$TREE_ROOT/evil/evil'name.ko" # literal single quote touch "$TREE_ROOT/evil/dollar\$IFS.ko" # literal $ then IFS touch "$TREE_ROOT/evil/with space.ko" # literal space # Verify the three adversarial files actually landed on disk (defensive: # if the touch above silently dropped one we'd silently get a false PASS). adversarial_count=$(find "$TREE_ROOT/evil" -type f -name '*.ko' | wc -l) if [ "$adversarial_count" -lt 3 ]; then printf '[%s] FAIL: only %d/3 adversarial files were created on disk\n' \ "$CASE_NAME" "$adversarial_count" >&2 ls -la "$TREE_ROOT/evil/" >&2 exit 1 fi # Baseline-name padding so list_baseline-kept modules are in the universe # (otherwise comm -23 universe.txt keep.txt subtracts loaded+baseline # names that are not in the universe, producing only the adversarial # residue, which after the canonical-name filter would be 0 -> EX_SOFTWARE empty- # blacklist trip). Reuse the same baseline subset case-env.sh uses. touch \ "$TREE_ROOT/fs/ext4.ko.zst" \ "$TREE_ROOT/fs/btrfs.ko.zst" \ "$TREE_ROOT/fs/xfs.ko.xz" \ "$TREE_ROOT/fs/vfat.ko.gz" \ "$TREE_ROOT/net/sctp.ko.zst" \ "$TREE_ROOT/net/netfilter.ko.zst" \ "$TREE_ROOT/net/nft_compat.ko" \ "$TREE_ROOT/drivers/e1000e.ko" \ "$TREE_ROOT/drivers/virtio_net.ko.gz" \ "$TREE_ROOT/drivers/vfio_pci.ko.zst" \ "$TREE_ROOT/drivers/usb_storage.ko.zst" \ "$TREE_ROOT/crypto/aes_generic.ko.zst" \ "$TREE_ROOT/crypto/sha256_generic.ko" i=1 while [ "$i" -le 50 ]; do touch "$TREE_ROOT/drivers/dummy_$i.ko.zst" i=$((i + 1)) done # Synthetic /proc/modules — a handful of canonical names so list_loaded # is non-empty. None of the adversarial names appear here (they would # never appear in real /proc/modules; the kernel only exposes canonical # names). The list_loaded canonical-name filter is exercised by the absence-of- # noise property: even if /proc/modules had a malformed name, it would # be filtered. CASE_PROC=$CASE_TMP/proc-modules { printf '%s 16384 1 - Live 0x0000000000000000\n' ext4 printf '%s 16384 1 - Live 0x0000000000000000\n' btrfs printf '%s 16384 1 - Live 0x0000000000000000\n' xfs printf '%s 16384 1 - Live 0x0000000000000000\n' e1000e printf '%s 16384 1 - Live 0x0000000000000000\n' virtio_net printf '%s 16384 1 - Live 0x0000000000000000\n' usb_storage printf '%s 16384 1 - Live 0x0000000000000000\n' aes_generic } > "$CASE_PROC" # assert_clean OUTPUT_FILE LABEL: run the two adversarial-character # grep/awk checks against the generated blacklist and fail with a # diagnostic dump if either trips. assert_clean() { out=$1 label=$2 # Check 1: no single-quote or dollar character anywhere in an # install-line module-name token (field 2). Search the whole file # first as a coarse net — if any of those characters appear # anywhere we want to know. if grep -nE "^install [^[:space:]]*['\$]" "$out" >"$CASE_TMP/grep.out"; then printf '[%s] FAIL: [%s] install-line module-name field contains shell-special char:\n' \ "$CASE_NAME" "$label" >&2 sed 's/^/ /' < "$CASE_TMP/grep.out" >&2 exit 1 fi # Check 2: every install-line $2 token must match the canonical # kernel-module regex. awk-on-field-2 is the tight check. awk '/^install / { if ($2 ~ /[^a-zA-Z0-9_]/) { printf "%d: %s\n", NR, $0 } }' "$out" >"$CASE_TMP/awk.out" if [ -s "$CASE_TMP/awk.out" ]; then printf '[%s] FAIL: [%s] install-line field 2 contains non-canonical chars:\n' \ "$CASE_NAME" "$label" >&2 sed 's/^/ /' < "$CASE_TMP/awk.out" >&2 exit 1 fi # Bonus check: verify no adversarial basename appears as a token # anywhere in the file (catches a hypothetical future regression # where the install-line shape changes but the universe walker # still admits adversarial names). if grep -qE "(evil_name|dollar|with space|with_space)" "$out"; then # `evil'name` would not match here because the regex above is # alpha-only; the gsub(/-/, "_", n) gate also does not affect # single quotes or dollars. But the strings could match if # the filter is partial — capture them explicitly. : fi if grep -nE "\\\$IFS|evil'|with space" "$out" >"$CASE_TMP/lit.out"; then printf '[%s] FAIL: [%s] adversarial basename leaked into output:\n' \ "$CASE_NAME" "$label" >&2 sed 's/^/ /' < "$CASE_TMP/lit.out" >&2 exit 1 fi } # Run 1: --no-syslog-logging form (v1.1.4 /bin/true body). OUT1=$CASE_TMP/out.no-logger.conf MODULEJAIL_MODULES_ROOT=$CASE_TMP/lib/modules \ MODULEJAIL_KVER=$CASE_KVER \ MODULEJAIL_PROC_MODULES=$CASE_PROC \ MODULEJAIL_NO_UPDATE_CHECK=1 \ MODULEJAIL_DEFAULT_WHITELIST_FILE=$CASE_TMP/default-whitelist-absent.conf \ "$MODULEJAIL_BIN" --no-syslog-logging -o "$OUT1" \ > "$CASE_TMP/stdout.no-logger" 2> "$CASE_TMP/stderr.no-logger" || { rc=$? printf '[%s] FAIL: modulejail --no-syslog-logging exited %d\n' \ "$CASE_NAME" "$rc" >&2 printf ' stderr:\n' >&2 sed 's/^/ /' < "$CASE_TMP/stderr.no-logger" >&2 exit 1 } assert_clean "$OUT1" "--no-syslog-logging" # Run 2: default logger form. The threat actually bites here — an # unmatched single quote in field 2 would break the shell quoting of # the logger install-line body. We need /usr/bin/logger (or any # executable) at MODULEJAIL_LOGGER_PATH for the USE_LOGGER branch in # modulejail to fire. macOS dev box ships /usr/bin/logger; fall back # to /bin/echo on hosts without it (the install-line shape is what # this test cares about, not logger semantics). LOGGER_PATH=/usr/bin/logger if [ ! -x "$LOGGER_PATH" ]; then if [ -x /bin/echo ]; then LOGGER_PATH=/bin/echo else printf '[%s] FAIL: no executable available for MODULEJAIL_LOGGER_PATH\n' \ "$CASE_NAME" >&2 exit 1 fi fi OUT2=$CASE_TMP/out.logger.conf MODULEJAIL_MODULES_ROOT=$CASE_TMP/lib/modules \ MODULEJAIL_KVER=$CASE_KVER \ MODULEJAIL_PROC_MODULES=$CASE_PROC \ MODULEJAIL_NO_UPDATE_CHECK=1 \ MODULEJAIL_DEFAULT_WHITELIST_FILE=$CASE_TMP/default-whitelist-absent.conf \ MODULEJAIL_LOGGER_PATH=$LOGGER_PATH \ "$MODULEJAIL_BIN" -o "$OUT2" \ > "$CASE_TMP/stdout.logger" 2> "$CASE_TMP/stderr.logger" || { rc=$? printf '[%s] FAIL: modulejail (default logger form) exited %d\n' \ "$CASE_NAME" "$rc" >&2 printf ' stderr:\n' >&2 sed 's/^/ /' < "$CASE_TMP/stderr.logger" >&2 exit 1 } assert_clean "$OUT2" "default logger" # Sanity: confirm the run actually emitted install lines (i.e. the # universe was large enough that the sanity guard did not trip on a # pure-baseline keep-set). 50 dummy_N files in the universe should # all be blacklisted. n1=$(grep -c '^install ' "$OUT1") n2=$(grep -c '^install ' "$OUT2") if [ "$n1" -lt 10 ] || [ "$n2" -lt 10 ]; then printf '[%s] FAIL: too few install lines: --no-logger=%d, logger=%d (expected >=10 each)\n' \ "$CASE_NAME" "$n1" "$n2" >&2 exit 1 fi # Confirm the universe sizes were equal for both runs (the only thing # that differed between the two invocations is USE_LOGGER, so the set # of blacklisted modules should be identical). if [ "$n1" -ne "$n2" ]; then printf '[%s] FAIL: install-line count drift: --no-logger=%d, logger=%d\n' \ "$CASE_NAME" "$n1" "$n2" >&2 exit 1 fi printf '[%s] PASS\n' "$CASE_NAME" exit 0 jnuyens-modulejail-06d8d74/tests/cases/fail-on-module-load-logger.sh000077500000000000000000000054751520651617500255160ustar00rootroot00000000000000#!/bin/sh # Case: --fail-on-module-load with the logger form (default-on when # /usr/bin/logger is executable) replaces the trailing `; exit 0` with # `; /bin/false`, so modprobe fails loudly after the syslog message is # emitted. # # Also asserts that the default-off (no -f flag) logger path is byte- # identical to v1.2.2 (i.e. still uses `; exit 0`). # # Skip (not fail) when /usr/bin/logger is absent on the host, matching the # pattern in logger-default-on.sh. set -eu CASE_NAME=fail-on-module-load-logger export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM if [ ! -x /usr/bin/logger ]; then printf '[%s] SKIP: /usr/bin/logger not executable on this host\n' "$CASE_NAME" exit 0 fi OUT_FAIL=$CASE_TMP/out-fail.conf OUT_DEFAULT=$CASE_TMP/out-default.conf # Run 1: default-on logger + --fail-on-module-load "$MODULEJAIL_BIN" --fail-on-module-load -o "$OUT_FAIL" \ > "$CASE_TMP/stdout-fail" 2> "$CASE_TMP/stderr-fail" || \ case_fail "modulejail --fail-on-module-load exited $? (expected 0)" # Run 2: default-on logger without -f (default) "$MODULEJAIL_BIN" -o "$OUT_DEFAULT" \ > "$CASE_TMP/stdout-default" 2> "$CASE_TMP/stderr-default" || \ case_fail "modulejail (default) exited $? (expected 0)" # Header annotation MUST be the logger + /bin/false form when -f is set. assert_grep '^# install-line: /bin/sh \+ logger \+ /bin/false \(syslog tag: modulejail, --fail-on-module-load\)$' \ "$OUT_FAIL" header-logger-false-annotation # Header annotation MUST be the legacy logger form when -f is not set. assert_grep '^# install-line: /bin/sh \+ logger \(syslog tag: modulejail\)$' \ "$OUT_DEFAULT" header-logger-default-annotation # Body MUST carry `; /bin/false` in the logger trailer when -f is set. assert_grep "^install [a-zA-Z0-9_-]+ /bin/sh -c '/usr/bin/logger -t modulejail \"blocked: [a-zA-Z0-9_-]+\" 2>/dev/null; /bin/false'\$" \ "$OUT_FAIL" body-logger-false-form # Body MUST NOT carry `; exit 0` under -f. if grep -qE "; exit 0'\$" "$OUT_FAIL"; then case_fail "body contains '; exit 0' under --fail-on-module-load (should be '; /bin/false')" fi # Body MUST carry `; exit 0` under default-off (byte-identical to v1.2.2). assert_grep "^install [a-zA-Z0-9_-]+ /bin/sh -c '/usr/bin/logger -t modulejail \"blocked: [a-zA-Z0-9_-]+\" 2>/dev/null; exit 0'\$" \ "$OUT_DEFAULT" body-logger-default-form # Body MUST NOT carry `; /bin/false` under default-off. if grep -qE "; /bin/false'\$" "$OUT_DEFAULT"; then case_fail "body contains '; /bin/false' without --fail-on-module-load (default should be '; exit 0')" fi case_pass jnuyens-modulejail-06d8d74/tests/cases/fail-on-module-load-silent.sh000077500000000000000000000050741520651617500255300ustar00rootroot00000000000000#!/bin/sh # Case: --fail-on-module-load with --no-syslog-logging produces /bin/false # install lines (silent form). The whole install command returns non-zero, # so modprobe fails loudly for blacklisted modules instead of silently # succeeding. # # Also asserts that the default-off (no -f flag) silent path is byte- # identical to v1.1.4 (preserved by the v1.1.4-regression.sh case, but # defended here too for the local diff). set -eu CASE_NAME=fail-on-module-load-silent export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM OUT_FAIL=$CASE_TMP/out-fail.conf OUT_DEFAULT=$CASE_TMP/out-default.conf # Run 1: --no-syslog-logging --fail-on-module-load "$MODULEJAIL_BIN" --no-syslog-logging --fail-on-module-load -o "$OUT_FAIL" \ > "$CASE_TMP/stdout-fail" 2> "$CASE_TMP/stderr-fail" || \ case_fail "modulejail --no-syslog-logging --fail-on-module-load exited $? (expected 0)" # Run 2: --no-syslog-logging without -f (default) "$MODULEJAIL_BIN" --no-syslog-logging -o "$OUT_DEFAULT" \ > "$CASE_TMP/stdout-default" 2> "$CASE_TMP/stderr-default" || \ case_fail "modulejail --no-syslog-logging exited $? (expected 0)" # Header annotation MUST be the /bin/false form when -f is set. assert_grep '^# install-line: /bin/false \(silent, --fail-on-module-load\)$' \ "$OUT_FAIL" header-false-annotation # Header annotation MUST be the /bin/true form when -f is not set. assert_grep '^# install-line: /bin/true \(silent, --no-syslog-logging or logger absent\)$' \ "$OUT_DEFAULT" header-true-annotation-default # Body MUST carry /bin/false install lines under -f. assert_grep '^install [a-zA-Z0-9_-]+ /bin/false$' "$OUT_FAIL" body-false-form # Body MUST NOT carry /bin/true lines under -f. if grep -qE '^install [a-zA-Z0-9_-]+ /bin/true$' "$OUT_FAIL"; then case_fail "body contains /bin/true install lines under --fail-on-module-load (should be /bin/false)" fi # Body MUST carry /bin/true install lines under default-off (byte-identical # to v1.1.4 / v1.2.2). assert_grep '^install [a-zA-Z0-9_-]+ /bin/true$' "$OUT_DEFAULT" body-true-form-default # Body MUST NOT carry /bin/false lines under default-off. if grep -qE '^install [a-zA-Z0-9_-]+ /bin/false$' "$OUT_DEFAULT"; then case_fail "body contains /bin/false install lines without --fail-on-module-load (default should be /bin/true)" fi case_pass jnuyens-modulejail-06d8d74/tests/cases/header-invocation.sh000077500000000000000000000047341520651617500241100ustar00rootroot00000000000000#!/bin/sh # Case: the `# invocation:` header line records the exact argv used to # produce the blacklist, with POSIX-canonical single-quote encoding so the # recorded line is copy-paste replayable. Covers four argv shapes: # # 1. Plain args - no special characters; no quoting applied. # 2. Empty args - the literal empty string is emitted as `''`. # 3. Args containing whitespace - wrapped in single quotes. # 4. Args containing single quotes - encoded with the canonical `'\''` # idiom (close-quote, escaped-apostrophe, open-quote). # # The four-backslash escape in the single-quote assertion is intentional: # shell strips two of them, grep BRE keeps the remaining `\\` as a literal # backslash match, which is exactly what the recorded line contains. set -eu CASE_NAME=header-invocation export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM OUT=$CASE_TMP/out.conf "$MODULEJAIL_BIN" -o "$OUT" > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" || \ case_fail "modulejail exited $? (expected 0); stderr=$(cat "$CASE_TMP/stderr")" # Header invocation test plain args assert_grep "^# invocation: $MODULEJAIL_BIN -o $OUT$" \ "$OUT" header-invocation-plain-args "$MODULEJAIL_BIN" --whitelist-file '' -o "$OUT" > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" || \ case_fail "modulejail exited $? (expected 0); stderr=$(cat "$CASE_TMP/stderr")" # Header invocation test empty args assert_grep "^# invocation: $MODULEJAIL_BIN --whitelist-file '' -o $OUT$" \ "$OUT" header-invocation-empty-args OUT="$CASE_TMP/out put.conf" "$MODULEJAIL_BIN" -o "$OUT" > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" || \ case_fail "modulejail exited $? (expected 0); stderr=$(cat "$CASE_TMP/stderr")" # Header invocation test args with spaces assert_grep "^# invocation: $MODULEJAIL_BIN -o '$OUT'$" \ "$OUT" header-invocation-args-with-spaces OUT="$CASE_TMP/out'put.conf" "$MODULEJAIL_BIN" -o "$OUT" > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" || \ case_fail "modulejail exited $? (expected 0); stderr=$(cat "$CASE_TMP/stderr")" # Header invocation test args with single quotes assert_grep "^# invocation: $MODULEJAIL_BIN -o '$CASE_TMP/out'\\\\''put.conf'$" \ "$OUT" header-invocation-args-with-single-quotes case_pass jnuyens-modulejail-06d8d74/tests/cases/header-kernel-line-locked.sh000077500000000000000000000027221520651617500253760ustar00rootroot00000000000000#!/bin/sh # Case: HDR-01 regression-fixture lock. # The generated blacklist MUST contain a line matching "^# kernel: \S+$" - # a non-empty kernel-version token after "# kernel:". This fixture prevents # a future refactor from silently dropping or renaming the kernel header line. # # Cross-reference: the JSON/logfmt schema "kernel_version" field carries the # same value as the "# kernel: KVER" header line (see OUTPUT FORMATS in # man/modulejail.8.in). Both are derived from uname -r (or MODULEJAIL_KVER # in test environments). The test exercises only the file header; the JSON # schema field is covered by output-format-json.sh. # # This test is the D-Phase5-13 documentation+regression-fixture contract. set -eu CASE_NAME=header-kernel-line-locked export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM OUT=$CASE_TMP/out.conf "$MODULEJAIL_BIN" -o "$OUT" > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" || \ case_fail "modulejail exited $? (expected 0); stderr=$(cat "$CASE_TMP/stderr")" # HDR-01 assertion: the "# kernel: KVER" header line must exist with a # non-empty kernel version token (no whitespace-only value). assert_grep '^# kernel: \S+$' "$OUT" header-kernel-line-locked case_pass jnuyens-modulejail-06d8d74/tests/cases/logger-absent-fallback.sh000077500000000000000000000062121520651617500247700ustar00rootroot00000000000000#!/bin/sh # Case: when /usr/bin/logger is not executable on the host AND # --no-syslog-logging is not set, modulejail silently falls back to the # v1.1.4 /bin/true install-line form. The output MUST be byte- # identical to a run with --no-syslog-logging on the same inputs. # # Simulates "logger absent" via the MODULEJAIL_LOGGER_PATH env-var override # (test-only plumbing parallel to MODULEJAIL_PROC_MODULES / MODULEJAIL_KVER / # MODULEJAIL_MODULES_ROOT). The override lets this case run on the macOS # dev box (which has /usr/bin/logger) without requiring a chroot or # namespace to actually hide the binary. set -eu CASE_NAME=logger-absent-fallback export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM OUT_ABSENT=$CASE_TMP/out-absent.conf OUT_OPTOUT=$CASE_TMP/out-optout.conf # Run 1: logger forced absent via MODULEJAIL_LOGGER_PATH=/nonexistent. # No --no-syslog-logging flag - this is the silent-fallback path. MODULEJAIL_LOGGER_PATH=/nonexistent \ "$MODULEJAIL_BIN" -o "$OUT_ABSENT" > "$CASE_TMP/stdout-absent" 2> "$CASE_TMP/stderr-absent" || \ case_fail "modulejail (logger absent) exited $? (expected 0); stderr=$(cat "$CASE_TMP/stderr-absent")" # Run 2: explicit --no-syslog-logging opt-out on the same inputs. "$MODULEJAIL_BIN" --no-syslog-logging -o "$OUT_OPTOUT" > "$CASE_TMP/stdout-optout" 2> "$CASE_TMP/stderr-optout" || \ case_fail "modulejail --no-syslog-logging exited $? (expected 0); stderr=$(cat "$CASE_TMP/stderr-optout")" # The silent-fallback path MUST produce byte-identical output to the # explicit opt-out path EXCEPT for the invocation header, which legitimately # differs because the two runs use different command-line args # (MODULEJAIL_LOGGER_PATH=/nonexistent vs --no-syslog-logging). Strip the # invocation line before the byte-identity check; everything else - the # fingerprint, the /bin/true install-line annotation, every install body # line, the trailing newline - MUST match. grep -v '^# invocation:' "$OUT_ABSENT" > "$CASE_TMP/absent.body" grep -v '^# invocation:' "$OUT_OPTOUT" > "$CASE_TMP/optout.body" assert_cmp "$CASE_TMP/absent.body" "$CASE_TMP/optout.body" # Header annotation MUST be the /bin/true form (defence in depth - cmp # already proves it, but this asserts the form explicitly). assert_grep '^# install-line: /bin/true \(silent, --no-syslog-logging or logger absent\)$' \ "$OUT_ABSENT" header-true-annotation-on-absent-fallback # Spec explicitly says NO stderr warning when logger is absent and the # operator did not pass --no-syslog-logging. Stderr must be empty. if [ -s "$CASE_TMP/stderr-absent" ]; then case_fail "logger-absent path produced stderr output; spec says silent fallback: $(cat "$CASE_TMP/stderr-absent")" fi # No logger reference in either body (sanity). if grep -qE 'logger -t modulejail' "$OUT_ABSENT"; then case_fail "absent-fallback body references logger -t modulejail; should be /bin/true only" fi case_pass jnuyens-modulejail-06d8d74/tests/cases/logger-default-on.sh000077500000000000000000000046601520651617500240220ustar00rootroot00000000000000#!/bin/sh # Case: with /usr/bin/logger present on the host AND no --no-syslog-logging # flag, modulejail emits the syslog-logging install-line form and the # matching header annotation. # # Skip (not fail) when /usr/bin/logger is absent on the running host: this # case asserts the positive default-on path, which is only exercisable when # logger is actually executable. The complementary logger-absent-fallback.sh # case covers the negative path via MODULEJAIL_LOGGER_PATH override. set -eu CASE_NAME=logger-default-on export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM # Skip-not-fail when the host has no logger. macOS dev box (Darwin) ships # /usr/bin/logger; Linux distros with util-linux or bsdmainutils ship it # too. Minimal containers or unusual hosts may not - skip gracefully. if [ ! -x /usr/bin/logger ]; then printf '[%s] SKIP: /usr/bin/logger not executable on this host\n' "$CASE_NAME" exit 0 fi OUT=$CASE_TMP/out.conf "$MODULEJAIL_BIN" -o "$OUT" > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" || \ case_fail "modulejail exited $? (expected 0); stderr=$(cat "$CASE_TMP/stderr")" # Header annotation MUST be the logger form. assert_grep '^# install-line: /bin/sh \+ logger \(syslog tag: modulejail\)$' \ "$OUT" header-logger-annotation # Header annotation MUST NOT be the /bin/true form. if grep -qE '^# install-line: /bin/true ' "$OUT"; then case_fail "header carries /bin/true annotation but default-on logger path was expected" fi # Body MUST carry at least one logger-form install line. Pattern: # install /bin/sh -c '/usr/bin/logger -t modulejail "blocked: " 2>/dev/null; exit 0' assert_grep "^install [a-zA-Z0-9_-]+ /bin/sh -c '/usr/bin/logger -t modulejail \"blocked: [a-zA-Z0-9_-]+\" 2>/dev/null; exit 0'\$" \ "$OUT" body-logger-form # Body MUST NOT carry any v1.1.4 /bin/true install lines under default-on. if grep -qE '^install [a-zA-Z0-9_-]+ /bin/true$' "$OUT"; then case_fail "body contains v1.1.4 /bin/true install lines but default-on logger path was expected" fi # Success summary on stdout. assert_grep '^modulejail: blacklisted [0-9]+ of [0-9]+ modules' \ "$CASE_TMP/stdout" success-summary case_pass jnuyens-modulejail-06d8d74/tests/cases/logger-opt-out.sh000077500000000000000000000043731520651617500233740ustar00rootroot00000000000000#!/bin/sh # Case: --no-syslog-logging forces the v1.1.4 /bin/true install-line form # regardless of whether /usr/bin/logger is present on the host # (byte-identical regression contract). # # Always runs (no skip): the opt-out path must be deterministic across all # hosts, with or without logger. The header annotation must reflect the # /bin/true variant. set -eu CASE_NAME=logger-opt-out export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM OUT=$CASE_TMP/out.conf "$MODULEJAIL_BIN" --no-syslog-logging -o "$OUT" > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" || \ case_fail "modulejail --no-syslog-logging exited $? (expected 0); stderr=$(cat "$CASE_TMP/stderr")" # Header annotation MUST be the /bin/true form. assert_grep '^# install-line: /bin/true \(silent, --no-syslog-logging or logger absent\)$' \ "$OUT" header-true-annotation # Header annotation MUST NOT be the logger form. if grep -qE '^# install-line: /bin/sh \+ logger ' "$OUT"; then case_fail "header carries logger annotation despite --no-syslog-logging" fi # Every body line MUST be either a comment, a v1.1.4 /bin/true install line, # or a blank line. No logger-form line may appear when --no-syslog-logging # is set. grep -E exits 1 when there are no non-matching lines (good). bad=$(grep -Evc '^#|^install [a-zA-Z0-9_-]+ /bin/true$|^$' "$OUT" || true) assert_eq 0 "$bad" all-body-lines-are-bin-true # Sanity: at least one /bin/true install line is present (the fixture # blacklists ~50 dummy modules; no flag-induced filtering removes them). assert_grep '^install [a-zA-Z0-9_-]+ /bin/true$' "$OUT" body-bin-true-present # No logger reference anywhere in the body (defence-in-depth assertion # against future regressions that emit both forms). if grep -qE 'logger -t modulejail' "$OUT"; then case_fail "body references logger -t modulejail despite --no-syslog-logging" fi # Success summary on stdout. assert_grep '^modulejail: blacklisted [0-9]+ of [0-9]+ modules' \ "$CASE_TMP/stdout" success-summary case_pass jnuyens-modulejail-06d8d74/tests/cases/output-format-bad-value.sh000077500000000000000000000016041520651617500251660ustar00rootroot00000000000000#!/bin/sh # Case: --output-format with an unknown value exits EX_USAGE=64 with a clear # stderr error message naming the bad value and the expected valid values. set -eu CASE_NAME=output-format-bad-value export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM set +e "$MODULEJAIL_BIN" --output-format yaml -o "$CASE_TMP/out.conf" \ > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" rc=$? set -e assert_eq 64 "$rc" "output-format-bad-value-exit-code" assert_grep '^modulejail: error: unknown --output-format: yaml \(expected json or logfmt\)$' \ "$CASE_TMP/stderr" "output-format-bad-value-error" case_pass jnuyens-modulejail-06d8d74/tests/cases/output-format-json.sh000077500000000000000000000036621520651617500243050ustar00rootroot00000000000000#!/bin/sh # Case: --output-format json emits a single-line JSON object on stdout with # schema_version=1, correct tool.name, 64-char hex fingerprint, and output_path. # Skip (not fail) when jq is absent on the running host. set -eu CASE_NAME=output-format-json export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM if ! command -v jq >/dev/null 2>&1; then printf '[%s] SKIP: jq not present\n' "$CASE_NAME" exit 0 fi OUT=$CASE_TMP/out.conf "$MODULEJAIL_BIN" --output-format json -o "$OUT" > "$CASE_TMP/stdout" 2>/dev/null || \ case_fail "modulejail --output-format json exited $? (expected 0)" # stdout must be exactly one line (strip leading spaces from wc -l for portability). if [ "$(wc -l < "$CASE_TMP/stdout" | tr -d ' ')" != "1" ]; then case_fail "JSON output is not exactly one line" fi # stdout must parse as valid JSON. if ! jq -e . < "$CASE_TMP/stdout" >/dev/null 2>&1; then case_fail "JSON output did not parse with jq" fi # schema_version must be 1. sv=$(jq -r .schema_version < "$CASE_TMP/stdout") assert_eq "1" "$sv" "schema_version" # tool.name must be "modulejail". tn=$(jq -r .tool.name < "$CASE_TMP/stdout") assert_eq "modulejail" "$tn" "tool.name" # fingerprint must be 64 lowercase hex chars (no sha256: prefix). fp=$(jq -r .fingerprint < "$CASE_TMP/stdout") if ! printf '%s' "$fp" | grep -qE '^[0-9a-f]{64}$'; then case_fail "fingerprint is not 64 hex chars: $fp" fi # output_path must be the OUT path. op=$(jq -r .output_path < "$CASE_TMP/stdout") assert_eq "$OUT" "$op" "output_path" # dry_run must be false (no --dry-run flag passed). dr=$(jq -r .dry_run < "$CASE_TMP/stdout") assert_eq "false" "$dr" "dry_run" case_pass jnuyens-modulejail-06d8d74/tests/cases/output-format-logfmt.sh000077500000000000000000000030751520651617500246220ustar00rootroot00000000000000#!/bin/sh # Case: --output-format logfmt emits a single-line key=value summary on stdout # with schema_version=1, tool_name=modulejail, 64-char hex fingerprint, and # output_path matching the -o target. set -eu CASE_NAME=output-format-logfmt export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM OUT=$CASE_TMP/out.conf "$MODULEJAIL_BIN" --output-format logfmt -o "$OUT" > "$CASE_TMP/stdout" 2>/dev/null || \ case_fail "modulejail --output-format logfmt exited $? (expected 0)" # stdout must be exactly one line (strip leading spaces from wc -l for portability). if [ "$(wc -l < "$CASE_TMP/stdout" | tr -d ' ')" != "1" ]; then case_fail "logfmt output is not exactly one line" fi # Must start with schema_version=1 tool_name=modulejail. if ! grep -qE '^schema_version=1 tool_name=modulejail ' "$CASE_TMP/stdout"; then case_fail "logfmt output does not start with 'schema_version=1 tool_name=modulejail '" fi # fingerprint must be 64 lowercase hex chars (no sha256: prefix). if ! grep -qE 'fingerprint=[0-9a-f]{64}' "$CASE_TMP/stdout"; then case_fail "logfmt fingerprint field is not 64 hex chars" fi # output_path must contain the OUT path. if ! grep -qE "output_path=$OUT( |\$)" "$CASE_TMP/stdout"; then case_fail "logfmt output_path does not match -o target: $OUT" fi case_pass jnuyens-modulejail-06d8d74/tests/cases/profile-none-happy.sh000077500000000000000000000023101520651617500242110ustar00rootroot00000000000000#!/bin/sh # Case: -p none exits 0, header has profile=none, info: line emits on stderr, # and the >99% sanity guard does NOT fire even with a tiny module universe. set -eu CASE_NAME=profile-none-happy export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM OUT=$CASE_TMP/out.conf set +e "$MODULEJAIL_BIN" -p none -o "$OUT" > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" rc=$? set -e assert_eq 0 "$rc" "profile-none-exit-code" # Header must record profile=none. assert_grep '^# profile: none$' "$OUT" profile-none-header-line # The -p none info: breadcrumb must appear on stderr. assert_grep '^modulejail: info: -p none selected' "$CASE_TMP/stderr" profile-none-info-line # The >99% sanity guard must NOT fire (rc already asserted 0 above; double-check # no error about >99% appears in stderr). if grep -qE 'error:.*99%' "$CASE_TMP/stderr"; then case_fail ">99% sanity guard fired under -p none (should be skipped)" fi case_pass jnuyens-modulejail-06d8d74/tests/cases/profile-none-with-whitelist.sh000077500000000000000000000027231520651617500260650ustar00rootroot00000000000000#!/bin/sh # Case: -p none --whitelist-file keeps whitelist modules in the keep-set. # Verify that whitelist entries do NOT appear in the generated blacklist body. set -eu CASE_NAME=profile-none-with-whitelist export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM WL=$CASE_TMP/whitelist.conf printf 'nft_compat\nxt_owner\n' > "$WL" chmod 0644 "$WL" OUT=$CASE_TMP/out.conf "$MODULEJAIL_BIN" -p none --whitelist-file "$WL" -o "$OUT" \ > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" || \ case_fail "modulejail exited $? (expected 0); stderr=$(cat "$CASE_TMP/stderr")" # nft_compat and xt_owner are in the whitelist so they should NOT appear in # the blacklist body (which lists all blacklisted modules, one per line via # "install ..."). Check both underscore and dash forms. if grep -qE '^install nft_compat ' "$OUT"; then case_fail "nft_compat appeared in blacklist despite being in whitelist under -p none" fi if grep -qE '^install xt_owner ' "$OUT"; then case_fail "xt_owner appeared in blacklist despite being in whitelist under -p none" fi # The output file must exist and be non-empty. if [ ! -s "$OUT" ]; then case_fail "output file is missing or empty" fi case_pass jnuyens-modulejail-06d8d74/tests/cases/quiet-does-not-suppress-error.sh000077500000000000000000000014661520651617500263760ustar00rootroot00000000000000#!/bin/sh # Case: --quiet does NOT suppress error: lines on stderr. A flag-error path # (unknown profile) must still emit the error message. set -eu CASE_NAME=quiet-does-not-suppress-error export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM set +e "$MODULEJAIL_BIN" --quiet -p bogus -o "$CASE_TMP/out.conf" \ > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" rc=$? set -e assert_eq 64 "$rc" "quiet-error-exit-code" assert_grep '^modulejail: error: unknown profile: bogus' "$CASE_TMP/stderr" "quiet-error-not-silenced" case_pass jnuyens-modulejail-06d8d74/tests/cases/quiet-suppresses-info-and-summary.sh000077500000000000000000000034761520651617500272400ustar00rootroot00000000000000#!/bin/sh # Case: --quiet suppresses stdout summary and all non-error stderr output # (info: lines, notice: lines) while still writing the output file. set -eu CASE_NAME=quiet-suppresses-info-and-summary export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM # Stage a default whitelist file so the info: line would normally fire. DWL=$CASE_TMP/etc-default-whitelist.conf printf '# default whitelist for quiet test\next4\n' > "$DWL" chmod 0644 "$DWL" MODULEJAIL_DEFAULT_WHITELIST_FILE=$DWL export MODULEJAIL_DEFAULT_WHITELIST_FILE OUT=$CASE_TMP/out.conf "$MODULEJAIL_BIN" --quiet -o "$OUT" > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" || \ case_fail "modulejail --quiet exited $? (expected 0); stderr=$(cat "$CASE_TMP/stderr")" # stdout must be empty (summary suppressed). # Strip leading spaces from wc -c for portability (macOS pads with spaces). if [ "$(wc -c < "$CASE_TMP/stdout" | tr -d ' ')" != "0" ]; then case_fail "--quiet did not suppress stdout summary; stdout=$(cat "$CASE_TMP/stdout")" fi # stderr must contain no info: or notice: lines. if grep -qE 'modulejail: (info|notice):' "$CASE_TMP/stderr"; then case_fail "--quiet did not suppress info:/notice: lines; stderr=$(cat "$CASE_TMP/stderr")" fi # stderr must contain no would-be header lines (no dry-run active). if grep -qE '^# modulejail' "$CASE_TMP/stderr"; then case_fail "--quiet did not suppress would-be header on stderr" fi # The output file MUST still be written. if [ ! -s "$OUT" ]; then case_fail "--quiet prevented output file from being written" fi case_pass jnuyens-modulejail-06d8d74/tests/cases/quiet-verbose-mutually-exclusive.sh000077500000000000000000000017031520651617500271530ustar00rootroot00000000000000#!/bin/sh # Case: --quiet and --verbose are mutually exclusive. # Combining them MUST exit EX_USAGE=64 with a clear stderr error. set -eu CASE_NAME=quiet-verbose-mutually-exclusive export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM set +e "$MODULEJAIL_BIN" --quiet --verbose -o "$CASE_TMP/out.conf" \ > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" rc=$? set -e assert_eq 64 "$rc" "rejection-exit-code" assert_grep "mutually exclusive" "$CASE_TMP/stderr" "rejection-stderr-message" # Defense-in-depth: no output file should have been written. if [ -f "$CASE_TMP/out.conf" ]; then case_fail "modulejail wrote an output file despite the usage error" fi case_pass jnuyens-modulejail-06d8d74/tests/cases/ssh-unreachable-regression.sh000077500000000000000000000104151520651617500257240ustar00rootroot00000000000000#!/bin/sh # Case: regression — SSH-host harness exit-code routing. # # Drives tests/run-ssh-hosts.sh against a guaranteed-unreachable host # (the RFC 2606 `.invalid` TLD, which DNS resolvers MUST reject) and # asserts the harness exits 2 ("unable to reach one or more hosts"), # NOT exit 1 ("at least one host failed"). # # Pre-fix, the harness's host loop used: # if ! run_host "$host" "$label"; then # rc=$? # if [ "$rc" -eq 2 ]; then UNREACHED=$((UNREACHED+1)) # else OVERALL_FAIL=$((OVERALL_FAIL+1)) # fi # fi # Under POSIX /bin/sh, dash, and bash the `$?` inside `if ! cmd; then` # is always 0 (the inverted-condition `!` consumes the inner return # code), so the rc=2 branch was dead and the harness misreported # every unreachable host as OVERALL_FAIL. The fix: # set +e # run_host "$host" "real-kernel acceptance" # rc=$? # set -e # case "$rc" in # 0) ;; # 2) UNREACHED=$((UNREACHED+1)) ;; # *) OVERALL_FAIL=$((OVERALL_FAIL+1)) ;; # esac # captures the real return code and routes correctly. # # Mutation-test recipe for a future reviewer who wants to confirm this # case actually guards the fix (not just runs): # git log -1 --pretty=%H tests/run-ssh-hosts.sh # remember the SHA # git stash push -- tests/run-ssh-hosts.sh # but the fix is # # already committed, so use revert instead: # git revert --no-commit # sh tests/cases/ssh-unreachable-regression.sh # expect FAIL # git restore --source=HEAD --staged --worktree tests/run-ssh-hosts.sh # sh tests/cases/ssh-unreachable-regression.sh # expect PASS # # Hermeticity contract: # - No real SSH server is contacted (the `.invalid` TLD never resolves). # - No ~/.ssh/config dependency (BatchMode=yes + ConnectTimeout=10 in # the harness already cap wall-clock and refuse password prompts). # - No sudo requirement. # - Total wall-clock under ~20s on macOS (one host * 10s timeout cap; # in practice DNS-NXDOMAIN returns in milliseconds). set -eu CASE_NAME=ssh-unreachable-regression export CASE_NAME # Locate repo root relative to this script (open-coded, since this case # shells out to run-ssh-hosts.sh rather than using case-env.sh's # synthetic kernel tree). case "${0:-}" in /*) CASE_SCRIPT=$0 ;; *) CASE_SCRIPT=$(pwd)/$0 ;; esac CASE_DIR=$(cd "$(dirname "$CASE_SCRIPT")" && pwd) REPO_ROOT=$(cd "$CASE_DIR/../.." && pwd) HARNESS=$REPO_ROOT/tests/run-ssh-hosts.sh if [ ! -f "$HARNESS" ]; then printf '[%s] FAIL: missing harness: %s\n' "$CASE_NAME" "$HARNESS" >&2 exit 1 fi CASE_TMP=$(mktemp -d "${TMPDIR:-/tmp}/modulejail-ssh-unreachable.XXXXXX") trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM # Drive the harness against one synthetic unreachable host. The # `.invalid` TLD is reserved by RFC 2606 and guaranteed non-resolving; # DNS-NXDOMAIN returns fast, so the ConnectTimeout=10 cap inside the # harness is the only thing that could stretch wall-clock and it almost # never fires for `.invalid`. HARNESS_STDOUT=$CASE_TMP/harness.stdout HARNESS_STDERR=$CASE_TMP/harness.stderr set +e HOSTS=unreachable-modulejail-test-host.invalid \ sh "$HARNESS" > "$HARNESS_STDOUT" 2> "$HARNESS_STDERR" HARNESS_RC=$? set -e # Assertion 1: the harness must exit 2 ("unable to reach one or more # hosts"), NOT 1 ("at least one host failed"). Pre-fix this was 1. if [ "$HARNESS_RC" -ne 2 ]; then printf '[%s] FAIL: harness exited %d, expected 2 (UNREACHED)\n' \ "$CASE_NAME" "$HARNESS_RC" >&2 printf ' stdout:\n' >&2 sed 's/^/ /' < "$HARNESS_STDOUT" >&2 printf ' stderr:\n' >&2 sed 's/^/ /' < "$HARNESS_STDERR" >&2 exit 1 fi # Assertion 2: the SUMMARY block must contain the literal "UNREACHABLE" # token for the unreachable host. The harness writes this to stdout # (the SUMMARY block) and an "N host(s) UNREACHABLE." line to stderr. # Search both, accept a match in either. if ! grep -qE 'UNREACHABLE' "$HARNESS_STDOUT" && ! grep -qE 'UNREACHABLE' "$HARNESS_STDERR"; then printf '[%s] FAIL: no UNREACHABLE token found in harness output\n' \ "$CASE_NAME" >&2 printf ' stdout:\n' >&2 sed 's/^/ /' < "$HARNESS_STDOUT" >&2 printf ' stderr:\n' >&2 sed 's/^/ /' < "$HARNESS_STDERR" >&2 exit 1 fi printf '[%s] PASS\n' "$CASE_NAME" exit 0 jnuyens-modulejail-06d8d74/tests/cases/v1.1.4-regression.sh000077500000000000000000000161041520651617500235100ustar00rootroot00000000000000#!/bin/sh # Case: v1.1.4 byte-identical regression contract. # # Asserts that modulejail v1.2 with --no-syslog-logging, run against the # archived v1.1.4-era canned inputs (proc-modules + modules-list + pinned # kver), produces output whose BODY is byte-identical to the archived # expected-blacklist.conf generated by v1.1.4 against the same inputs. # # Body-only: three header lines legitimately changed between v1.1.4 and v1.2 # and are filtered out before the diff: # # modulejail - VERSION line bumped 1.1.4 -> 1.2.0 # # fingerprint: sha256:... - filtered defensively; on identical inputs # the fingerprint IS identical, but if a # future version touches the fingerprint # inputs the body-diff stays clean # # install-line: ... - new in v1.2, absent in v1.1.4 # All other lines (kernel, profile, disclaimer, every install line) MUST # match exactly. # # Contract scope (clarified 2026-05-29 during the v1.3.3 fix): # This case asserts that the install-line RENDERING (the per-line # `install /bin/true` form with the `--no-syslog-logging` # body) stays byte-identical across releases. It does NOT freeze the # SET of modules that appear in the blacklist: every intentional # addition to BASELINE_CONSERVATIVE moves a module from "blacklisted" # to "kept", which changes which install lines appear in the output. # When that happens, the expected reference fixture is updated in the # same commit as the baseline change, and the test continues to # enforce the rendering contract. # # The current fixture reflects the v1.3.3 baseline (6360 install # lines); the v1.1.4 original was 6363 lines (three modules - # inet_diag, tcp_diag, udp_diag - moved into BASELINE_CONSERVATIVE # in v1.3.2). # # The fixture's universe is rebuilt from tests/fixtures/v1.1.4-regression/ # modules-list (6474 basenames). The case builds a synthetic /lib/modules/ # tree of empty files matching those basenames under $CASE_TMP and points # modulejail at it via MODULEJAIL_MODULES_ROOT (test-only plumbing). The # fixture's proc-modules and kver pin the loaded set and kernel version. # Net effect: the case is hermetic, network-free, and runs on any host # that can execute /bin/sh - including the macOS dev box. set -eu CASE_NAME=v1.1.4-regression export CASE_NAME # Source the shared boilerplate (REPO_ROOT, MODULEJAIL_BIN, CASE_TMP, # the centralized EXIT trap, MODULEJAIL_NO_UPDATE_CHECK, # MODULEJAIL_DEFAULT_WHITELIST_FILE, case_pass, case_fail). This case # builds its own 6474-entry universe inline below from the canned # modules-list fixture, with a 2-tier (lo/ + uc/) sharding scheme to # survive case-insensitive filesystems, so it does NOT source the # small representative-universe builder lib (which would conflict # with its own layout). # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" FIXTURE_DIR=$REPO_ROOT/tests/fixtures/v1.1.4-regression # Sanity-check the fixture is present. for f in proc-modules kver modules-list expected-blacklist.conf; do if [ ! -f "$FIXTURE_DIR/$f" ]; then case_fail "missing fixture file: $FIXTURE_DIR/$f" fi done # CASE_TMP cleanup is handled by the centralized EXIT trap installed # in tests/lib/case-env.sh (D-Phase6-15). No inline trap needed here. # Rebuild the synthetic modules tree from the canned list. All 6474 # entries in the v1.1.4 fixture use .ko.zst; the list is shipped as-is # (basename per line). The script's list_universe walks recursively via # `find -type f -name '*.ko*'` and only uses the basename, so the # directory layout does not matter for the regression contract. # # 2-tier sharding (lo/ + uc/) is REQUIRED to survive case-insensitive # filesystems (default macOS APFS). The v1.1.4 fixture's modules-list # contains four uppercase-vs-lowercase basename pairs (xt_DSCP / xt_dscp, # xt_HL / xt_hl, xt_RATEEST / xt_rateest, xt_TCPMSS / xt_tcpmss); on # Linux ext4/xfs these are distinct inodes, but on a single flat # case-insensitive dir the second touch updates the first's mtime # instead of creating a sibling, silently dropping four modules from the # synthetic universe. Sharding files-with-any-uppercase into uc/ and # all-lowercase into lo/ gives the two case-variant groups separate # basename namespaces, so they coexist on APFS as well as on ext4. KVER=$(cat "$FIXTURE_DIR/kver") TREE_ROOT=$CASE_TMP/lib/modules/$KVER mkdir -p "$TREE_ROOT/lo" "$TREE_ROOT/uc" # awk classifies each line (has-any-uppercase vs all-lowercase) and # routes to uc/ or lo/. Then a single batched xargs invocation does the # touches. awk '{ has_upper = 0 for (i=1; i<=length($0); i++) { c = substr($0, i, 1) if (c >= "A" && c <= "Z") { has_upper = 1; break } } if (has_upper) print "uc/" $0 else print "lo/" $0 }' "$FIXTURE_DIR/modules-list" > "$CASE_TMP/manifest" (cd "$TREE_ROOT" && xargs touch < "$CASE_TMP/manifest") # Generate the v1.2 candidate output with --no-syslog-logging set so the # install-line body matches the v1.1.4 form (byte-identical contract). ACTUAL=$CASE_TMP/actual.conf MODULEJAIL_MODULES_ROOT=$CASE_TMP/lib/modules \ MODULEJAIL_KVER=$KVER \ MODULEJAIL_PROC_MODULES=$FIXTURE_DIR/proc-modules \ MODULEJAIL_NO_UPDATE_CHECK=1 \ MODULEJAIL_DEFAULT_WHITELIST_FILE=$CASE_TMP/default-whitelist-absent.conf \ "$MODULEJAIL_BIN" -p conservative --no-syslog-logging -o "$ACTUAL" > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" || \ case_fail "modulejail exited $? (expected 0); stderr=$(cat "$CASE_TMP/stderr")" # Body-only diff: drop the three legitimately-changed header lines. # All other lines (kernel, profile, disclaimer, every install line) must # match the archived v1.1.4 reference. EXPECTED_FILTERED=$CASE_TMP/expected.body ACTUAL_FILTERED=$CASE_TMP/actual.body grep -v -E '^# modulejail |^# fingerprint:|^# install-line:|^# invocation:' \ "$FIXTURE_DIR/expected-blacklist.conf" > "$EXPECTED_FILTERED" grep -v -E '^# modulejail |^# fingerprint:|^# install-line:|^# invocation:' \ "$ACTUAL" > "$ACTUAL_FILTERED" if ! diff -u "$EXPECTED_FILTERED" "$ACTUAL_FILTERED" > "$CASE_TMP/diff.out"; then # KEEP the inline diff dump for operator diagnosability - case_fail # cannot render multi-line context. The diff context goes to stderr # BEFORE the case_fail invocation so it appears above the FAIL line. head -40 "$CASE_TMP/diff.out" >&2 case_fail "v1.1.4 regression body diverged from reference (see diff above)" fi # Sanity: the expected counts (6363 of 6474) ARE the v1.1.4 reference # counts. Confirm v1.2 head produced the same totals (this would also # fall out of a body-identical diff above, but the explicit check makes # the regression contract self-documenting in test output). EXPECTED_COUNT=$(grep -c '^install ' "$FIXTURE_DIR/expected-blacklist.conf") ACTUAL_COUNT=$(grep -c '^install ' "$ACTUAL") if [ "$EXPECTED_COUNT" != "$ACTUAL_COUNT" ]; then case_fail "install-line count drift: expected $EXPECTED_COUNT got $ACTUAL_COUNT" fi printf '[%s] PASS (%d/%d install lines body-identical to v1.1.4 reference)\n' \ "$CASE_NAME" "$ACTUAL_COUNT" "$EXPECTED_COUNT" exit 0 jnuyens-modulejail-06d8d74/tests/cases/verbose-emits-decision-lines.sh000077500000000000000000000035451520651617500261770ustar00rootroot00000000000000#!/bin/sh # Case: --verbose emits per-module decision lines on stderr in the form # "keep: NAME (loaded|whitelist|baseline)" and "blacklist: NAME". # Decision lines must NOT carry a severity prefix (no "modulejail: keep:"). set -eu CASE_NAME=verbose-emits-decision-lines export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM OUT=$CASE_TMP/out.conf "$MODULEJAIL_BIN" --verbose -o "$OUT" > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" || \ case_fail "modulejail --verbose exited $? (expected 0); stderr=$(cat "$CASE_TMP/stderr")" # At least one "keep: NAME (loaded)" line must appear (loaded modules are always kept). if ! grep -qE '^keep: [a-zA-Z0-9_-]+ \(loaded\)$' "$CASE_TMP/stderr"; then case_fail "no 'keep: NAME (loaded)' lines found in verbose stderr" fi # At least one "keep: NAME (baseline)" line must appear (conservative profile has baseline). if ! grep -qE '^keep: [a-zA-Z0-9_-]+ \(baseline\)$' "$CASE_TMP/stderr"; then case_fail "no 'keep: NAME (baseline)' lines found in verbose stderr" fi # At least one "blacklist: NAME" line must appear. if ! grep -qE '^blacklist: [a-zA-Z0-9_-]+$' "$CASE_TMP/stderr"; then case_fail "no 'blacklist: NAME' lines found in verbose stderr" fi # Decision lines must NOT carry the "modulejail:" severity prefix. if grep -qE '^modulejail: keep:' "$CASE_TMP/stderr"; then case_fail "keep: lines carry 'modulejail:' severity prefix (should be plain 'keep:')" fi if grep -qE '^modulejail: blacklist:' "$CASE_TMP/stderr"; then case_fail "blacklist: lines carry 'modulejail:' severity prefix (should be plain 'blacklist:')" fi case_pass jnuyens-modulejail-06d8d74/tests/cases/verbose-logging-enriches-install-line.sh000077500000000000000000000115231520651617500277630ustar00rootroot00000000000000#!/bin/sh # Case: --verbose-logging enriches the per-blocked-load logger call with # the caller's PPID/loginuid/pcomm/pexe (read from /proc/$PPID/...). # Default (no flag) keeps the bare "blocked: " form for backward # compatibility. # # Skip (not fail) when /usr/bin/logger is absent on the host: the flag # requires logger to be executable, and the test asserts behavior of the # logger-path branch specifically. set -eu CASE_NAME=verbose-logging-enriches-install-line export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM if [ ! -x /usr/bin/logger ]; then printf '[%s] SKIP: /usr/bin/logger not executable on this host\n' "$CASE_NAME" exit 0 fi OUT_VERBOSE=$CASE_TMP/out-verbose.conf OUT_DEFAULT=$CASE_TMP/out-default.conf # Run 1: --verbose-logging on "$MODULEJAIL_BIN" --verbose-logging -o "$OUT_VERBOSE" \ > "$CASE_TMP/stdout-verbose" 2> "$CASE_TMP/stderr-verbose" || \ case_fail "modulejail --verbose-logging exited $? (expected 0)" # Run 2: default (no flag) "$MODULEJAIL_BIN" -o "$OUT_DEFAULT" \ > "$CASE_TMP/stdout-default" 2> "$CASE_TMP/stderr-default" || \ case_fail "modulejail (default) exited $? (expected 0)" # Header annotation MUST be the verbose-logging form when --verbose-logging set. assert_grep '^# install-line: /bin/sh \+ logger \+ ppid/loginuid/pcomm/pexe context \(syslog tag: modulejail, --verbose-logging\)$' \ "$OUT_VERBOSE" header-verbose-annotation # Header annotation MUST be the legacy logger form when --verbose-logging is not set. assert_grep '^# install-line: /bin/sh \+ logger \(syslog tag: modulejail\)$' \ "$OUT_DEFAULT" header-default-annotation # Body MUST carry the enriched logger call under --verbose-logging. # Every install line should reference $PPID, loginuid, pcomm, pexe as # literal strings (single-quoted; resolved at modprobe time by /bin/sh). # assert_grep uses ERE (grep -E); the literal `(` chars in the # `$(...)` substrings need `\(` escape so ERE treats them as literal # rather than as group-open metacharacters. # shellcheck disable=SC2016 # the \$PPID etc. are LITERAL by design assert_grep 'ppid=\$PPID' "$OUT_VERBOSE" body-verbose-ppid # shellcheck disable=SC2016 assert_grep 'loginuid=\$\(cat /proc/\$PPID/loginuid' "$OUT_VERBOSE" body-verbose-loginuid # shellcheck disable=SC2016 assert_grep 'pcomm=\$\(cat /proc/\$PPID/comm' "$OUT_VERBOSE" body-verbose-pcomm # pexe uses tr twice (v1.3.5; v1.3.4 used cat which concatenated argv # elements because shell substitution strips NULs). First tr strips # control bytes (\x01-\x08 \x0b-\x1f \x7f) for log-injection # hardening; second tr converts NUL to space so argv elements show # as space-separated. Per @retry-the-user in #18. Using grep -F # (fixed string) here because the install-line content has literal # backslash-octal sequences that are awkward to match in ERE. # Backslashes are DOUBLED in the install-line text (v1.3.6 per # @retry-the-user in #18): modprobe's libkmod config parser collapses # \\ → \ when reading the install command, so `\\001` in the file # becomes `\001` at the shell, which tr then interprets as octal byte 1. # v1.3.5 emitted bare `\001` which modprobe collapsed to `001`, giving # tr a digit string whose `1-0` substring tr correctly rejected as a # reverse range. Verified on Ubuntu 24.04 + kmod 31. if ! grep -F -e "pexe=\$(/usr/bin/tr -d '\\\\001-\\\\010\\\\013-\\\\037\\\\177' < /proc/\$PPID/cmdline" "$OUT_VERBOSE" > /dev/null; then case_fail "pexe tr -d control-strip pattern (doubled-backslash form) not found in $OUT_VERBOSE" fi if ! grep -F -e "| /usr/bin/tr '\\\\0' ' '" "$OUT_VERBOSE" > /dev/null; then case_fail "pexe tr NUL-to-space pattern (doubled-backslash form) not found in $OUT_VERBOSE" fi # Verbose install line MUST NOT have the /bin/sh -c wrapper (v1.3.5; # v1.3.4 had one, which caused $PPID to point at the wrapper sh # instead of modprobe). Per @retry-the-user in #18. # shellcheck disable=SC2016 if grep -qE "/bin/sh -c '/usr/bin/logger" "$OUT_VERBOSE"; then case_fail "verbose install line contains a redundant /bin/sh -c wrapper - \$PPID will point at the wrapper sh, not at modprobe" fi # Body MUST NOT carry the enriched form under default (no flag). # shellcheck disable=SC2016 if grep -qE 'ppid=\$PPID' "$OUT_DEFAULT"; then case_fail "default body contains ppid=\\\$PPID (should be bare blocked: )" fi # Body under default MUST carry the bare "blocked: " v1.2.2 form # (byte-identical to v1.2.2 by construction). assert_grep "^install [a-zA-Z0-9_-]+ /bin/sh -c '/usr/bin/logger -t modulejail \"blocked: [a-zA-Z0-9_-]+\" 2>/dev/null; exit 0'\$" \ "$OUT_DEFAULT" body-default-form case_pass jnuyens-modulejail-06d8d74/tests/cases/verbose-logging-mutex-no-syslog-logging.sh000077500000000000000000000026031520651617500303070ustar00rootroot00000000000000#!/bin/sh # Case: --verbose-logging + --no-syslog-logging are mutually exclusive. # Both orderings of the flags MUST exit EX_USAGE=64 with a clear stderr # message. set -eu CASE_NAME=verbose-logging-mutex-no-syslog-logging export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM # Both orderings must error with EX_USAGE=64. for args in \ "--verbose-logging --no-syslog-logging" \ "--no-syslog-logging --verbose-logging" do OUT=$CASE_TMP/out.conf set +e # shellcheck disable=SC2086 # we want the args unquoted for splitting "$MODULEJAIL_BIN" $args -o "$OUT" > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" rc=$? set -e assert_eq 64 "$rc" "EX_USAGE for: $args" # stderr MUST contain a "mutually exclusive" message naming the two flags. if ! grep -q "mutually exclusive" "$CASE_TMP/stderr"; then case_fail "stderr did not mention 'mutually exclusive' for: $args. stderr=$(cat "$CASE_TMP/stderr")" fi # The output file MUST NOT have been written. if [ -e "$OUT" ]; then case_fail "output file written despite EX_USAGE for: $args" fi done case_pass jnuyens-modulejail-06d8d74/tests/cases/verbose-logging-requires-logger.sh000077500000000000000000000026341520651617500267110ustar00rootroot00000000000000#!/bin/sh # Case: --verbose-logging requires /usr/bin/logger (or whatever # MODULEJAIL_LOGGER_PATH points to) to be executable. When logger is # absent, modulejail MUST exit EX_NOINPUT=66 with a clear stderr message # rather than silently falling back to the v1.1.4 /bin/true form (which # has nothing to enrich). set -eu CASE_NAME=verbose-logging-requires-logger export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM OUT=$CASE_TMP/out.conf set +e MODULEJAIL_LOGGER_PATH=/nonexistent/logger-binary \ "$MODULEJAIL_BIN" --verbose-logging -o "$OUT" \ > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" rc=$? set -e assert_eq 66 "$rc" EX_NOINPUT # stderr MUST cite --verbose-logging and the missing logger path. if ! grep -q "verbose-logging" "$CASE_TMP/stderr"; then case_fail "stderr did not mention --verbose-logging. stderr=$(cat "$CASE_TMP/stderr")" fi if ! grep -q "/nonexistent/logger-binary" "$CASE_TMP/stderr"; then case_fail "stderr did not cite the missing logger path. stderr=$(cat "$CASE_TMP/stderr")" fi # Output file MUST NOT exist. if [ -e "$OUT" ]; then case_fail "output file written despite EX_NOINPUT" fi case_pass jnuyens-modulejail-06d8d74/tests/cases/verbose-logging-requires-tr.sh000077500000000000000000000032041520651617500260510ustar00rootroot00000000000000#!/bin/sh # Case: --verbose-logging requires `tr` (coreutils) to be executable. # The enriched install-line pipes /proc/$PPID/cmdline through tr to # strip control bytes and convert NULs to spaces. If tr is absent at # blacklist-generation time, the install-line would emit `tr: command # not found` into syslog at modprobe-time, mangling the log entry. # modulejail MUST exit EX_NOINPUT=66 with a clear stderr message # instead of silently generating broken install lines. # # Override via MODULEJAIL_TR_PATH (test-only plumbing, parallel to # MODULEJAIL_LOGGER_PATH). set -eu CASE_NAME=verbose-logging-requires-tr export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM OUT=$CASE_TMP/out.conf set +e MODULEJAIL_TR_PATH=/nonexistent/tr-binary \ "$MODULEJAIL_BIN" --verbose-logging -o "$OUT" \ > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" rc=$? set -e assert_eq 66 "$rc" EX_NOINPUT # stderr MUST cite --verbose-logging and the missing tr path. if ! grep -q "verbose-logging" "$CASE_TMP/stderr"; then case_fail "stderr did not mention --verbose-logging. stderr=$(cat "$CASE_TMP/stderr")" fi if ! grep -q "/nonexistent/tr-binary" "$CASE_TMP/stderr"; then case_fail "stderr did not cite the missing tr path. stderr=$(cat "$CASE_TMP/stderr")" fi # Output file MUST NOT exist. if [ -e "$OUT" ]; then case_fail "output file written despite EX_NOINPUT" fi case_pass jnuyens-modulejail-06d8d74/tests/cases/whitelist-file-bad-name.sh000077500000000000000000000036411520651617500251000ustar00rootroot00000000000000#!/bin/sh # Case: a whitelist file containing any non-comment, non-blank line that # does not match [a-zA-Z0-9_-]+ is rejected with EX_DATAERR (65). The # stderr message must reference the file path, line number, and the # offending content. set -eu CASE_NAME=whitelist-file-bad-name export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM OUT=$CASE_TMP/out.conf WL=$CASE_TMP/whitelist.txt # Line 1: comment (ignored). # Line 2: valid (ignored when computing rejection, but parsed). # Line 3: blank (ignored). # Line 4: a deliberately hostile shell-injection-shaped string. The strict # regex must catch this and reject the file BEFORE any of its # content reaches modprobe.d. # Line 5: a name with dots, which sometimes appears in stray copy-pastes. printf '%s\n' \ '# operator notes' \ 'vfio_pci' \ '' \ 'evil; rm -rf /' \ 'module.name.with.dots' \ > "$WL" chmod 0644 "$WL" set +e "$MODULEJAIL_BIN" --whitelist-file "$WL" -o "$OUT" > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" rc=$? set -e assert_eq 65 "$rc" exit-code-EX_DATAERR # stderr must mention the validation error and reference the bad input. assert_grep 'invalid module name' "$CASE_TMP/stderr" stderr-message assert_grep 'must match \[a-zA-Z0-9_-\]\+' "$CASE_TMP/stderr" stderr-regex-hint # Line number: at least one of line 4 or line 5 must be flagged. (The # implementation reports every bad line; either one being present proves # line-numbering works.) assert_grep "line [45]:" "$CASE_TMP/stderr" stderr-line-number # Output MUST NOT have been written. if [ -e "$OUT" ]; then case_fail "$OUT was written despite EX_DATAERR rejection" fi case_pass jnuyens-modulejail-06d8d74/tests/cases/whitelist-file-bad-perms.sh000077500000000000000000000027161520651617500253100ustar00rootroot00000000000000#!/bin/sh # Case: whitelist files with group- or world-write bits set are rejected # with EX_NOPERM (77) and a chmod-hint stderr message. set -eu CASE_NAME=whitelist-file-bad-perms export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM OUT=$CASE_TMP/out.conf check_rejection() { mode=$1 label=$2 WL=$CASE_TMP/whitelist-$label.txt printf 'vfio_pci\n' > "$WL" chmod "$mode" "$WL" set +e "$MODULEJAIL_BIN" --whitelist-file "$WL" -o "$OUT" \ > "$CASE_TMP/stdout-$label" 2> "$CASE_TMP/stderr-$label" rc=$? set -e assert_eq 77 "$rc" "exit code for $label (mode=$mode)" assert_grep 'must not be group- or world-writable' "$CASE_TMP/stderr-$label" "$label-stderr-message" assert_grep "chmod go-w" "$CASE_TMP/stderr-$label" "$label-stderr-chmod-hint" assert_grep "whitelist file $WL" "$CASE_TMP/stderr-$label" "$label-stderr-path-quoted" # Output file MUST NOT exist (rejection happens before write). if [ -e "$OUT" ]; then case_fail "$label: $OUT was written despite rejection" fi } # Group-writable (0664). check_rejection 0664 group-writable # World-writable (0666). check_rejection 0666 world-writable case_pass jnuyens-modulejail-06d8d74/tests/cases/whitelist-file-comments-and-blanks.sh000077500000000000000000000042201520651617500272630ustar00rootroot00000000000000#!/bin/sh # Case: a whitelist file containing only comments and blank lines (no # module names) is accepted (exit 0). It contributes no entries, so the # generated blacklist must be byte-identical to a run without # --whitelist-file at all (i.e. the file is a no-op). set -eu CASE_NAME=whitelist-file-comments-and-blanks export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM WL=$CASE_TMP/whitelist.txt { printf '# This whitelist file is intentionally empty.\n' printf '# Operators may flesh it out later.\n' printf '\n' printf ' \n' # blank-with-spaces line printf '\t\n' # blank-with-tab line printf '# trailing comment\n' } > "$WL" chmod 0644 "$WL" OUT_WITH=$CASE_TMP/out-with.conf OUT_WITHOUT=$CASE_TMP/out-without.conf # Run WITH the no-op whitelist file. "$MODULEJAIL_BIN" --whitelist-file "$WL" -o "$OUT_WITH" > "$CASE_TMP/stdout-with" 2> "$CASE_TMP/stderr-with" || \ case_fail "modulejail (with WL) exited $? (expected 0); stderr=$(cat "$CASE_TMP/stderr-with")" # Run WITHOUT --whitelist-file. "$MODULEJAIL_BIN" -o "$OUT_WITHOUT" > "$CASE_TMP/stdout-without" 2> "$CASE_TMP/stderr-without" || \ case_fail "modulejail (no WL) exited $? (expected 0); stderr=$(cat "$CASE_TMP/stderr-without")" # Both outputs MUST be byte-identical EXCEPT for the invocation header, # which legitimately differs because the two runs use different args # (--whitelist-file PATH vs no flag). Strip the invocation line before the # byte-identity check; the fingerprint, the install-line annotation, and # every install body line MUST match - the fingerprint hashes the canonical # sorted whitelist content, so a no-op file MUST produce the same # fingerprint as no file at all. grep -v '^# invocation:' "$OUT_WITH" > "$CASE_TMP/with.body" grep -v '^# invocation:' "$OUT_WITHOUT" > "$CASE_TMP/without.body" assert_cmp "$CASE_TMP/with.body" "$CASE_TMP/without.body" case_pass jnuyens-modulejail-06d8d74/tests/cases/whitelist-file-dash-form.sh000077500000000000000000000044501520651617500253130ustar00rootroot00000000000000#!/bin/sh # Case: dash form module names in --whitelist-file are normalized to underscore # form before joining the keep-set. # # Regression for the v1.2 code-review BLOCKER: the manpage and README both # document "Module names are accepted in both dash and underscore form; # the pipeline normalises - to _ internally." Before the fix, the # parse_whitelist_file output was concatenated into whitelist.txt without # the tr '-' '_' pass that list_baseline / list_whitelist / list_universe # all apply, so a file entry "nft-compat" silently failed to match # /proc/modules's "nft_compat" and the module got blacklisted anyway. set -eu CASE_NAME=whitelist-file-dash-form export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM # Whitelist file uses dash form for two modules that the synthetic # universe carries in underscore form (nft_compat.ko and vfio_pci.ko.zst, # both planted by case-env.sh). WL=$CASE_TMP/whitelist.conf { printf '# Dash-form entries; pipeline must normalize them.\n' printf 'nft-compat\n' printf 'vfio-pci\n' } > "$WL" chmod 0644 "$WL" OUT=$CASE_TMP/out.conf "$MODULEJAIL_BIN" --whitelist-file "$WL" -o "$OUT" \ > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" || \ case_fail "modulejail exited $? (expected 0); stderr=$(cat "$CASE_TMP/stderr")" # After normalization, the underscore-form names should be in the keep-set # and therefore MUST NOT appear in the blacklist. if grep -qE '^install nft_compat ' "$OUT"; then case_fail "nft_compat should not be blacklisted (whitelist file had dash form 'nft-compat')" fi if grep -qE '^install vfio_pci ' "$OUT"; then case_fail "vfio_pci should not be blacklisted (whitelist file had dash form 'vfio-pci')" fi # Defense-in-depth: the dash form MUST NOT appear in the blacklist either # (no install lines for the literal dash names should be present, since # /proc/modules and list_universe both use underscore form). if grep -qE '^install nft-compat ' "$OUT"; then case_fail "dash form 'nft-compat' leaked into blacklist; normalization failed" fi case_pass jnuyens-modulejail-06d8d74/tests/cases/whitelist-file-default-opt-out.sh000077500000000000000000000035511520651617500264650ustar00rootroot00000000000000#!/bin/sh # Case: --no-whitelist-file skips an existing default whitelist file. # # When --no-whitelist-file is passed, modulejail MUST NOT load the default # file even if it exists. The info-message MUST be absent from stderr. # Module names in the default file MUST end up blacklisted (proves the # default was skipped, not silently merged). set -eu CASE_NAME=whitelist-file-default-opt-out export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM # Plant a default file containing a non-baseline module. DEFAULT_WL=$CASE_TMP/etc/modulejail/whitelist.conf mkdir -p "$(dirname "$DEFAULT_WL")" printf 'vfio_pci\n' > "$DEFAULT_WL" chmod 0644 "$DEFAULT_WL" MODULEJAIL_DEFAULT_WHITELIST_FILE=$DEFAULT_WL export MODULEJAIL_DEFAULT_WHITELIST_FILE OUT=$CASE_TMP/out.conf "$MODULEJAIL_BIN" --no-whitelist-file -o "$OUT" \ > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" || \ case_fail "modulejail --no-whitelist-file exited $? (expected 0); stderr=$(cat "$CASE_TMP/stderr")" # No info-line for default-detection: --no-whitelist-file forced the skip. if grep -q 'using default whitelist file' "$CASE_TMP/stderr"; then case_fail "modulejail emitted default-detection info despite --no-whitelist-file" fi # vfio_pci IS in the universe (CASE_TREE plants it), is NOT in # /proc/modules (CASE_PROC omits it), is NOT in the baseline-conservative, # and was supposed to be added by the default file we just skipped — so # it MUST end up blacklisted. if ! grep -qE '^install vfio_pci ' "$OUT"; then case_fail "vfio_pci should be blacklisted (default file was skipped via --no-whitelist-file)" fi case_pass jnuyens-modulejail-06d8d74/tests/cases/whitelist-file-default-used.sh000077500000000000000000000042271520651617500260170ustar00rootroot00000000000000#!/bin/sh # Case: default whitelist file auto-detection. # # When --whitelist-file is NOT passed and the path resolved by # $MODULEJAIL_DEFAULT_WHITELIST_FILE (default: /etc/modulejail/whitelist.conf) # exists, modulejail picks it up automatically with the same strict mode # and content gates. An "info:" line MUST appear on stderr documenting # the auto-detected path, so operators are not surprised. set -eu CASE_NAME=whitelist-file-default-used export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM # Plant a fake default whitelist file in CASE_TMP and point the env # override at it. case-env.sh has already set the var to a non-existent # path; we override here. DEFAULT_WL=$CASE_TMP/etc/modulejail/whitelist.conf mkdir -p "$(dirname "$DEFAULT_WL")" { printf '# default whitelist file used for auto-detection test\n' printf 'vfio_pci\n' printf 'nft_compat\n' } > "$DEFAULT_WL" chmod 0644 "$DEFAULT_WL" MODULEJAIL_DEFAULT_WHITELIST_FILE=$DEFAULT_WL export MODULEJAIL_DEFAULT_WHITELIST_FILE OUT=$CASE_TMP/out.conf "$MODULEJAIL_BIN" -o "$OUT" > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" || \ case_fail "modulejail exited $? (expected 0); stderr=$(cat "$CASE_TMP/stderr")" # Info line MUST be on stderr (severity-prefixed per OPS-03). assert_grep "^modulejail: info: using default whitelist file $DEFAULT_WL" \ "$CASE_TMP/stderr" default-detection-info # Modules from the default file MUST NOT appear in the blacklist. if grep -qE '^install vfio_pci ' "$OUT"; then case_fail "vfio_pci should not be blacklisted (default whitelist file has it)" fi if grep -qE '^install nft_compat ' "$OUT"; then case_fail "nft_compat should not be blacklisted (default whitelist file has it)" fi # Sanity: at least one module IS blacklisted. if ! grep -qE '^install dummy_[0-9]+ ' "$OUT"; then case_fail "no dummy_* module ended up in the blacklist; pipeline did not run" fi case_pass jnuyens-modulejail-06d8d74/tests/cases/whitelist-file-happy.sh000077500000000000000000000036771520651617500245660ustar00rootroot00000000000000#!/bin/sh # Case: --whitelist-file FILE on a well-formed, properly-permissioned file. # Expect exit 0, and the named modules MUST NOT appear in the generated # blacklist (they are added to the keep-set). set -eu CASE_NAME=whitelist-file-happy export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM WL=$CASE_TMP/whitelist.txt { printf '# Operator notes: keep our two site-local modules\n' printf 'vfio_pci\n' printf '\n' printf '# blank line above is allowed\n' printf 'nft_compat\n' } > "$WL" chmod 0644 "$WL" OUT=$CASE_TMP/out.conf "$MODULEJAIL_BIN" --whitelist-file "$WL" -o "$OUT" > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" || \ case_fail "modulejail exited $? (expected 0); stderr=$(cat "$CASE_TMP/stderr")" # Modules in the whitelist file MUST NOT appear as install lines in the # blacklist - they are in the keep-set, so they are excluded. The install # line body varies (/bin/true vs /bin/sh + logger, per Plan 03-02), so the # pattern matches "^install " agnostically. if grep -qE '^install vfio_pci ' "$OUT"; then case_fail "vfio_pci should not be blacklisted (it is in the whitelist file)" fi if grep -qE '^install nft_compat ' "$OUT"; then case_fail "nft_compat should not be blacklisted (it is in the whitelist file)" fi # Sanity: at least one module IS blacklisted (the fixture pads with ~50 # dummies that nothing keeps). Pattern is install-line-form-agnostic. if ! grep -qE '^install dummy_[0-9]+ ' "$OUT"; then case_fail "no dummy_* module ended up in the blacklist; pipeline did not run" fi # Success line on stdout. assert_grep '^modulejail: blacklisted [0-9]+ of [0-9]+ modules' "$CASE_TMP/stdout" success-summary case_pass jnuyens-modulejail-06d8d74/tests/cases/whitelist-file-missing.sh000077500000000000000000000017341520651617500251060ustar00rootroot00000000000000#!/bin/sh # Case: --whitelist-file PATH where PATH does not exist (or is not # readable) is rejected with EX_NOINPUT (66). set -eu CASE_NAME=whitelist-file-missing export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM OUT=$CASE_TMP/out.conf BOGUS=$CASE_TMP/does-not-exist/anywhere/whitelist.txt set +e "$MODULEJAIL_BIN" --whitelist-file "$BOGUS" -o "$OUT" > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" rc=$? set -e assert_eq 66 "$rc" exit-code-EX_NOINPUT assert_grep "whitelist file $BOGUS does not exist or is not readable" "$CASE_TMP/stderr" stderr-message # Output MUST NOT have been written. if [ -e "$OUT" ]; then case_fail "$OUT was written despite EX_NOINPUT rejection" fi case_pass jnuyens-modulejail-06d8d74/tests/cases/whitelist-file-mutually-exclusive.sh000077500000000000000000000020771520651617500273170ustar00rootroot00000000000000#!/bin/sh # Case: --whitelist-file PATH and --no-whitelist-file are mutually exclusive. # Combining them MUST exit EX_USAGE=64 with a clear stderr error. set -eu CASE_NAME=whitelist-file-mutually-exclusive export CASE_NAME # shellcheck source=tests/lib/case-env.sh disable=SC1091 . "$(dirname "$0")/../lib/case-env.sh" # shellcheck source=tests/lib/case-tree.sh disable=SC1091 . "$REPO_ROOT/tests/lib/case-tree.sh" # shellcheck source=tests/lib/assert.sh disable=SC1091 . "$REPO_ROOT/tests/lib/assert.sh" trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM WL=$CASE_TMP/whitelist.conf printf 'vfio_pci\n' > "$WL" chmod 0644 "$WL" set +e "$MODULEJAIL_BIN" --whitelist-file "$WL" --no-whitelist-file \ -o "$CASE_TMP/out.conf" > "$CASE_TMP/stdout" 2> "$CASE_TMP/stderr" rc=$? set -e assert_eq 64 "$rc" "rejection-exit-code" assert_grep "mutually exclusive" "$CASE_TMP/stderr" "rejection-stderr-message" # Defense-in-depth: no output file should have been written. if [ -f "$CASE_TMP/out.conf" ]; then case_fail "modulejail wrote an output file despite the usage error" fi case_pass jnuyens-modulejail-06d8d74/tests/fixtures/000077500000000000000000000000001520651617500207155ustar00rootroot00000000000000jnuyens-modulejail-06d8d74/tests/fixtures/alpine/000077500000000000000000000000001520651617500221655ustar00rootroot00000000000000jnuyens-modulejail-06d8d74/tests/fixtures/alpine/Dockerfile000066400000000000000000000004071520651617500241600ustar00rootroot00000000000000# tests/fixtures/alpine/Dockerfile FROM alpine:latest RUN apk add --no-cache shellcheck COPY modulejail /usr/local/bin/modulejail RUN chmod +x /usr/local/bin/modulejail COPY tests/lib /tests/lib WORKDIR /tests CMD ["sh", "/tests/lib/run-in-fixture.sh", "alpine"] jnuyens-modulejail-06d8d74/tests/fixtures/arch/000077500000000000000000000000001520651617500216325ustar00rootroot00000000000000jnuyens-modulejail-06d8d74/tests/fixtures/arch/Dockerfile000066400000000000000000000004571520651617500236320ustar00rootroot00000000000000# tests/fixtures/arch/Dockerfile FROM archlinux:latest RUN pacman -Sy --noconfirm shellcheck diffutils && pacman -Scc --noconfirm COPY modulejail /usr/local/bin/modulejail RUN chmod +x /usr/local/bin/modulejail COPY tests/lib /tests/lib WORKDIR /tests CMD ["sh", "/tests/lib/run-in-fixture.sh", "arch"] jnuyens-modulejail-06d8d74/tests/fixtures/opensuse/000077500000000000000000000000001520651617500225565ustar00rootroot00000000000000jnuyens-modulejail-06d8d74/tests/fixtures/opensuse/Dockerfile000066400000000000000000000005151520651617500245510ustar00rootroot00000000000000# tests/fixtures/opensuse/Dockerfile FROM opensuse/tumbleweed:latest RUN zypper --non-interactive in ShellCheck findutils gawk diffutils && zypper clean -a COPY modulejail /usr/local/bin/modulejail RUN chmod +x /usr/local/bin/modulejail COPY tests/lib /tests/lib WORKDIR /tests CMD ["sh", "/tests/lib/run-in-fixture.sh", "opensuse"] jnuyens-modulejail-06d8d74/tests/fixtures/v1.1.4-regression/000077500000000000000000000000001520651617500237225ustar00rootroot00000000000000jnuyens-modulejail-06d8d74/tests/fixtures/v1.1.4-regression/expected-blacklist.conf000066400000000000000000005603441520651617500303540ustar00rootroot00000000000000# modulejail 1.3.2 # https://github.com/jnuyens/modulejail # profile: conservative # kernel: 6.8.0-110-generic # fingerprint: sha256:44393d4c16d0f1849c9e9403756165d5d7041e9d9b05628b535b778afecb6a5d # install-line: /bin/true (silent, --no-syslog-logging or logger absent) # invocation: modulejail -p conservative --no-syslog-logging -o /tmp/v1.1.4-regen.j8AIqW/actual.conf # Do not edit by hand — regenerate with modulejail(8). install 104_quad_8 /bin/true install 3c574_cs /bin/true install 3c589_cs /bin/true install 3c59x /bin/true install 3w_9xxx /bin/true install 3w_sas /bin/true install 3w_xxxx /bin/true install 6lowpan /bin/true install 6pack /bin/true install 8021q /bin/true install 8139cp /bin/true install 8139too /bin/true install 8250_dfl /bin/true install 8250_dw /bin/true install 8250_exar /bin/true install 8250_lpss /bin/true install 8250_men_mcb /bin/true install 8250_pci1xxxx /bin/true install 8250_pericom /bin/true install 8255 /bin/true install 8255_pci /bin/true install 8390 /bin/true install 842 /bin/true install 842_compress /bin/true install 842_decompress /bin/true install 88pg86x /bin/true install 88pm800 /bin/true install 88pm800_regulator /bin/true install 88pm805 /bin/true install 88pm80x /bin/true install 88pm80x_onkey /bin/true install 88pm8607 /bin/true install 88pm860x_battery /bin/true install 88pm860x_bl /bin/true install 88pm860x_charger /bin/true install 88pm860x_onkey /bin/true install 88pm860x_ts /bin/true install 9p /bin/true install 9pnet /bin/true install 9pnet_fd /bin/true install 9pnet_rdma /bin/true install 9pnet_virtio /bin/true install 9pnet_xen /bin/true install BusLogic /bin/true install a100u2w /bin/true install a3d /bin/true install a8293 /bin/true install aacraid /bin/true install aat2870_bl /bin/true install aat2870_regulator /bin/true install abituguru /bin/true install abituguru3 /bin/true install abp060mg /bin/true install acard_ahci /bin/true install acbel_fsg032 /bin/true install acecad /bin/true install acenic /bin/true install acer_wireless /bin/true install acer_wmi /bin/true install acerhdf /bin/true install acp_audio_dma /bin/true install acpi_als /bin/true install acpi_configfs /bin/true install acpi_extlog /bin/true install acpi_ipmi /bin/true install acpi_pad /bin/true install acpi_power_meter /bin/true install acpi_tad /bin/true install acpi_thermal_rel /bin/true install acpiphp_ibm /bin/true install acquirewdt /bin/true install acrn /bin/true install act8865_regulator /bin/true install act_bpf /bin/true install act_connmark /bin/true install act_csum /bin/true install act_ct /bin/true install act_ctinfo /bin/true install act_gact /bin/true install act_gate /bin/true install act_mirred /bin/true install act_mpls /bin/true install act_nat /bin/true install act_pedit /bin/true install act_police /bin/true install act_sample /bin/true install act_simple /bin/true install act_skbedit /bin/true install act_skbmod /bin/true install act_tunnel_key /bin/true install act_vlan /bin/true install ad2s1200 /bin/true install ad2s1210 /bin/true install ad2s90 /bin/true install ad3552r /bin/true install ad4130 /bin/true install ad5064 /bin/true install ad5110 /bin/true install ad525x_dpot /bin/true install ad525x_dpot_i2c /bin/true install ad525x_dpot_spi /bin/true install ad5272 /bin/true install ad5360 /bin/true install ad5380 /bin/true install ad5398 /bin/true install ad5421 /bin/true install ad5446 /bin/true install ad5449 /bin/true install ad5504 /bin/true install ad5592r /bin/true install ad5592r_base /bin/true install ad5593r /bin/true install ad5624r_spi /bin/true install ad5686 /bin/true install ad5686_spi /bin/true install ad5696_i2c /bin/true install ad5755 /bin/true install ad5758 /bin/true install ad5761 /bin/true install ad5764 /bin/true install ad5766 /bin/true install ad5770r /bin/true install ad5791 /bin/true install ad5820 /bin/true install ad5933 /bin/true install ad7091r5 /bin/true install ad7091r8 /bin/true install ad7091r_base /bin/true install ad7124 /bin/true install ad714x /bin/true install ad714x_i2c /bin/true install ad714x_spi /bin/true install ad7150 /bin/true install ad7192 /bin/true install ad7266 /bin/true install ad7280a /bin/true install ad7291 /bin/true install ad7292 /bin/true install ad7293 /bin/true install ad7298 /bin/true install ad7303 /bin/true install ad7314 /bin/true install ad74115 /bin/true install ad7414 /bin/true install ad7418 /bin/true install ad74413r /bin/true install ad7476 /bin/true install ad7606 /bin/true install ad7606_par /bin/true install ad7606_spi /bin/true install ad7746 /bin/true install ad7766 /bin/true install ad7768_1 /bin/true install ad7780 /bin/true install ad7791 /bin/true install ad7793 /bin/true install ad7816 /bin/true install ad7877 /bin/true install ad7879 /bin/true install ad7879_i2c /bin/true install ad7879_spi /bin/true install ad7887 /bin/true install ad7923 /bin/true install ad7949 /bin/true install ad799x /bin/true install ad8366 /bin/true install ad8801 /bin/true install ad9467 /bin/true install ad9523 /bin/true install ad9832 /bin/true install ad9834 /bin/true install ad_sigma_delta /bin/true install ada4250 /bin/true install adafruit_seesaw /bin/true install adc128d818 /bin/true install adc_joystick /bin/true install adc_keys /bin/true install adcxx /bin/true install addi_apci_1032 /bin/true install addi_apci_1500 /bin/true install addi_apci_1516 /bin/true install addi_apci_1564 /bin/true install addi_apci_16xx /bin/true install addi_apci_2032 /bin/true install addi_apci_2200 /bin/true install addi_apci_3120 /bin/true install addi_apci_3501 /bin/true install addi_apci_3xxx /bin/true install addi_watchdog /bin/true install adf4350 /bin/true install adf4371 /bin/true install adf4377 /bin/true install adf7242 /bin/true install adfs /bin/true install adi /bin/true install adi_axi_adc /bin/true install adiantum /bin/true install adin /bin/true install adin1100 /bin/true install adin1110 /bin/true install adis16080 /bin/true install adis16130 /bin/true install adis16136 /bin/true install adis16201 /bin/true install adis16203 /bin/true install adis16209 /bin/true install adis16240 /bin/true install adis16260 /bin/true install adis16400 /bin/true install adis16460 /bin/true install adis16475 /bin/true install adis16480 /bin/true install adis_lib /bin/true install adjd_s311 /bin/true install adl_pci6208 /bin/true install adl_pci7x3x /bin/true install adl_pci8164 /bin/true install adl_pci9111 /bin/true install adl_pci9118 /bin/true install adm1025 /bin/true install adm1026 /bin/true install adm1029 /bin/true install adm1031 /bin/true install adm1177 /bin/true install adm1266 /bin/true install adm1275 /bin/true install adm8211 /bin/true install adm9240 /bin/true install admv1013 /bin/true install admv1014 /bin/true install admv4420 /bin/true install admv8818 /bin/true install adp1653 /bin/true install adp5061 /bin/true install adp5520_bl /bin/true install adp5520_keys /bin/true install adp5588_keys /bin/true install adp5589_keys /bin/true install adp8860_bl /bin/true install adp8870_bl /bin/true install adq12b /bin/true install adrf6780 /bin/true install ads7828 /bin/true install ads7846 /bin/true install ads7871 /bin/true install adt7310 /bin/true install adt7316 /bin/true install adt7316_i2c /bin/true install adt7316_spi /bin/true install adt7410 /bin/true install adt7411 /bin/true install adt7462 /bin/true install adt7470 /bin/true install adt7475 /bin/true install adt7x10 /bin/true install adummy /bin/true install adutux /bin/true install adux1020 /bin/true install adv7170 /bin/true install adv7175 /bin/true install adv7180 /bin/true install adv7183 /bin/true install adv7343 /bin/true install adv7393 /bin/true install adv7511_v4l2 /bin/true install adv7604 /bin/true install adv7842 /bin/true install adv_pci1710 /bin/true install adv_pci1720 /bin/true install adv_pci1723 /bin/true install adv_pci1724 /bin/true install adv_pci1760 /bin/true install adv_pci_dio /bin/true install adv_swbutton /bin/true install advansys /bin/true install advantech_ec_wdt /bin/true install advantechwdt /bin/true install adxl313_core /bin/true install adxl313_i2c /bin/true install adxl313_spi /bin/true install adxl34x /bin/true install adxl34x_i2c /bin/true install adxl34x_spi /bin/true install adxl355_core /bin/true install adxl355_i2c /bin/true install adxl355_spi /bin/true install adxl367 /bin/true install adxl367_i2c /bin/true install adxl367_spi /bin/true install adxl372 /bin/true install adxl372_i2c /bin/true install adxl372_spi /bin/true install adxrs290 /bin/true install adxrs450 /bin/true install aegis128 /bin/true install aegis128_aesni /bin/true install aes_ti /bin/true install af9013 /bin/true install af9033 /bin/true install af_alg /bin/true install af_key /bin/true install af_packet_diag /bin/true install afe4403 /bin/true install afe4404 /bin/true install affs /bin/true install ags02ma /bin/true install ah4 /bin/true install ah6 /bin/true install aha152x_cs /bin/true install ahci_dwc /bin/true install ahci_platform /bin/true install aht10 /bin/true install aic79xx /bin/true install aic7xxx /bin/true install aic94xx /bin/true install aio_aio12_8 /bin/true install aio_iiro_16 /bin/true install aiptek /bin/true install aircable /bin/true install airspy /bin/true install ak7375 /bin/true install ak881x /bin/true install ak8974 /bin/true install ak8975 /bin/true install al3010 /bin/true install al3320a /bin/true install alcor /bin/true install alcor_pci /bin/true install algif_aead /bin/true install algif_hash /bin/true install algif_rng /bin/true install algif_skcipher /bin/true install alienware_wmi /bin/true install alim1535_wdt /bin/true install alim7101_wdt /bin/true install altera_ci /bin/true install altera_cvp /bin/true install altera_freeze_bridge /bin/true install altera_jtaguart /bin/true install altera_msgdma /bin/true install altera_pr_ip_core /bin/true install altera_ps2 /bin/true install altera_ps_spi /bin/true install altera_stapl /bin/true install altera_tse /bin/true install altera_uart /bin/true install alvium_csi2 /bin/true install alx /bin/true install am2315 /bin/true install am53c974 /bin/true install amc6821 /bin/true install amd /bin/true install amd5536udc_pci /bin/true install amd64_edac /bin/true install amd76xrom /bin/true install amd8111e /bin/true install amd_axi_w1 /bin/true install amd_freq_sensitivity /bin/true install amd_hsmp /bin/true install amd_pmc /bin/true install amd_pmf /bin/true install amd_rng /bin/true install amd_sfh /bin/true install amd_uncore /bin/true install amd_xgbe /bin/true install amdgpu /bin/true install amdtee /bin/true install amdxcp /bin/true install amilo_rfkill /bin/true install amlogic_gxl_crypto /bin/true install amplc_dio200 /bin/true install amplc_dio200_common /bin/true install amplc_dio200_pci /bin/true install amplc_pc236 /bin/true install amplc_pc236_common /bin/true install amplc_pc263 /bin/true install amplc_pci224 /bin/true install amplc_pci230 /bin/true install amplc_pci236 /bin/true install amplc_pci263 /bin/true install ams369fg06 /bin/true install ams_iaq_core /bin/true install amt /bin/true install analog /bin/true install analogix_anx78xx /bin/true install analogix_dp /bin/true install ansi_cprng /bin/true install anx7411 /bin/true install aoe /bin/true install apanel /bin/true install apds9300 /bin/true install apds9802als /bin/true install apds990x /bin/true install apds9960 /bin/true install apple_bl /bin/true install apple_gmux /bin/true install apple_mfi_fastcharge /bin/true install appledisplay /bin/true install applesmc /bin/true install applespi /bin/true install appletalk /bin/true install appletouch /bin/true install applicom /bin/true install aptina_pll /bin/true install aqc111 /bin/true install aquacomputer_d5next /bin/true install aquantia /bin/true install ar0521 /bin/true install ar5523 /bin/true install ar9331 /bin/true install arasan_nand_controller /bin/true install arc_ps2 /bin/true install arc_rawmode /bin/true install arc_rimi /bin/true install arc_uart /bin/true install arcfb /bin/true install arcmsr /bin/true install arcnet /bin/true install arcxcnn_bl /bin/true install aria_aesni_avx2_x86_64 /bin/true install aria_aesni_avx_x86_64 /bin/true install aria_generic /bin/true install aria_gfni_avx512_x86_64 /bin/true install arizona /bin/true install arizona_haptics /bin/true install arizona_i2c /bin/true install arizona_ldo1 /bin/true install arizona_micsupp /bin/true install arizona_spi /bin/true install ark3116 /bin/true install arkfb /bin/true install arp_tables /bin/true install arpt_mangle /bin/true install arptable_filter /bin/true install as102_fe /bin/true install as370_hwmon /bin/true install as3711_bl /bin/true install as3711_regulator /bin/true install as3935 /bin/true install as5011 /bin/true install as73211 /bin/true install asb100 /bin/true install asc7621 /bin/true install ascot2e /bin/true install asix /bin/true install ast /bin/true install asus_atk0110 /bin/true install asus_ec_sensors /bin/true install asus_laptop /bin/true install asus_nb_wmi /bin/true install asus_tf103c_dock /bin/true install asus_wireless /bin/true install asus_wmi /bin/true install asus_wmi_sensors /bin/true install async_memcpy /bin/true install async_pq /bin/true install async_raid6_recov /bin/true install async_tx /bin/true install async_xor /bin/true install at24 /bin/true install at25 /bin/true install at76c50x_usb /bin/true install at803x /bin/true install at86rf230 /bin/true install atbm8830 /bin/true install atc260x_core /bin/true install atc260x_i2c /bin/true install atc260x_onkey /bin/true install atc260x_poweroff /bin/true install atc260x_regulator /bin/true install aten /bin/true install ath /bin/true install ath10k_core /bin/true install ath10k_pci /bin/true install ath10k_sdio /bin/true install ath10k_usb /bin/true install ath11k /bin/true install ath11k_ahb /bin/true install ath11k_pci /bin/true install ath12k /bin/true install ath3k /bin/true install ath5k /bin/true install ath6kl_core /bin/true install ath6kl_sdio /bin/true install ath6kl_usb /bin/true install ath9k /bin/true install ath9k_common /bin/true install ath9k_htc /bin/true install ath9k_hw /bin/true install ath9k_pci_owl_loader /bin/true install ati_remote /bin/true install ati_remote2 /bin/true install atl1 /bin/true install atl1c /bin/true install atl1e /bin/true install atl2 /bin/true install atlantic /bin/true install atlas_btns /bin/true install atlas_ezo_sensor /bin/true install atlas_sensor /bin/true install atm /bin/true install atmel_ecc /bin/true install atmel_i2c /bin/true install atmel_mxt_ts /bin/true install atmel_sha204a /bin/true install atmtcp /bin/true install atp /bin/true install atp870u /bin/true install atusb /bin/true install atxp1 /bin/true install aty128fb /bin/true install atyfb /bin/true install au0828 /bin/true install au8522_common /bin/true install au8522_decoder /bin/true install au8522_dig /bin/true install auo_pixcir_ts /bin/true install auth_rpcgss /bin/true install authenc /bin/true install authencesn /bin/true install avmfritz /bin/true install aw37503_regulator /bin/true install ax25 /bin/true install ax88179_178a /bin/true install ax88796b /bin/true install ax88796c /bin/true install axi_fan_control /bin/true install axnet_cs /bin/true install axp20x /bin/true install axp20x_ac_power /bin/true install axp20x_adc /bin/true install axp20x_battery /bin/true install axp20x_i2c /bin/true install axp20x_pek /bin/true install axp20x_regulator /bin/true install axp20x_usb_power /bin/true install axp288_adc /bin/true install axp288_charger /bin/true install axp288_fuel_gauge /bin/true install b2c2_flexcop /bin/true install b2c2_flexcop_pci /bin/true install b2c2_flexcop_usb /bin/true install b43 /bin/true install b43legacy /bin/true install b44 /bin/true install b53_common /bin/true install b53_mdio /bin/true install b53_mmap /bin/true install b53_serdes /bin/true install b53_spi /bin/true install b53_srab /bin/true install ba431_rng /bin/true install barco_p50_gpio /bin/true install bareudp /bin/true install batman_adv /bin/true install baycom_par /bin/true install baycom_ser_fdx /bin/true install baycom_ser_hdx /bin/true install bcache /bin/true install bcachefs /bin/true install bch /bin/true install bcm203x /bin/true install bcm3510 /bin/true install bcm54140 /bin/true install bcm590xx /bin/true install bcm590xx_regulator /bin/true install bcm5974 /bin/true install bcm7xxx /bin/true install bcm87xx /bin/true install bcm_phy_lib /bin/true install bcm_phy_ptp /bin/true install bcm_sf2 /bin/true install bcm_vk /bin/true install bcma /bin/true install bcma_hcd /bin/true install bcmsysport /bin/true install bd6107 /bin/true install bd9571mwv /bin/true install bd9571mwv_regulator /bin/true install bd99954_charger /bin/true install bdc /bin/true install be2iscsi /bin/true install be2net /bin/true install befs /bin/true install bel_pfe /bin/true install belkin_sa /bin/true install bfa /bin/true install bfq /bin/true install bfs /bin/true install bfusb /bin/true install bh1750 /bin/true install bh1770glc /bin/true install bh1780 /bin/true install binder_linux /bin/true install blake2b_generic /bin/true install block2mtd /bin/true install blocklayoutdriver /bin/true install blowfish_common /bin/true install blowfish_generic /bin/true install blowfish_x86_64 /bin/true install bluecard_cs /bin/true install bluetooth /bin/true install bluetooth_6lowpan /bin/true install bma150 /bin/true install bma220_spi /bin/true install bma400_core /bin/true install bma400_i2c /bin/true install bma400_spi /bin/true install bmc150_accel_core /bin/true install bmc150_accel_i2c /bin/true install bmc150_accel_spi /bin/true install bmc150_magn /bin/true install bmc150_magn_i2c /bin/true install bmc150_magn_spi /bin/true install bme680_core /bin/true install bme680_i2c /bin/true install bme680_spi /bin/true install bmg160_core /bin/true install bmg160_i2c /bin/true install bmg160_spi /bin/true install bmi088_accel_core /bin/true install bmi088_accel_spi /bin/true install bmi160_core /bin/true install bmi160_i2c /bin/true install bmi160_spi /bin/true install bmi323_core /bin/true install bmi323_i2c /bin/true install bmi323_spi /bin/true install bmp280 /bin/true install bmp280_i2c /bin/true install bmp280_spi /bin/true install bna /bin/true install bnep /bin/true install bno055 /bin/true install bno055_i2c /bin/true install bno055_ser /bin/true install bnx2fc /bin/true install bnx2i /bin/true install bnx2x /bin/true install bnxt_re /bin/true install bochs /bin/true install bonding /bin/true install bpa10x /bin/true install bpa_rs600 /bin/true install bpck /bin/true install bpck6 /bin/true install bpqether /bin/true install bq2415x_charger /bin/true install bq24190_charger /bin/true install bq24257_charger /bin/true install bq24735_charger /bin/true install bq2515x_charger /bin/true install bq256xx_charger /bin/true install bq25890_charger /bin/true install bq25980_charger /bin/true install bq27xxx_battery /bin/true install bq27xxx_battery_hdq /bin/true install bq27xxx_battery_i2c /bin/true install br2684 /bin/true install br_netfilter /bin/true install brcmfmac /bin/true install brcmfmac_bca /bin/true install brcmfmac_cyw /bin/true install brcmfmac_wcc /bin/true install brcmsmac /bin/true install brcmutil /bin/true install brd /bin/true install broadcom /bin/true install bsd_comp /bin/true install bt3c_cs /bin/true install bt819 /bin/true install bt856 /bin/true install bt866 /bin/true install bt878 /bin/true install btbcm /bin/true install btcoexist /bin/true install btintel /bin/true install btmrvl /bin/true install btmrvl_sdio /bin/true install btmtk /bin/true install btmtksdio /bin/true install btmtkuart /bin/true install btnxpuart /bin/true install btqca /bin/true install btrsi /bin/true install btrtl /bin/true install btsdio /bin/true install bttv /bin/true install btusb /bin/true install bu21013_ts /bin/true install bu21029_ts /bin/true install budget /bin/true install budget_av /bin/true install budget_ci /bin/true install budget_core /bin/true install budget_patch /bin/true install c2port_duramar2150 /bin/true install c67x00 /bin/true install c6xdigio /bin/true install c_can /bin/true install c_can_pci /bin/true install c_can_platform /bin/true install ca8210 /bin/true install cachefiles /bin/true install cadence_wdt /bin/true install cafe_ccic /bin/true install cafe_nand /bin/true install caif /bin/true install caif_serial /bin/true install caif_socket /bin/true install caif_usb /bin/true install caif_virtio /bin/true install camellia_aesni_avx2 /bin/true install camellia_aesni_avx_x86_64 /bin/true install camellia_generic /bin/true install camellia_x86_64 /bin/true install can /bin/true install can327 /bin/true install can_bcm /bin/true install can_dev /bin/true install can_gw /bin/true install can_isotp /bin/true install can_j1939 /bin/true install can_raw /bin/true install capmode /bin/true install capsule_loader /bin/true install carl9170 /bin/true install carminefb /bin/true install cassini /bin/true install cast5_avx_x86_64 /bin/true install cast5_generic /bin/true install cast6_avx_x86_64 /bin/true install cast6_generic /bin/true install cast_common /bin/true install catc /bin/true install cavium_ptp /bin/true install cb710 /bin/true install cb710_mmc /bin/true install cb_das16_cs /bin/true install cb_pcidas /bin/true install cb_pcidas64 /bin/true install cb_pcidda /bin/true install cb_pcimdas /bin/true install cb_pcimdda /bin/true install cc10001_adc /bin/true install cc2520 /bin/true install cc770 /bin/true install cc770_isa /bin/true install cc770_platform /bin/true install ccm /bin/true install ccp /bin/true install ccp_crypto /bin/true install ccs /bin/true install ccs811 /bin/true install ccs_pll /bin/true install cdc_acm /bin/true install cdc_eem /bin/true install cdc_ether /bin/true install cdc_mbim /bin/true install cdc_ncm /bin/true install cdc_phonet /bin/true install cdc_subset /bin/true install cdc_wdm /bin/true install cdns2_udc_pci /bin/true install cdns3 /bin/true install cdns3_pci_wrap /bin/true install cdns_csi2rx /bin/true install cdns_csi2tx /bin/true install cdns_pltfrm /bin/true install cdns_usb_common /bin/true install cdnsp_udc_pci /bin/true install cec /bin/true install cec_gpio /bin/true install ceph /bin/true install cfag12864b /bin/true install cfag12864bfb /bin/true install cfg80211 /bin/true install cfi_cmdset_0001 /bin/true install cfi_cmdset_0002 /bin/true install cfi_cmdset_0020 /bin/true install cfi_probe /bin/true install cfi_util /bin/true install ch /bin/true install ch341 /bin/true install ch7006 /bin/true install ch7322 /bin/true install ch9200 /bin/true install ch_ipsec /bin/true install ch_ktls /bin/true install chacha20poly1305 /bin/true install chacha_generic /bin/true install chacha_x86_64 /bin/true install chaoskey /bin/true install charlcd /bin/true install chcr /bin/true install chipone_icn8505 /bin/true install chipreg /bin/true install chnl_net /bin/true install chromeos_acpi /bin/true install chromeos_laptop /bin/true install chromeos_privacy_screen /bin/true install chromeos_pstore /bin/true install chromeos_tbmc /bin/true install chv3_i2s /bin/true install ci_hdrc /bin/true install ci_hdrc_msm /bin/true install ci_hdrc_npcm /bin/true install ci_hdrc_pci /bin/true install ci_hdrc_usb2 /bin/true install cicada /bin/true install cifs /bin/true install cifs_arc4 /bin/true install cifs_md4 /bin/true install cio_dac /bin/true install cirrus /bin/true install cirrusfb /bin/true install ck804xrom /bin/true install classmate_laptop /bin/true install clip /bin/true install clk_cdce706 /bin/true install clk_cs2000_cp /bin/true install clk_lmk04832 /bin/true install clk_max9485 /bin/true install clk_palmas /bin/true install clk_pwm /bin/true install clk_si5341 /bin/true install clk_si5351 /bin/true install clk_si544 /bin/true install clk_tps68470 /bin/true install clk_twl /bin/true install clk_twl6040 /bin/true install clk_wm831x /bin/true install cls_basic /bin/true install cls_bpf /bin/true install cls_cgroup /bin/true install cls_flow /bin/true install cls_flower /bin/true install cls_fw /bin/true install cls_matchall /bin/true install cls_route /bin/true install cls_u32 /bin/true install cm109 /bin/true install cm32181 /bin/true install cm3232 /bin/true install cm3323 /bin/true install cm3605 /bin/true install cm36651 /bin/true install cma3000_d0x /bin/true install cma3000_d0x_i2c /bin/true install cmac /bin/true install cmdlinepart /bin/true install cmtp /bin/true install cnic /bin/true install cobalt /bin/true install cobra /bin/true install coda /bin/true install colibri_vf50_ts /bin/true install com20020 /bin/true install com20020_cs /bin/true install com20020_pci /bin/true install com90io /bin/true install com90xx /bin/true install comedi /bin/true install comedi_8254 /bin/true install comedi_8255 /bin/true install comedi_bond /bin/true install comedi_example_test /bin/true install comedi_isadma /bin/true install comedi_parport /bin/true install comedi_pci /bin/true install comedi_pcmcia /bin/true install comedi_test /bin/true install comedi_usb /bin/true install comm /bin/true install compal_laptop /bin/true install contec_pci_dio /bin/true install cordic /bin/true install core /bin/true install coretemp /bin/true install corsair_cpro /bin/true install corsair_psu /bin/true install cortina /bin/true install counter /bin/true install cp210x /bin/true install cpcihp_generic /bin/true install cpcihp_zt5550 /bin/true install cpu5wdt /bin/true install cpuidle_haltpoll /bin/true install cqhci /bin/true install cramfs /bin/true install crc32_generic /bin/true install crc32_pclmul /bin/true install crc4 /bin/true install crc7 /bin/true install crc8 /bin/true install crc_itu_t /bin/true install crct10dif_pclmul /bin/true install cros_ec /bin/true install cros_ec_accel_legacy /bin/true install cros_ec_baro /bin/true install cros_ec_cec /bin/true install cros_ec_chardev /bin/true install cros_ec_debugfs /bin/true install cros_ec_dev /bin/true install cros_ec_i2c /bin/true install cros_ec_ishtp /bin/true install cros_ec_keyb /bin/true install cros_ec_lid_angle /bin/true install cros_ec_light_prox /bin/true install cros_ec_lightbar /bin/true install cros_ec_lpcs /bin/true install cros_ec_mkbp_proximity /bin/true install cros_ec_sensorhub /bin/true install cros_ec_sensors /bin/true install cros_ec_sensors_core /bin/true install cros_ec_spi /bin/true install cros_ec_sysfs /bin/true install cros_ec_typec /bin/true install cros_ec_uart /bin/true install cros_hps_i2c /bin/true install cros_kbd_led_backlight /bin/true install cros_peripheral_charger /bin/true install cros_typec_switch /bin/true install cros_usbpd_charger /bin/true install cros_usbpd_logger /bin/true install cros_usbpd_notify /bin/true install cryptd /bin/true install crypto_engine /bin/true install crypto_safexcel /bin/true install crypto_simd /bin/true install crypto_user /bin/true install cs3308 /bin/true install cs42l43 /bin/true install cs42l43_i2c /bin/true install cs42l43_sdw /bin/true install cs5345 /bin/true install cs53l32a /bin/true install cs_dsp /bin/true install csiostor /bin/true install ct82c710 /bin/true install ctucanfd /bin/true install ctucanfd_pci /bin/true install curve25519_generic /bin/true install curve25519_x86_64 /bin/true install cuse /bin/true install cw1200_core /bin/true install cw1200_wlan_sdio /bin/true install cw1200_wlan_spi /bin/true install cw2015_battery /bin/true install cx18 /bin/true install cx18_alsa /bin/true install cx22700 /bin/true install cx22702 /bin/true install cx231xx /bin/true install cx231xx_alsa /bin/true install cx231xx_dvb /bin/true install cx2341x /bin/true install cx23885 /bin/true install cx24110 /bin/true install cx24113 /bin/true install cx24116 /bin/true install cx24117 /bin/true install cx24120 /bin/true install cx24123 /bin/true install cx25821 /bin/true install cx25821_alsa /bin/true install cx25840 /bin/true install cx82310_eth /bin/true install cx8800 /bin/true install cx8802 /bin/true install cx88_alsa /bin/true install cx88_blackbird /bin/true install cx88_dvb /bin/true install cx88_vp3054_i2c /bin/true install cx88xx /bin/true install cxacru /bin/true install cxd2099 /bin/true install cxd2820r /bin/true install cxd2841er /bin/true install cxd2880 /bin/true install cxd2880_spi /bin/true install cxgb /bin/true install cxgb3 /bin/true install cxgb3i /bin/true install cxgb4 /bin/true install cxgb4i /bin/true install cxgb4vf /bin/true install cxgbit /bin/true install cxl_acpi /bin/true install cxl_core /bin/true install cxl_mem /bin/true install cxl_pci /bin/true install cxl_pmem /bin/true install cxl_pmu /bin/true install cxl_port /bin/true install cy8ctma140 /bin/true install cy8ctmg110_ts /bin/true install cyapatp /bin/true install cyber2000fb /bin/true install cyberjack /bin/true install cypress_cy7c63 /bin/true install cypress_firmware /bin/true install cypress_m8 /bin/true install cypress_sf /bin/true install cytherm /bin/true install cyttsp4_core /bin/true install cyttsp4_i2c /bin/true install cyttsp4_spi /bin/true install cyttsp5 /bin/true install cyttsp_core /bin/true install cyttsp_i2c /bin/true install cyttsp_i2c_common /bin/true install cyttsp_spi /bin/true install da280 /bin/true install da311 /bin/true install da7280 /bin/true install da9030_battery /bin/true install da9034_ts /bin/true install da903x_bl /bin/true install da903x_regulator /bin/true install da9052_battery /bin/true install da9052_bl /bin/true install da9052_hwmon /bin/true install da9052_onkey /bin/true install da9052_regulator /bin/true install da9052_tsi /bin/true install da9052_wdt /bin/true install da9055_hwmon /bin/true install da9055_onkey /bin/true install da9055_regulator /bin/true install da9055_wdt /bin/true install da9062_core /bin/true install da9062_regulator /bin/true install da9062_wdt /bin/true install da9063_onkey /bin/true install da9063_wdt /bin/true install da9150_charger /bin/true install da9150_core /bin/true install da9150_fg /bin/true install da9150_gpadc /bin/true install da9210_regulator /bin/true install da9211_regulator /bin/true install dac02 /bin/true install daqboard2000 /bin/true install das08 /bin/true install das08_cs /bin/true install das08_isa /bin/true install das08_pci /bin/true install das16 /bin/true install das16m1 /bin/true install das1800 /bin/true install das6402 /bin/true install das800 /bin/true install davicom /bin/true install dax_cxl /bin/true install dax_hmem /bin/true install dax_pmem /bin/true install db9 /bin/true install dc395x /bin/true install dca /bin/true install dccp /bin/true install dccp_diag /bin/true install dccp_ipv4 /bin/true install dccp_ipv6 /bin/true install dcdbas /bin/true install ddbridge /bin/true install ddbridge_dummy_fe /bin/true install de2104x /bin/true install defxx /bin/true install dell_laptop /bin/true install dell_rbtn /bin/true install dell_rbu /bin/true install dell_smbios /bin/true install dell_smm_hwmon /bin/true install dell_smo8800 /bin/true install dell_uart_backlight /bin/true install dell_wmi /bin/true install dell_wmi_aio /bin/true install dell_wmi_ddv /bin/true install dell_wmi_descriptor /bin/true install dell_wmi_led /bin/true install dell_wmi_sysman /bin/true install delta_ahe50dc_fan /bin/true install denali /bin/true install denali_pci /bin/true install des3_ede_x86_64 /bin/true install des_generic /bin/true install designware_i2s /bin/true install dev_sync_probe /bin/true install device_dax /bin/true install dfl /bin/true install dfl_afu /bin/true install dfl_emif /bin/true install dfl_fme /bin/true install dfl_fme_br /bin/true install dfl_fme_mgr /bin/true install dfl_fme_region /bin/true install dfl_n3000_nios /bin/true install dfl_pci /bin/true install dht11 /bin/true install diag /bin/true install dib0070 /bin/true install dib0090 /bin/true install dib3000mb /bin/true install dib3000mc /bin/true install dib7000m /bin/true install dib7000p /bin/true install dib8000 /bin/true install dib9000 /bin/true install dibx000_common /bin/true install digi_acceleport /bin/true install diskonchip /bin/true install dl2k /bin/true install dlhl60d /bin/true install dlink_dir685_touchkeys /bin/true install dlm /bin/true install dln2 /bin/true install dln2_adc /bin/true install dm1105 /bin/true install dm9601 /bin/true install dm_bio_prison /bin/true install dm_bufio /bin/true install dm_cache /bin/true install dm_cache_smq /bin/true install dm_clone /bin/true install dm_delay /bin/true install dm_ebs /bin/true install dm_era /bin/true install dm_flakey /bin/true install dm_historical_service_time /bin/true install dm_integrity /bin/true install dm_io_affinity /bin/true install dm_log /bin/true install dm_log_userspace /bin/true install dm_log_writes /bin/true install dm_multipath /bin/true install dm_persistent_data /bin/true install dm_queue_length /bin/true install dm_raid /bin/true install dm_region_hash /bin/true install dm_round_robin /bin/true install dm_service_time /bin/true install dm_snapshot /bin/true install dm_switch /bin/true install dm_thin_pool /bin/true install dm_unstripe /bin/true install dm_verity /bin/true install dm_writecache /bin/true install dm_zero /bin/true install dm_zoned /bin/true install dmard06 /bin/true install dmard09 /bin/true install dmard10 /bin/true install dme1737 /bin/true install dmfe /bin/true install dmm32at /bin/true install dmx3191d /bin/true install dnet /bin/true install dp83640 /bin/true install dp83822 /bin/true install dp83848 /bin/true install dp83867 /bin/true install dp83869 /bin/true install dp83tc811 /bin/true install dp83td510 /bin/true install dp83tg720 /bin/true install dpot_dac /bin/true install dps310 /bin/true install dps920ab /bin/true install dptf_pch_fivr /bin/true install dptf_power /bin/true install drbd /bin/true install drivetemp /bin/true install drm_buddy /bin/true install drm_display_helper /bin/true install drm_dma_helper /bin/true install drm_exec /bin/true install drm_gpuvm /bin/true install drm_mipi_dbi /bin/true install drm_suballoc_helper /bin/true install drm_vram_helper /bin/true install drm_xen_front /bin/true install drv260x /bin/true install drv2665 /bin/true install drv2667 /bin/true install drx39xyj /bin/true install drxd /bin/true install drxk /bin/true install ds1621 /bin/true install ds1682 /bin/true install ds1803 /bin/true install ds2482 /bin/true install ds2490 /bin/true install ds2760_battery /bin/true install ds2780_battery /bin/true install ds2781_battery /bin/true install ds2782_battery /bin/true install ds3000 /bin/true install ds4424 /bin/true install ds620 /bin/true install dsa_core /bin/true install dsbr100 /bin/true install dst /bin/true install dst_ca /bin/true install dstr /bin/true install dt2801 /bin/true install dt2811 /bin/true install dt2814 /bin/true install dt2815 /bin/true install dt2817 /bin/true install dt282x /bin/true install dt3000 /bin/true install dt3155 /bin/true install dt9812 /bin/true install dtl1_cs /bin/true install dummy /bin/true install dummy_irq /bin/true install dummy_stm /bin/true install dvb_as102 /bin/true install dvb_bt8xx /bin/true install dvb_core /bin/true install dvb_dummy_fe /bin/true install dvb_pll /bin/true install dvb_ttpci /bin/true install dvb_ttusb_budget /bin/true install dvb_usb /bin/true install dvb_usb_a800 /bin/true install dvb_usb_af9005 /bin/true install dvb_usb_af9005_remote /bin/true install dvb_usb_af9015 /bin/true install dvb_usb_af9035 /bin/true install dvb_usb_anysee /bin/true install dvb_usb_au6610 /bin/true install dvb_usb_az6007 /bin/true install dvb_usb_az6027 /bin/true install dvb_usb_ce6230 /bin/true install dvb_usb_cinergyT2 /bin/true install dvb_usb_cxusb /bin/true install dvb_usb_dib0700 /bin/true install dvb_usb_dibusb_common /bin/true install dvb_usb_dibusb_mb /bin/true install dvb_usb_dibusb_mc /bin/true install dvb_usb_dibusb_mc_common /bin/true install dvb_usb_digitv /bin/true install dvb_usb_dtt200u /bin/true install dvb_usb_dtv5100 /bin/true install dvb_usb_dvbsky /bin/true install dvb_usb_dw2102 /bin/true install dvb_usb_ec168 /bin/true install dvb_usb_gl861 /bin/true install dvb_usb_gp8psk /bin/true install dvb_usb_lmedm04 /bin/true install dvb_usb_m920x /bin/true install dvb_usb_mxl111sf /bin/true install dvb_usb_nova_t_usb2 /bin/true install dvb_usb_opera /bin/true install dvb_usb_pctv452e /bin/true install dvb_usb_rtl28xxu /bin/true install dvb_usb_technisat_usb2 /bin/true install dvb_usb_ttusb2 /bin/true install dvb_usb_umt_010 /bin/true install dvb_usb_v2 /bin/true install dvb_usb_vp702x /bin/true install dvb_usb_vp7045 /bin/true install dw9714 /bin/true install dw9719 /bin/true install dw9768 /bin/true install dw9807_vcm /bin/true install dw_dmac /bin/true install dw_dmac_core /bin/true install dw_dmac_pci /bin/true install dw_edma /bin/true install dw_edma_pcie /bin/true install dw_i3c_master /bin/true install dw_wdt /bin/true install dw_xdata_pcie /bin/true install dwc2_pci /bin/true install dwc3 /bin/true install dwc3_haps /bin/true install dwc3_pci /bin/true install dwc_pcie_pmu /bin/true install dwc_xlgmac /bin/true install dwmac_generic /bin/true install dwmac_intel /bin/true install dyna_pci10xx /bin/true install dynapro /bin/true install e100 /bin/true install e3x0_button /bin/true install e4000 /bin/true install e752x_edac /bin/true install earth_pt1 /bin/true install earth_pt3 /bin/true install ebc_c384_wdt /bin/true install ebt_802_3 /bin/true install ebt_among /bin/true install ebt_arp /bin/true install ebt_arpreply /bin/true install ebt_dnat /bin/true install ebt_ip /bin/true install ebt_ip6 /bin/true install ebt_limit /bin/true install ebt_log /bin/true install ebt_mark /bin/true install ebt_mark_m /bin/true install ebt_nflog /bin/true install ebt_pkttype /bin/true install ebt_redirect /bin/true install ebt_snat /bin/true install ebt_stp /bin/true install ebt_vlan /bin/true install ebtable_broute /bin/true install ebtable_filter /bin/true install ebtable_nat /bin/true install ebtables /bin/true install ec100 /bin/true install ec_bhf /bin/true install ec_sys /bin/true install ecc /bin/true install ecdh_generic /bin/true install ecdsa_generic /bin/true install echainiv /bin/true install echo /bin/true install ecrdsa_generic /bin/true install edac_mce_amd /bin/true install edt_ft5x06 /bin/true install ee1004 /bin/true install eeepc_laptop /bin/true install eeepc_wmi /bin/true install eeprom_93cx6 /bin/true install eeprom_93xx46 /bin/true install eeti_ts /bin/true install efa /bin/true install efct /bin/true install efi_secret /bin/true install efi_test /bin/true install efibc /bin/true install efs /bin/true install egalax_ts_serial /bin/true install ehci_fsl /bin/true install ehset /bin/true install einj /bin/true install ektf2127 /bin/true install elan_i2c /bin/true install elo /bin/true install em28xx /bin/true install em28xx_alsa /bin/true install em28xx_dvb /bin/true install em28xx_rc /bin/true install em28xx_v4l /bin/true install em_canid /bin/true install em_cmp /bin/true install em_ipset /bin/true install em_ipt /bin/true install em_meta /bin/true install em_nbyte /bin/true install em_text /bin/true install em_u32 /bin/true install emc1403 /bin/true install emc2103 /bin/true install emc2305 /bin/true install emc6w201 /bin/true install emi26 /bin/true install emi62 /bin/true install empeg /bin/true install ems_pci /bin/true install ems_pcmcia /bin/true install ems_usb /bin/true install emu10k1_gp /bin/true install ena /bin/true install enc28j60 /bin/true install enclosure /bin/true install encx24j600 /bin/true install encx24j600_regmap /bin/true install ene_ir /bin/true install eni /bin/true install eni_vdpa /bin/true install enic /bin/true install envelope_detector /bin/true install epat /bin/true install epia /bin/true install epic100 /bin/true install eql /bin/true install erdma /bin/true install erofs /bin/true install esas2r /bin/true install esb2rom /bin/true install esd_usb /bin/true install esp4 /bin/true install esp4_offload /bin/true install esp6 /bin/true install esp6_offload /bin/true install esp_scsi /bin/true install essiv /bin/true install et1011c /bin/true install et131x /bin/true install et8ek8 /bin/true install etas_es58x /bin/true install ethoc /bin/true install eurotechwdt /bin/true install evbug /bin/true install exar_wdt /bin/true install exc3000 /bin/true install exfat /bin/true install extcon_adc_jack /bin/true install extcon_axp288 /bin/true install extcon_fsa9480 /bin/true install extcon_gpio /bin/true install extcon_intel_cht_wc /bin/true install extcon_intel_int3496 /bin/true install extcon_intel_mrfld /bin/true install extcon_max14577 /bin/true install extcon_max3355 /bin/true install extcon_max77693 /bin/true install extcon_max77843 /bin/true install extcon_max8997 /bin/true install extcon_palmas /bin/true install extcon_ptn5150 /bin/true install extcon_rt8973a /bin/true install extcon_sm5502 /bin/true install extcon_usb_gpio /bin/true install extcon_usbc_cros_ec /bin/true install extcon_usbc_tusb320 /bin/true install ezusb /bin/true install f2fs /bin/true install f71805f /bin/true install f71808e_wdt /bin/true install f71882fg /bin/true install f75375s /bin/true install f81232 /bin/true install f81534 /bin/true install f81601 /bin/true install f81604 /bin/true install fakelb /bin/true install fam15h_power /bin/true install fan53555 /bin/true install farsync /bin/true install fb_agm1264k_fl /bin/true install fb_bd663474 /bin/true install fb_ddc /bin/true install fb_hx8340bn /bin/true install fb_hx8347d /bin/true install fb_hx8353d /bin/true install fb_hx8357d /bin/true install fb_ili9163 /bin/true install fb_ili9320 /bin/true install fb_ili9325 /bin/true install fb_ili9340 /bin/true install fb_ili9341 /bin/true install fb_ili9481 /bin/true install fb_ili9486 /bin/true install fb_pcd8544 /bin/true install fb_ra8875 /bin/true install fb_s6d02a1 /bin/true install fb_s6d1121 /bin/true install fb_seps525 /bin/true install fb_sh1106 /bin/true install fb_ssd1289 /bin/true install fb_ssd1305 /bin/true install fb_ssd1306 /bin/true install fb_ssd1325 /bin/true install fb_ssd1331 /bin/true install fb_ssd1351 /bin/true install fb_st7735r /bin/true install fb_st7789v /bin/true install fb_tinylcd /bin/true install fb_tls8204 /bin/true install fb_uc1611 /bin/true install fb_uc1701 /bin/true install fb_upd161704 /bin/true install fbtft /bin/true install fc0011 /bin/true install fc0012 /bin/true install fc0013 /bin/true install fc2580 /bin/true install fcoe /bin/true install fcrypt /bin/true install fdomain /bin/true install fdomain_cs /bin/true install fdomain_pci /bin/true install fdp /bin/true install fdp_i2c /bin/true install fealnx /bin/true install ff_memless /bin/true install fieldbus_dev /bin/true install fintek_cir /bin/true install firedtv /bin/true install firewire_core /bin/true install firewire_net /bin/true install firewire_ohci /bin/true install firewire_sbp2 /bin/true install firmware_attributes_class /bin/true install fit2 /bin/true install fit3 /bin/true install fixed /bin/true install fjes /bin/true install fl512 /bin/true install floppy /bin/true install fm10k /bin/true install fm801_gp /bin/true install fm_drv /bin/true install fmvj18x_cs /bin/true install fnic /bin/true install forcedeth /bin/true install fore_200e /bin/true install fou /bin/true install fou6 /bin/true install fpga_bridge /bin/true install fpga_mgr /bin/true install fpga_region /bin/true install freevxfs /bin/true install friq /bin/true install frpw /bin/true install fsa4480 /bin/true install fschmd /bin/true install fsia6b /bin/true install fsl_linflexuart /bin/true install fsl_lpuart /bin/true install fsl_mph_dr_of /bin/true install fsp_3y /bin/true install ftdi_sio /bin/true install ftl /bin/true install ftrace_direct /bin/true install ftrace_direct_modify /bin/true install ftrace_direct_too /bin/true install ftsteutates /bin/true install fujitsu_laptop /bin/true install fujitsu_tablet /bin/true install fujitsu_ts /bin/true install funcore /bin/true install funeth /bin/true install fusb302 /bin/true install fxas21002c_core /bin/true install fxas21002c_i2c /bin/true install fxas21002c_spi /bin/true install fxls8962af_core /bin/true install fxls8962af_i2c /bin/true install fxls8962af_spi /bin/true install fxos8700_core /bin/true install fxos8700_i2c /bin/true install fxos8700_spi /bin/true install g450_pll /bin/true install g760a /bin/true install g762 /bin/true install g_acm_ms /bin/true install g_audio /bin/true install g_cdc /bin/true install g_dbgp /bin/true install g_ether /bin/true install g_ffs /bin/true install g_hid /bin/true install g_mass_storage /bin/true install g_midi /bin/true install g_ncm /bin/true install g_nokia /bin/true install g_printer /bin/true install g_serial /bin/true install g_webcam /bin/true install g_zero /bin/true install gadgetfs /bin/true install gamecon /bin/true install gameport /bin/true install garmin_gps /bin/true install garp /bin/true install gb_audio_apbridgea /bin/true install gb_audio_codec /bin/true install gb_audio_gb /bin/true install gb_audio_manager /bin/true install gb_audio_module /bin/true install gb_beagleplay /bin/true install gb_bootrom /bin/true install gb_es2 /bin/true install gb_firmware /bin/true install gb_gbphy /bin/true install gb_gpio /bin/true install gb_hid /bin/true install gb_i2c /bin/true install gb_light /bin/true install gb_log /bin/true install gb_loopback /bin/true install gb_power_supply /bin/true install gb_pwm /bin/true install gb_raw /bin/true install gb_sdio /bin/true install gb_spi /bin/true install gb_spilib /bin/true install gb_uart /bin/true install gb_usb /bin/true install gb_vibrator /bin/true install gc0308 /bin/true install gc2145 /bin/true install gdmtty /bin/true install gdmulte /bin/true install gen_probe /bin/true install generic /bin/true install generic_adc_battery /bin/true install genet /bin/true install geneve /bin/true install genwqe_card /bin/true install gf2k /bin/true install gfs2 /bin/true install ghash_clmulni_intel /bin/true install gigabyte_waterforce /bin/true install gigabyte_wmi /bin/true install gl518sm /bin/true install gl520sm /bin/true install gl620a /bin/true install gluebi /bin/true install gm12u320 /bin/true install gma500_gfx /bin/true install gnss /bin/true install gnss_mtk /bin/true install gnss_serial /bin/true install gnss_sirf /bin/true install gnss_ubx /bin/true install gnss_usb /bin/true install go7007 /bin/true install go7007_loader /bin/true install go7007_usb /bin/true install goku_udc /bin/true install goldfish_battery /bin/true install goodix_ts /bin/true install gp2ap002 /bin/true install gp2ap020a00f /bin/true install gp8psk_fe /bin/true install gpd_pocket_fan /bin/true install gpio /bin/true install gpio_104_dio_48e /bin/true install gpio_104_idi_48 /bin/true install gpio_104_idio_16 /bin/true install gpio_aaeon /bin/true install gpio_adp5520 /bin/true install gpio_aggregator /bin/true install gpio_amd8111 /bin/true install gpio_amd_fch /bin/true install gpio_amdpt /bin/true install gpio_arizona /bin/true install gpio_backlight /bin/true install gpio_bd9571mwv /bin/true install gpio_beeper /bin/true install gpio_charger /bin/true install gpio_da9052 /bin/true install gpio_da9055 /bin/true install gpio_decoder /bin/true install gpio_dln2 /bin/true install gpio_ds4520 /bin/true install gpio_dwapb /bin/true install gpio_elkhartlake /bin/true install gpio_exar /bin/true install gpio_f7188x /bin/true install gpio_fxl6408 /bin/true install gpio_gpio_mm /bin/true install gpio_i8255 /bin/true install gpio_ich /bin/true install gpio_idio_16 /bin/true install gpio_it87 /bin/true install gpio_janz_ttl /bin/true install gpio_kempld /bin/true install gpio_keys /bin/true install gpio_keys_polled /bin/true install gpio_latch /bin/true install gpio_ljca /bin/true install gpio_lp3943 /bin/true install gpio_lp873x /bin/true install gpio_madera /bin/true install gpio_max3191x /bin/true install gpio_max7300 /bin/true install gpio_max7301 /bin/true install gpio_max730x /bin/true install gpio_max732x /bin/true install gpio_mb86s7x /bin/true install gpio_mc33880 /bin/true install gpio_menz127 /bin/true install gpio_ml_ioh /bin/true install gpio_mouse /bin/true install gpio_pca953x /bin/true install gpio_pca9570 /bin/true install gpio_pcf857x /bin/true install gpio_pci_idio_16 /bin/true install gpio_pcie_idio_24 /bin/true install gpio_pisosr /bin/true install gpio_rdc321x /bin/true install gpio_regmap /bin/true install gpio_regulator /bin/true install gpio_sbu_mux /bin/true install gpio_sch /bin/true install gpio_sch311x /bin/true install gpio_sim /bin/true install gpio_siox /bin/true install gpio_tangier /bin/true install gpio_tpic2810 /bin/true install gpio_tps65086 /bin/true install gpio_tps65912 /bin/true install gpio_tps68470 /bin/true install gpio_tqmx86 /bin/true install gpio_twl4030 /bin/true install gpio_twl6040 /bin/true install gpio_vibra /bin/true install gpio_viperboard /bin/true install gpio_virtio /bin/true install gpio_vx855 /bin/true install gpio_wcove /bin/true install gpio_winbond /bin/true install gpio_wm831x /bin/true install gpio_wm8350 /bin/true install gpio_wm8994 /bin/true install gpio_ws16c48 /bin/true install gpio_xra1403 /bin/true install gpu_sched /bin/true install gr_udc /bin/true install grace /bin/true install gre /bin/true install greybus /bin/true install grip /bin/true install grip_mp /bin/true install gru /bin/true install gs1662 /bin/true install gs_usb /bin/true install gsc_hpdi /bin/true install gspca_benq /bin/true install gspca_conex /bin/true install gspca_cpia1 /bin/true install gspca_dtcs033 /bin/true install gspca_etoms /bin/true install gspca_finepix /bin/true install gspca_gl860 /bin/true install gspca_jeilinj /bin/true install gspca_jl2005bcd /bin/true install gspca_kinect /bin/true install gspca_konica /bin/true install gspca_m5602 /bin/true install gspca_main /bin/true install gspca_mars /bin/true install gspca_mr97310a /bin/true install gspca_nw80x /bin/true install gspca_ov519 /bin/true install gspca_ov534 /bin/true install gspca_ov534_9 /bin/true install gspca_pac207 /bin/true install gspca_pac7302 /bin/true install gspca_pac7311 /bin/true install gspca_se401 /bin/true install gspca_sn9c2028 /bin/true install gspca_sn9c20x /bin/true install gspca_sonixb /bin/true install gspca_sonixj /bin/true install gspca_spca1528 /bin/true install gspca_spca500 /bin/true install gspca_spca501 /bin/true install gspca_spca505 /bin/true install gspca_spca506 /bin/true install gspca_spca508 /bin/true install gspca_spca561 /bin/true install gspca_sq905 /bin/true install gspca_sq905c /bin/true install gspca_sq930x /bin/true install gspca_stk014 /bin/true install gspca_stk1135 /bin/true install gspca_stv0680 /bin/true install gspca_stv06xx /bin/true install gspca_sunplus /bin/true install gspca_t613 /bin/true install gspca_topro /bin/true install gspca_touptek /bin/true install gspca_tv8532 /bin/true install gspca_vc032x /bin/true install gspca_vicam /bin/true install gspca_xirlink_cit /bin/true install gspca_zc3xx /bin/true install gtp /bin/true install gud /bin/true install guillemot /bin/true install gunze /bin/true install gve /bin/true install habanalabs /bin/true install hackrf /bin/true install hamachi /bin/true install hampshire /bin/true install hangcheck_timer /bin/true install hanwang /bin/true install hci /bin/true install hci_bcm4377 /bin/true install hci_nokia /bin/true install hci_uart /bin/true install hci_vhci /bin/true install hctr2 /bin/true install hd3ss3220 /bin/true install hd44780 /bin/true install hd44780_common /bin/true install hdaps /bin/true install hdc100x /bin/true install hdc2010 /bin/true install hdc3020 /bin/true install hdlc /bin/true install hdlc_cisco /bin/true install hdlc_fr /bin/true install hdlc_ppp /bin/true install hdlc_raw /bin/true install hdlc_raw_eth /bin/true install hdlc_x25 /bin/true install hdlcdrv /bin/true install hdma /bin/true install hdma_mgmt /bin/true install hdpvr /bin/true install he /bin/true install hecubafb /bin/true install helene /bin/true install hellcreek_sw /bin/true install hexium_gemini /bin/true install hexium_orion /bin/true install hfcmulti /bin/true install hfcpci /bin/true install hfcsusb /bin/true install hfi1 /bin/true install hfs /bin/true install hfsplus /bin/true install hgafb /bin/true install hi311x /bin/true install hi556 /bin/true install hi6210_i2s /bin/true install hi8435 /bin/true install hi846 /bin/true install hi847 /bin/true install hid_a4tech /bin/true install hid_accutouch /bin/true install hid_alps /bin/true install hid_apple /bin/true install hid_appleir /bin/true install hid_asus /bin/true install hid_aureal /bin/true install hid_axff /bin/true install hid_belkin /bin/true install hid_betopff /bin/true install hid_bigbenff /bin/true install hid_cherry /bin/true install hid_chicony /bin/true install hid_cmedia /bin/true install hid_corsair /bin/true install hid_cougar /bin/true install hid_cp2112 /bin/true install hid_creative_sb0540 /bin/true install hid_cypress /bin/true install hid_dr /bin/true install hid_elan /bin/true install hid_elecom /bin/true install hid_elo /bin/true install hid_emsff /bin/true install hid_evision /bin/true install hid_ezkey /bin/true install hid_ft260 /bin/true install hid_gaff /bin/true install hid_gembird /bin/true install hid_gfrm /bin/true install hid_glorious /bin/true install hid_google_hammer /bin/true install hid_google_stadiaff /bin/true install hid_gt683r /bin/true install hid_gyration /bin/true install hid_holtek_kbd /bin/true install hid_holtek_mouse /bin/true install hid_holtekff /bin/true install hid_hyperv /bin/true install hid_icade /bin/true install hid_ite /bin/true install hid_jabra /bin/true install hid_kensington /bin/true install hid_keytouch /bin/true install hid_kye /bin/true install hid_lcpower /bin/true install hid_led /bin/true install hid_lenovo /bin/true install hid_letsketch /bin/true install hid_lg_g15 /bin/true install hid_logitech /bin/true install hid_logitech_dj /bin/true install hid_logitech_hidpp /bin/true install hid_macally /bin/true install hid_magicmouse /bin/true install hid_maltron /bin/true install hid_mcp2200 /bin/true install hid_mcp2221 /bin/true install hid_megaworld /bin/true install hid_mf /bin/true install hid_microsoft /bin/true install hid_monterey /bin/true install hid_multitouch /bin/true install hid_nintendo /bin/true install hid_nti /bin/true install hid_ntrig /bin/true install hid_nvidia_shield /bin/true install hid_ortek /bin/true install hid_penmount /bin/true install hid_petalynx /bin/true install hid_picolcd /bin/true install hid_pl /bin/true install hid_plantronics /bin/true install hid_playstation /bin/true install hid_primax /bin/true install hid_prodikeys /bin/true install hid_pxrc /bin/true install hid_razer /bin/true install hid_redragon /bin/true install hid_retrode /bin/true install hid_rmi /bin/true install hid_roccat /bin/true install hid_roccat_arvo /bin/true install hid_roccat_common /bin/true install hid_roccat_isku /bin/true install hid_roccat_kone /bin/true install hid_roccat_koneplus /bin/true install hid_roccat_konepure /bin/true install hid_roccat_kovaplus /bin/true install hid_roccat_lua /bin/true install hid_roccat_pyra /bin/true install hid_roccat_ryos /bin/true install hid_roccat_savu /bin/true install hid_saitek /bin/true install hid_samsung /bin/true install hid_semitek /bin/true install hid_sensor_accel_3d /bin/true install hid_sensor_als /bin/true install hid_sensor_custom /bin/true install hid_sensor_custom_intel_hinge /bin/true install hid_sensor_gyro_3d /bin/true install hid_sensor_hub /bin/true install hid_sensor_humidity /bin/true install hid_sensor_iio_common /bin/true install hid_sensor_incl_3d /bin/true install hid_sensor_magn_3d /bin/true install hid_sensor_press /bin/true install hid_sensor_prox /bin/true install hid_sensor_rotation /bin/true install hid_sensor_temperature /bin/true install hid_sensor_trigger /bin/true install hid_sigmamicro /bin/true install hid_sjoy /bin/true install hid_sony /bin/true install hid_speedlink /bin/true install hid_steam /bin/true install hid_steelseries /bin/true install hid_sunplus /bin/true install hid_thrustmaster /bin/true install hid_tivo /bin/true install hid_tmff /bin/true install hid_topre /bin/true install hid_topseed /bin/true install hid_twinhan /bin/true install hid_u2fzero /bin/true install hid_uclogic /bin/true install hid_udraw_ps3 /bin/true install hid_universal_pidff /bin/true install hid_viewsonic /bin/true install hid_vivaldi /bin/true install hid_vivaldi_common /bin/true install hid_vrc2 /bin/true install hid_waltop /bin/true install hid_wiimote /bin/true install hid_xiaomi /bin/true install hid_xinmo /bin/true install hid_zpff /bin/true install hid_zydacron /bin/true install hideep /bin/true install hidp /bin/true install hih6130 /bin/true install himax_hx83112b /bin/true install hinic /bin/true install hisi_spmi_controller /bin/true install hmc425a /bin/true install hmc5843_core /bin/true install hmc5843_i2c /bin/true install hmc5843_spi /bin/true install hmc6352 /bin/true install hopper /bin/true install horus3a /bin/true install hp03 /bin/true install hp206c /bin/true install hp_accel /bin/true install hp_bioscfg /bin/true install hp_wmi /bin/true install hp_wmi_sensors /bin/true install hpfs /bin/true install hpilo /bin/true install hpsa /bin/true install hptiop /bin/true install hpwdt /bin/true install hs3001 /bin/true install hsc030pa /bin/true install hsc030pa_i2c /bin/true install hsc030pa_spi /bin/true install hsi /bin/true install hsi_char /bin/true install hso /bin/true install hsr /bin/true install ht16k33 /bin/true install hts221 /bin/true install hts221_i2c /bin/true install hts221_spi /bin/true install htu21 /bin/true install huawei_cdc_ncm /bin/true install huawei_wmi /bin/true install hv_balloon /bin/true install hv_netvsc /bin/true install hv_sock /bin/true install hv_storvsc /bin/true install hv_utils /bin/true install hv_vmbus /bin/true install hwmon_aaeon /bin/true install hwmon_vid /bin/true install hwpoison_inject /bin/true install hx711 /bin/true install hx8357 /bin/true install hx8357d /bin/true install hycon_hy46xx /bin/true install hynitron_cstxxx /bin/true install hyperbus_core /bin/true install hyperv_drm /bin/true install hyperv_keyboard /bin/true install i10nm_edac /bin/true install i2c_algo_bit /bin/true install i2c_algo_pca /bin/true install i2c_ali1535 /bin/true install i2c_ali1563 /bin/true install i2c_ali15x3 /bin/true install i2c_amd756 /bin/true install i2c_amd756_s4882 /bin/true install i2c_amd8111 /bin/true install i2c_amd_mp2_pci /bin/true install i2c_amd_mp2_plat /bin/true install i2c_cbus_gpio /bin/true install i2c_ccgx_ucsi /bin/true install i2c_cht_wc /bin/true install i2c_cp2615 /bin/true install i2c_cros_ec_tunnel /bin/true install i2c_designware_pci /bin/true install i2c_diolan_u2c /bin/true install i2c_dln2 /bin/true install i2c_gpio /bin/true install i2c_hid /bin/true install i2c_hid_acpi /bin/true install i2c_hid_of /bin/true install i2c_isch /bin/true install i2c_ismt /bin/true install i2c_kempld /bin/true install i2c_ljca /bin/true install i2c_matroxfb /bin/true install i2c_mchp_pci1xxxx /bin/true install i2c_mlxcpld /bin/true install i2c_mux /bin/true install i2c_mux_gpio /bin/true install i2c_mux_ltc4306 /bin/true install i2c_mux_mlxcpld /bin/true install i2c_mux_pca9541 /bin/true install i2c_mux_pca954x /bin/true install i2c_mux_reg /bin/true install i2c_nforce2 /bin/true install i2c_nforce2_s4985 /bin/true install i2c_nvidia_gpu /bin/true install i2c_ocores /bin/true install i2c_parport /bin/true install i2c_pca_platform /bin/true install i2c_piix4 /bin/true install i2c_robotfuzz_osif /bin/true install i2c_scmi /bin/true install i2c_simtec /bin/true install i2c_sis5595 /bin/true install i2c_sis630 /bin/true install i2c_sis96x /bin/true install i2c_stub /bin/true install i2c_taos_evm /bin/true install i2c_tiny_usb /bin/true install i2c_via /bin/true install i2c_viapro /bin/true install i2c_viperboard /bin/true install i2c_virtio /bin/true install i2c_xiic /bin/true install i3000_edac /bin/true install i3200_edac /bin/true install i3c /bin/true install i3c_master_cdns /bin/true install i40e /bin/true install i5100_edac /bin/true install i5400_edac /bin/true install i5500_temp /bin/true install i5k_amb /bin/true install i6300esb /bin/true install i7300_edac /bin/true install i740fb /bin/true install i7core_edac /bin/true install i82092 /bin/true install i8254 /bin/true install i82975x_edac /bin/true install i915 /bin/true install iTCO_vendor_support /bin/true install iTCO_wdt /bin/true install iaa_crypto /bin/true install iavf /bin/true install ib700wdt /bin/true install ib_cm /bin/true install ib_core /bin/true install ib_ipoib /bin/true install ib_iser /bin/true install ib_isert /bin/true install ib_mthca /bin/true install ib_qib /bin/true install ib_srp /bin/true install ib_srpt /bin/true install ib_umad /bin/true install ib_uverbs /bin/true install ibm_cffps /bin/true install ibm_rtl /bin/true install ibmaem /bin/true install ibmasm /bin/true install ibmasr /bin/true install ibmpex /bin/true install ice /bin/true install ichxrom /bin/true install icp10100 /bin/true install icp_multi /bin/true install icplus /bin/true install ics932s401 /bin/true install ideapad_laptop /bin/true install ideapad_slidebar /bin/true install idma64 /bin/true install idmouse /bin/true install idpf /bin/true install idt77252 /bin/true install idt_89hpesx /bin/true install idt_gen2 /bin/true install idt_gen3 /bin/true install idtcps /bin/true install idxd /bin/true install idxd_bus /bin/true install ie31200_edac /bin/true install ie6xx_wdt /bin/true install ieee802154 /bin/true install ieee802154_6lowpan /bin/true install ieee802154_socket /bin/true install ifb /bin/true install ifcvf /bin/true install ife /bin/true install ifi_canfd /bin/true install iforce /bin/true install iforce_serio /bin/true install iforce_usb /bin/true install igbvf /bin/true install igen6_edac /bin/true install igorplugusb /bin/true install iguanair /bin/true install ii_pci20kc /bin/true install iio_dummy /bin/true install iio_hwmon /bin/true install iio_mux /bin/true install iio_rescale /bin/true install iio_trig_hrtimer /bin/true install iio_trig_interrupt /bin/true install iio_trig_loop /bin/true install iio_trig_sysfs /bin/true install ila /bin/true install ili210x /bin/true install ili9163 /bin/true install ili9225 /bin/true install ili922x /bin/true install ili9320 /bin/true install ili9341 /bin/true install ili9486 /bin/true install ilitek_ts_i2c /bin/true install imagis /bin/true install img_ascii_lcd /bin/true install img_i2s_in /bin/true install img_i2s_out /bin/true install img_parallel_out /bin/true install img_spdif_in /bin/true install img_spdif_out /bin/true install imm /bin/true install imon /bin/true install imon_raw /bin/true install ims_pcu /bin/true install imx208 /bin/true install imx214 /bin/true install imx219 /bin/true install imx258 /bin/true install imx274 /bin/true install imx290 /bin/true install imx296 /bin/true install imx319 /bin/true install imx355 /bin/true install ina209 /bin/true install ina238 /bin/true install ina2xx /bin/true install ina2xx_adc /bin/true install ina3221 /bin/true install industrialio /bin/true install industrialio_backend /bin/true install industrialio_buffer_cb /bin/true install industrialio_buffer_dma /bin/true install industrialio_buffer_dmaengine /bin/true install industrialio_configfs /bin/true install industrialio_gts_helper /bin/true install industrialio_hw_consumer /bin/true install industrialio_sw_device /bin/true install industrialio_sw_trigger /bin/true install industrialio_triggered_buffer /bin/true install industrialio_triggered_event /bin/true install inexio /bin/true install inftl /bin/true install initio /bin/true install inspur_ipsps /bin/true install inspur_platform_profile /bin/true install int3400_thermal /bin/true install int3401_thermal /bin/true install int3402_thermal /bin/true install int3403_thermal /bin/true install int3406_thermal /bin/true install int340x_thermal_zone /bin/true install int51x1 /bin/true install intel_atomisp2_led /bin/true install intel_atomisp2_pm /bin/true install intel_bxt_pmic_thermal /bin/true install intel_bxtwc_tmu /bin/true install intel_bytcrc_pwrsrc /bin/true install intel_chtdc_ti_pwrbtn /bin/true install intel_chtwc_int33fe /bin/true install intel_crystal_cove_charger /bin/true install intel_cstate /bin/true install intel_hid /bin/true install intel_ifs /bin/true install intel_int0002_vgpio /bin/true install intel_ips /bin/true install intel_ish_ipc /bin/true install intel_ishtp /bin/true install intel_ishtp_hid /bin/true install intel_ishtp_loader /bin/true install intel_lpss /bin/true install intel_lpss_acpi /bin/true install intel_lpss_pci /bin/true install intel_m10_bmc_core /bin/true install intel_m10_bmc_hwmon /bin/true install intel_m10_bmc_pmci /bin/true install intel_m10_bmc_spi /bin/true install intel_mrfld_adc /bin/true install intel_mrfld_pwrbtn /bin/true install intel_oaktrail /bin/true install intel_pch_thermal /bin/true install intel_pmc_bxt /bin/true install intel_pmc_core /bin/true install intel_pmc_core_pltdrv /bin/true install intel_pmc_mux /bin/true install intel_powerclamp /bin/true install intel_punit_ipc /bin/true install intel_qat /bin/true install intel_qep /bin/true install intel_quark_i2c_gpio /bin/true install intel_rapl_common /bin/true install intel_rapl_msr /bin/true install intel_rapl_tpmi /bin/true install intel_rng /bin/true install intel_rst /bin/true install intel_sar /bin/true install intel_scu_ipcutil /bin/true install intel_scu_pltdrv /bin/true install intel_sdsi /bin/true install intel_skl_int3472_discrete /bin/true install intel_skl_int3472_tps68470 /bin/true install intel_smartconnect /bin/true install intel_soc_dts_iosf /bin/true install intel_soc_dts_thermal /bin/true install intel_soc_pmic_bxtwc /bin/true install intel_soc_pmic_chtdc_ti /bin/true install intel_soc_pmic_mrfld /bin/true install intel_tcc_cooling /bin/true install intel_telemetry_core /bin/true install intel_telemetry_debugfs /bin/true install intel_telemetry_pltdrv /bin/true install intel_th /bin/true install intel_th_acpi /bin/true install intel_th_gth /bin/true install intel_th_msu /bin/true install intel_th_msu_sink /bin/true install intel_th_pci /bin/true install intel_th_pti /bin/true install intel_th_sth /bin/true install intel_uncore_frequency /bin/true install intel_uncore_frequency_common /bin/true install intel_uncore_frequency_tpmi /bin/true install intel_vbtn /bin/true install intel_vpu /bin/true install intel_vr_nor /bin/true install intel_vsec /bin/true install intel_vsec_tpmi /bin/true install intel_wmi_sbl_fw_update /bin/true install intel_wmi_thunderbolt /bin/true install intel_xhci_usb_role_switch /bin/true install intel_xway /bin/true install interact /bin/true install interrupt_cnt /bin/true install inv_icm42600 /bin/true install inv_icm42600_i2c /bin/true install inv_icm42600_spi /bin/true install inv_mpu6050 /bin/true install inv_mpu6050_i2c /bin/true install inv_mpu6050_spi /bin/true install inv_sensors_timestamp /bin/true install io_edgeport /bin/true install io_ti /bin/true install ioatdma /bin/true install iommufd /bin/true install ionic /bin/true install iosm /bin/true install iowarrior /bin/true install ip5xxx_power /bin/true install ip6_gre /bin/true install ip6_tables /bin/true install ip6_tunnel /bin/true install ip6_vti /bin/true install ip6t_NPT /bin/true install ip6t_SYNPROXY /bin/true install ip6t_ah /bin/true install ip6t_eui64 /bin/true install ip6t_frag /bin/true install ip6t_hbh /bin/true install ip6t_ipv6header /bin/true install ip6t_mh /bin/true install ip6t_rpfilter /bin/true install ip6t_srh /bin/true install ip6table_filter /bin/true install ip6table_mangle /bin/true install ip6table_nat /bin/true install ip6table_raw /bin/true install ip6table_security /bin/true install ip_gre /bin/true install ip_set_bitmap_ip /bin/true install ip_set_bitmap_ipmac /bin/true install ip_set_bitmap_port /bin/true install ip_set_hash_ip /bin/true install ip_set_hash_ipmac /bin/true install ip_set_hash_ipmark /bin/true install ip_set_hash_ipport /bin/true install ip_set_hash_ipportip /bin/true install ip_set_hash_ipportnet /bin/true install ip_set_hash_mac /bin/true install ip_set_hash_net /bin/true install ip_set_hash_netiface /bin/true install ip_set_hash_netnet /bin/true install ip_set_hash_netport /bin/true install ip_set_hash_netportnet /bin/true install ip_set_list_set /bin/true install ip_tunnel /bin/true install ip_vs /bin/true install ip_vs_dh /bin/true install ip_vs_fo /bin/true install ip_vs_ftp /bin/true install ip_vs_lblc /bin/true install ip_vs_lblcr /bin/true install ip_vs_lc /bin/true install ip_vs_mh /bin/true install ip_vs_nq /bin/true install ip_vs_ovf /bin/true install ip_vs_pe_sip /bin/true install ip_vs_rr /bin/true install ip_vs_sed /bin/true install ip_vs_sh /bin/true install ip_vs_twos /bin/true install ip_vs_wlc /bin/true install ip_vs_wrr /bin/true install ip_vti /bin/true install ipack /bin/true install ipaq /bin/true install ipcomp /bin/true install ipcomp6 /bin/true install iphase /bin/true install ipheth /bin/true install ipip /bin/true install ipmi_devintf /bin/true install ipmi_msghandler /bin/true install ipmi_poweroff /bin/true install ipmi_si /bin/true install ipmi_ssif /bin/true install ipmi_watchdog /bin/true install ipoctal /bin/true install ipr /bin/true install ips /bin/true install ipt_ECN /bin/true install ipt_SYNPROXY /bin/true install ipt_ah /bin/true install ipt_rpfilter /bin/true install iptable_filter /bin/true install iptable_mangle /bin/true install iptable_nat /bin/true install iptable_raw /bin/true install iptable_security /bin/true install ipu3_cio2 /bin/true install ipu3_imgu /bin/true install ipu_bridge /bin/true install ipvlan /bin/true install ipvtap /bin/true install ipw /bin/true install ipw2100 /bin/true install ipw2200 /bin/true install ipwireless /bin/true install iqs269a /bin/true install iqs5xx /bin/true install iqs620at_temp /bin/true install iqs621_als /bin/true install iqs624_pos /bin/true install iqs626a /bin/true install iqs62x /bin/true install iqs62x_keys /bin/true install iqs7211 /bin/true install iqs7222 /bin/true install ir35221 /bin/true install ir36021 /bin/true install ir38064 /bin/true install ir_imon_decoder /bin/true install ir_jvc_decoder /bin/true install ir_kbd_i2c /bin/true install ir_mce_kbd_decoder /bin/true install ir_nec_decoder /bin/true install ir_rc5_decoder /bin/true install ir_rc6_decoder /bin/true install ir_rcmm_decoder /bin/true install ir_sanyo_decoder /bin/true install ir_sharp_decoder /bin/true install ir_sony_decoder /bin/true install ir_toy /bin/true install ir_usb /bin/true install ir_xmp_decoder /bin/true install irdma /bin/true install irps5401 /bin/true install irq_madera /bin/true install irqbypass /bin/true install irsd200 /bin/true install isci /bin/true install iscsi_boot_sysfs /bin/true install iscsi_ibft /bin/true install iscsi_target_mod /bin/true install iscsi_tcp /bin/true install isdnhdlc /bin/true install ishtp_eclite /bin/true install isight_firmware /bin/true install isl29003 /bin/true install isl29018 /bin/true install isl29020 /bin/true install isl29028 /bin/true install isl29125 /bin/true install isl29501 /bin/true install isl6271a_regulator /bin/true install isl6405 /bin/true install isl6421 /bin/true install isl6423 /bin/true install isl68137 /bin/true install isl76682 /bin/true install isl9305 /bin/true install isofs /bin/true install isp116x_hcd /bin/true install isp1704_charger /bin/true install isp1760 /bin/true install isst_if_common /bin/true install isst_if_mbox_msr /bin/true install isst_if_mbox_pci /bin/true install isst_if_mmio /bin/true install isst_tpmi /bin/true install isst_tpmi_core /bin/true install it87 /bin/true install it8712f_wdt /bin/true install it87_wdt /bin/true install it913x /bin/true install itd1000 /bin/true install ite_cir /bin/true install itg3200 /bin/true install iuu_phoenix /bin/true install ivsc_ace /bin/true install ivsc_csi /bin/true install ivtv /bin/true install ivtv_alsa /bin/true install ivtvfb /bin/true install iw_cm /bin/true install iw_cxgb4 /bin/true install iwl3945 /bin/true install iwl4965 /bin/true install iwldvm /bin/true install iwlegacy /bin/true install iwlmvm /bin/true install iwlwifi /bin/true install ix2505v /bin/true install ixgbevf /bin/true install janz_cmodio /bin/true install janz_ican3 /bin/true install jc42 /bin/true install jedec_probe /bin/true install jffs2 /bin/true install jfs /bin/true install jmb38x_ms /bin/true install jme /bin/true install joydump /bin/true install jr3_pci /bin/true install jsa1212 /bin/true install jsm /bin/true install k10temp /bin/true install k8temp /bin/true install kafs /bin/true install kalmia /bin/true install kaweth /bin/true install kb3886_bl /bin/true install kbic /bin/true install kbtab /bin/true install kcm /bin/true install kcomedilib /bin/true install ke_counter /bin/true install kempld_core /bin/true install kempld_wdt /bin/true install kernelcapi /bin/true install keyspan /bin/true install keyspan_pda /bin/true install keyspan_remote /bin/true install keywrap /bin/true install kfifo_buf /bin/true install kheaders /bin/true install kionix_kx022a /bin/true install kionix_kx022a_i2c /bin/true install kionix_kx022a_spi /bin/true install kl5kusb105 /bin/true install kmem /bin/true install kmx61 /bin/true install kobil_sct /bin/true install ks0108 /bin/true install ks0127 /bin/true install ks7010 /bin/true install ks8842 /bin/true install ks8851_common /bin/true install ks8851_par /bin/true install ks8851_spi /bin/true install ksmbd /bin/true install ksz884x /bin/true install ksz8863_smi /bin/true install ksz9477_i2c /bin/true install ksz_spi /bin/true install ksz_switch /bin/true install ktd253_backlight /bin/true install ktti /bin/true install ktz8866 /bin/true install kvaser_pci /bin/true install kvaser_pciefd /bin/true install kvaser_usb /bin/true install kvm /bin/true install kvm_amd /bin/true install kvm_intel /bin/true install kvmgt /bin/true install kxcjk_1013 /bin/true install kxsd9 /bin/true install kxsd9_i2c /bin/true install kxsd9_spi /bin/true install kxtj9 /bin/true install kyber_iosched /bin/true install kyrofb /bin/true install l1oip /bin/true install l2tp_core /bin/true install l2tp_debugfs /bin/true install l2tp_eth /bin/true install l2tp_ip /bin/true install l2tp_ip6 /bin/true install l2tp_netlink /bin/true install l2tp_ppp /bin/true install l440gx /bin/true install l4f00242t03 /bin/true install l64781 /bin/true install lan743x /bin/true install lan78xx /bin/true install lan9303_core /bin/true install lan9303_i2c /bin/true install lan9303_mdio /bin/true install lanai /bin/true install lantiq /bin/true install lantiq_gswip /bin/true install lapb /bin/true install lapbether /bin/true install lattice_ecp3_config /bin/true install lattice_sysconfig /bin/true install lattice_sysconfig_spi /bin/true install lcd /bin/true install lcd2s /bin/true install ldusb /bin/true install lec /bin/true install led_class_flash /bin/true install led_class_multicolor /bin/true install leds_88pm860x /bin/true install leds_aaeon /bin/true install leds_adp5520 /bin/true install leds_apu /bin/true install leds_as3645a /bin/true install leds_aw200xx /bin/true install leds_bd2606mvv /bin/true install leds_bd2802 /bin/true install leds_blinkm /bin/true install leds_cht_wcove /bin/true install leds_da903x /bin/true install leds_da9052 /bin/true install leds_dac124s085 /bin/true install leds_gpio /bin/true install leds_is31fl319x /bin/true install leds_lm3530 /bin/true install leds_lm3532 /bin/true install leds_lm3533 /bin/true install leds_lm355x /bin/true install leds_lm3601x /bin/true install leds_lm36274 /bin/true install leds_lm3642 /bin/true install leds_lp3944 /bin/true install leds_lp3952 /bin/true install leds_lp50xx /bin/true install leds_lp8788 /bin/true install leds_lt3593 /bin/true install leds_max8997 /bin/true install leds_mc13783 /bin/true install leds_menf21bmc /bin/true install leds_mlxcpld /bin/true install leds_mlxreg /bin/true install leds_mt6323 /bin/true install leds_mt6370_flash /bin/true install leds_mt6370_rgb /bin/true install leds_nic78bx /bin/true install leds_pca9532 /bin/true install leds_pca955x /bin/true install leds_pca963x /bin/true install leds_pca995x /bin/true install leds_pwm /bin/true install leds_pwm_multicolor /bin/true install leds_regulator /bin/true install leds_rt8515 /bin/true install leds_sgm3140 /bin/true install leds_ss4200 /bin/true install leds_tca6507 /bin/true install leds_ti_lmu_common /bin/true install leds_tlc591xx /bin/true install leds_tps6105x /bin/true install leds_wm831x_status /bin/true install leds_wm8350 /bin/true install ledtrig_activity /bin/true install ledtrig_audio /bin/true install ledtrig_backlight /bin/true install ledtrig_camera /bin/true install ledtrig_default_on /bin/true install ledtrig_gpio /bin/true install ledtrig_heartbeat /bin/true install ledtrig_netdev /bin/true install ledtrig_oneshot /bin/true install ledtrig_pattern /bin/true install ledtrig_timer /bin/true install ledtrig_transient /bin/true install ledtrig_tty /bin/true install ledtrig_usbport /bin/true install legousbtower /bin/true install lenovo_wmi_hotkey_utilities /bin/true install lenovo_ymc /bin/true install lenovo_yogabook /bin/true install lg2160 /bin/true install lg_laptop /bin/true install lg_vl600 /bin/true install lgdt3305 /bin/true install lgdt3306a /bin/true install lgdt330x /bin/true install lgs8gl5 /bin/true install lgs8gxx /bin/true install lib80211 /bin/true install lib80211_crypt_ccmp /bin/true install lib80211_crypt_tkip /bin/true install lib80211_crypt_wep /bin/true install libahci_platform /bin/true install libarc4 /bin/true install libceph /bin/true install libchacha /bin/true install libchacha20poly1305 /bin/true install libcomposite /bin/true install libcurve25519 /bin/true install libcurve25519_generic /bin/true install libcxgb /bin/true install libcxgbi /bin/true install libdes /bin/true install libertas /bin/true install libertas_sdio /bin/true install libertas_spi /bin/true install libertas_tf /bin/true install libertas_tf_usb /bin/true install libfc /bin/true install libfcoe /bin/true install libipw /bin/true install libiscsi /bin/true install libiscsi_tcp /bin/true install libpoly1305 /bin/true install libsas /bin/true install libwx /bin/true install line_display /bin/true install lineage_pem /bin/true install liquidio /bin/true install liquidio_core /bin/true install liquidio_vf /bin/true install lis3lv02d /bin/true install lis3lv02d_i2c /bin/true install lkkbd /bin/true install ll_temac /bin/true install llc2 /bin/true install lm25066 /bin/true install lm3533_als /bin/true install lm3533_bl /bin/true install lm3533_core /bin/true install lm3533_ctrlbank /bin/true install lm3560 /bin/true install lm3630a_bl /bin/true install lm3639_bl /bin/true install lm363x_regulator /bin/true install lm3646 /bin/true install lm63 /bin/true install lm70 /bin/true install lm73 /bin/true install lm75 /bin/true install lm77 /bin/true install lm78 /bin/true install lm80 /bin/true install lm83 /bin/true install lm8323 /bin/true install lm8333 /bin/true install lm85 /bin/true install lm87 /bin/true install lm90 /bin/true install lm92 /bin/true install lm93 /bin/true install lm95234 /bin/true install lm95241 /bin/true install lm95245 /bin/true install lmp91000 /bin/true install lms283gf05 /bin/true install lms501kf03 /bin/true install lnbh25 /bin/true install lnbh29 /bin/true install lnbp21 /bin/true install lnbp22 /bin/true install lockd /bin/true install lp3943 /bin/true install lp3971 /bin/true install lp3972 /bin/true install lp855x_bl /bin/true install lp8727_charger /bin/true install lp872x /bin/true install lp873x /bin/true install lp8755 /bin/true install lp8788_adc /bin/true install lp8788_bl /bin/true install lp8788_buck /bin/true install lp8788_charger /bin/true install lp8788_ldo /bin/true install lpc_sch /bin/true install lpddr_cmds /bin/true install lpfc /bin/true install lru_cache /bin/true install lrw /bin/true install lt3651_charger /bin/true install lt7182s /bin/true install ltc1660 /bin/true install ltc2309 /bin/true install ltc2471 /bin/true install ltc2485 /bin/true install ltc2496 /bin/true install ltc2497 /bin/true install ltc2497_core /bin/true install ltc2632 /bin/true install ltc2688 /bin/true install ltc2941_battery_gauge /bin/true install ltc2945 /bin/true install ltc2947_core /bin/true install ltc2947_i2c /bin/true install ltc2947_spi /bin/true install ltc2978 /bin/true install ltc2983 /bin/true install ltc2990 /bin/true install ltc2991 /bin/true install ltc2992 /bin/true install ltc3589 /bin/true install ltc3676 /bin/true install ltc3815 /bin/true install ltc4151 /bin/true install ltc4162_l_charger /bin/true install ltc4215 /bin/true install ltc4222 /bin/true install ltc4245 /bin/true install ltc4260 /bin/true install ltc4261 /bin/true install ltr390 /bin/true install ltr501 /bin/true install ltrf216a /bin/true install ltv350qv /bin/true install lv0104cs /bin/true install lv5207lp /bin/true install lvstest /bin/true install lxt /bin/true install lz4 /bin/true install lz4_compress /bin/true install lz4hc /bin/true install lz4hc_compress /bin/true install m2m_deinterlace /bin/true install m52790 /bin/true install m62332 /bin/true install m88ds3103 /bin/true install m88rs2000 /bin/true install m88rs6000t /bin/true install mISDN_core /bin/true install mISDN_dsp /bin/true install mISDNinfineon /bin/true install mISDNipac /bin/true install mISDNisar /bin/true install m_can /bin/true install m_can_pci /bin/true install m_can_platform /bin/true install mac80211 /bin/true install mac80211_hwsim /bin/true install mac802154 /bin/true install mac802154_hwsim /bin/true install mac_celtic /bin/true install mac_centeuro /bin/true install mac_croatian /bin/true install mac_cyrillic /bin/true install mac_gaelic /bin/true install mac_greek /bin/true install mac_iceland /bin/true install mac_inuit /bin/true install mac_roman /bin/true install mac_romanian /bin/true install mac_turkish /bin/true install macb /bin/true install macb_pci /bin/true install machxo2_spi /bin/true install machzwd /bin/true install macmodes /bin/true install macsec /bin/true install macvlan /bin/true install macvtap /bin/true install madera /bin/true install madera_i2c /bin/true install madera_spi /bin/true install mag3110 /bin/true install magellan /bin/true install mailbox_altera /bin/true install mana /bin/true install mana_ib /bin/true install mantis /bin/true install mantis_core /bin/true install map_absent /bin/true install map_funcs /bin/true install map_ram /bin/true install map_rom /bin/true install marvell /bin/true install marvell10g /bin/true install marvell_88q2xxx /bin/true install marvell_88x2222 /bin/true install matrix_keymap /bin/true install matrix_keypad /bin/true install matrox_w1 /bin/true install matroxfb_DAC1064 /bin/true install matroxfb_Ti3026 /bin/true install matroxfb_accel /bin/true install matroxfb_base /bin/true install matroxfb_crtc2 /bin/true install matroxfb_g450 /bin/true install matroxfb_maven /bin/true install matroxfb_misc /bin/true install max1027 /bin/true install max11100 /bin/true install max1111 /bin/true install max1118 /bin/true install max11205 /bin/true install max11410 /bin/true install max11801_ts /bin/true install max1241 /bin/true install max127 /bin/true install max1363 /bin/true install max14577_charger /bin/true install max14577_regulator /bin/true install max15301 /bin/true install max1586 /bin/true install max16064 /bin/true install max16065 /bin/true install max1619 /bin/true install max16601 /bin/true install max1668 /bin/true install max17040_battery /bin/true install max17042_battery /bin/true install max1721x_battery /bin/true install max197 /bin/true install max20086_regulator /bin/true install max20411_regulator /bin/true install max20730 /bin/true install max20751 /bin/true install max2165 /bin/true install max2175 /bin/true install max30100 /bin/true install max30102 /bin/true install max30208 /bin/true install max3100 /bin/true install max31722 /bin/true install max31730 /bin/true install max31760 /bin/true install max31785 /bin/true install max31790 /bin/true install max31827 /bin/true install max31856 /bin/true install max31865 /bin/true install max3420_udc /bin/true install max3421_hcd /bin/true install max34408 /bin/true install max34440 /bin/true install max44000 /bin/true install max44009 /bin/true install max517 /bin/true install max5432 /bin/true install max5481 /bin/true install max5487 /bin/true install max5522 /bin/true install max5821 /bin/true install max63xx_wdt /bin/true install max6620 /bin/true install max6621 /bin/true install max6639 /bin/true install max6650 /bin/true install max6697 /bin/true install max6875 /bin/true install max7359_keypad /bin/true install max77503_regulator /bin/true install max77541 /bin/true install max77541_adc /bin/true install max77541_regulator /bin/true install max77693_charger /bin/true install max77693_haptic /bin/true install max77693_regulator /bin/true install max77826_regulator /bin/true install max77857_regulator /bin/true install max77976_charger /bin/true install max8649 /bin/true install max8660 /bin/true install max8688 /bin/true install max8893 /bin/true install max8903_charger /bin/true install max8907 /bin/true install max8907_regulator /bin/true install max8925_bl /bin/true install max8925_onkey /bin/true install max8925_power /bin/true install max8925_regulator /bin/true install max8952 /bin/true install max8997_charger /bin/true install max8997_haptic /bin/true install max8997_regulator /bin/true install max8998 /bin/true install max8998_charger /bin/true install max9271 /bin/true install max9611 /bin/true install maxim_thermocouple /bin/true install mb1232 /bin/true install mb862xxfb /bin/true install mb86a16 /bin/true install mb86a20s /bin/true install mc /bin/true install mc13783_adc /bin/true install mc13783_pwrbutton /bin/true install mc13783_regulator /bin/true install mc13783_ts /bin/true install mc13892_regulator /bin/true install mc13xxx_core /bin/true install mc13xxx_i2c /bin/true install mc13xxx_regulator_core /bin/true install mc13xxx_spi /bin/true install mc3230 /bin/true install mc34vr500 /bin/true install mc44s803 /bin/true install mcam_core /bin/true install mcb /bin/true install mcb_lpc /bin/true install mcb_pci /bin/true install mcba_usb /bin/true install mce_inject /bin/true install mceusb /bin/true install mchp23k256 /bin/true install mchp48l640 /bin/true install mchp_pci1xxxx_gp /bin/true install mchp_pci1xxxx_gpio /bin/true install mchp_pci1xxxx_otpe2p /bin/true install mcp251x /bin/true install mcp251xfd /bin/true install mcp3021 /bin/true install mcp320x /bin/true install mcp3422 /bin/true install mcp3564 /bin/true install mcp3911 /bin/true install mcp4018 /bin/true install mcp41010 /bin/true install mcp4131 /bin/true install mcp4531 /bin/true install mcp4725 /bin/true install mcp4728 /bin/true install mcp4821 /bin/true install mcp4922 /bin/true install mcp9600 /bin/true install mcr20a /bin/true install mcs5000_ts /bin/true install mcs7830 /bin/true install mcs_touchkey /bin/true install mct_u232 /bin/true install mctp_i3c /bin/true install mctp_serial /bin/true install md4 /bin/true install md_cluster /bin/true install mdc800 /bin/true install mdev /bin/true install mdio /bin/true install mdio_bcm_unimac /bin/true install mdio_bitbang /bin/true install mdio_cavium /bin/true install mdio_gpio /bin/true install mdio_i2c /bin/true install mdio_mscc_miim /bin/true install mdio_mvusb /bin/true install mdio_regmap /bin/true install mdio_thunder /bin/true install me4000 /bin/true install me_daq /bin/true install mediatek_ge /bin/true install megaraid /bin/true install megaraid_mbox /bin/true install megaraid_mm /bin/true install megaraid_sas /bin/true install mei /bin/true install mei_gsc /bin/true install mei_gsc_proxy /bin/true install mei_hdcp /bin/true install mei_me /bin/true install mei_phy /bin/true install mei_pxp /bin/true install mei_txe /bin/true install mei_vsc /bin/true install mei_vsc_hw /bin/true install mei_wdt /bin/true install melfas_mip4 /bin/true install memory_notifier_error_inject /bin/true install memstick /bin/true install men_z135_uart /bin/true install men_z188_adc /bin/true install mena21_wdt /bin/true install menf21bmc /bin/true install menf21bmc_hwmon /bin/true install menf21bmc_wdt /bin/true install menz69_wdt /bin/true install meraki_mx100 /bin/true install metro_usb /bin/true install metronomefb /bin/true install mf6x4 /bin/true install mfd_aaeon /bin/true install mgag200 /bin/true install mgb4 /bin/true install mhi /bin/true install mhi_ep /bin/true install mhi_net /bin/true install mhi_pci_generic /bin/true install mhi_wwan_ctrl /bin/true install mhi_wwan_mbim /bin/true install mi0283qt /bin/true install michael_mic /bin/true install micrel /bin/true install microchip /bin/true install microchip_spi /bin/true install microchip_t1 /bin/true install microchip_t1s /bin/true install microread /bin/true install microread_i2c /bin/true install microread_mei /bin/true install microtek /bin/true install mii /bin/true install minix /bin/true install mip6 /bin/true install mipi_i3c_hci /bin/true install mipi_i3c_hci_pci /bin/true install mite /bin/true install mkiss /bin/true install ml86v7667 /bin/true install mlx4_core /bin/true install mlx4_en /bin/true install mlx4_ib /bin/true install mlx5_core /bin/true install mlx5_dpll /bin/true install mlx5_ib /bin/true install mlx5_vdpa /bin/true install mlx5_vfio_pci /bin/true install mlx90614 /bin/true install mlx90632 /bin/true install mlx90635 /bin/true install mlx_platform /bin/true install mlx_wdt /bin/true install mlxfw /bin/true install mlxreg_fan /bin/true install mlxreg_hotplug /bin/true install mlxreg_io /bin/true install mlxreg_lc /bin/true install mlxsw_core /bin/true install mlxsw_i2c /bin/true install mlxsw_minimal /bin/true install mlxsw_pci /bin/true install mlxsw_spectrum /bin/true install mm8013 /bin/true install mma7455_core /bin/true install mma7455_i2c /bin/true install mma7455_spi /bin/true install mma7660 /bin/true install mma8450 /bin/true install mma8452 /bin/true install mma9551 /bin/true install mma9551_core /bin/true install mma9553 /bin/true install mmc35240 /bin/true install mmc_block /bin/true install mmc_spi /bin/true install mms114 /bin/true install mn88443x /bin/true install mn88472 /bin/true install mn88473 /bin/true install mos7720 /bin/true install mos7840 /bin/true install most_cdev /bin/true install most_core /bin/true install most_net /bin/true install most_snd /bin/true install most_usb /bin/true install most_video /bin/true install motorcomm /bin/true install moxa /bin/true install mp2629 /bin/true install mp2629_adc /bin/true install mp2629_charger /bin/true install mp2856 /bin/true install mp2888 /bin/true install mp2975 /bin/true install mp3309c /bin/true install mp5023 /bin/true install mp5990 /bin/true install mp8859 /bin/true install mpc624 /bin/true install mpi3mr /bin/true install mpl115 /bin/true install mpl115_i2c /bin/true install mpl115_spi /bin/true install mpl3115 /bin/true install mpls_gso /bin/true install mpls_iptunnel /bin/true install mpls_router /bin/true install mpoa /bin/true install mpq7932 /bin/true install mpr121_touchkey /bin/true install mprls0025pa /bin/true install mpt3sas /bin/true install mptbase /bin/true install mptcp_diag /bin/true install mptctl /bin/true install mptfc /bin/true install mptlan /bin/true install mptsas /bin/true install mptscsih /bin/true install mptspi /bin/true install mpu3050 /bin/true install mr75203 /bin/true install mrf24j40 /bin/true install mrp /bin/true install ms5611_core /bin/true install ms5611_i2c /bin/true install ms5611_spi /bin/true install ms5637 /bin/true install ms_block /bin/true install ms_sensors_i2c /bin/true install msa311 /bin/true install mscc /bin/true install mscc_felix_dsa_lib /bin/true install mscc_ocelot_ext /bin/true install mscc_ocelot_switch_lib /bin/true install mscc_seville /bin/true install msdos /bin/true install mse102x /bin/true install msg2638 /bin/true install msi001 /bin/true install msi2500 /bin/true install msi_ec /bin/true install msi_laptop /bin/true install msi_wmi /bin/true install msp3400 /bin/true install mspro_block /bin/true install mt2060 /bin/true install mt2063 /bin/true install mt20xx /bin/true install mt2131 /bin/true install mt2266 /bin/true install mt312 /bin/true install mt352 /bin/true install mt6311_regulator /bin/true install mt6315_regulator /bin/true install mt6323_regulator /bin/true install mt6331_regulator /bin/true install mt6332_regulator /bin/true install mt6357_regulator /bin/true install mt6358_regulator /bin/true install mt6359_regulator /bin/true install mt6360_adc /bin/true install mt6360_charger /bin/true install mt6360_core /bin/true install mt6360_regulator /bin/true install mt6370 /bin/true install mt6370_adc /bin/true install mt6370_backlight /bin/true install mt6370_charger /bin/true install mt6370_regulator /bin/true install mt6397 /bin/true install mt6397_regulator /bin/true install mt7530 /bin/true install mt7530_mdio /bin/true install mt7530_mmio /bin/true install mt76 /bin/true install mt7601u /bin/true install mt7603e /bin/true install mt7615_common /bin/true install mt7615e /bin/true install mt7663_usb_sdio_common /bin/true install mt7663s /bin/true install mt7663u /bin/true install mt76_connac_lib /bin/true install mt76_sdio /bin/true install mt76_usb /bin/true install mt76x02_lib /bin/true install mt76x02_usb /bin/true install mt76x0_common /bin/true install mt76x0e /bin/true install mt76x0u /bin/true install mt76x2_common /bin/true install mt76x2e /bin/true install mt76x2u /bin/true install mt7915e /bin/true install mt7921_common /bin/true install mt7921e /bin/true install mt7921s /bin/true install mt7921u /bin/true install mt7925_common /bin/true install mt7925e /bin/true install mt7925u /bin/true install mt792x_lib /bin/true install mt792x_usb /bin/true install mt7996e /bin/true install mt9m001 /bin/true install mt9m111 /bin/true install mt9m114 /bin/true install mt9p031 /bin/true install mt9t112 /bin/true install mt9v011 /bin/true install mt9v032 /bin/true install mt9v111 /bin/true install mtd /bin/true install mtd_blkdevs /bin/true install mtd_dataflash /bin/true install mtdblock /bin/true install mtdblock_ro /bin/true install mtdoops /bin/true install mtdpstore /bin/true install mtdram /bin/true install mtdswap /bin/true install mtip32xx /bin/true install mtk_pmic_keys /bin/true install mtk_sd /bin/true install mtk_t7xx /bin/true install mtouch /bin/true install multiq3 /bin/true install musb_hdrc /bin/true install mux_adg792a /bin/true install mux_adgs1408 /bin/true install mux_core /bin/true install mux_gpio /bin/true install mv88e6060 /bin/true install mv88e6xxx /bin/true install mv_u3d_core /bin/true install mv_udc /bin/true install mvmdio /bin/true install mvsas /bin/true install mvumi /bin/true install mwave /bin/true install mwifiex /bin/true install mwifiex_pcie /bin/true install mwifiex_sdio /bin/true install mwifiex_usb /bin/true install mwl8k /bin/true install mxb /bin/true install mxc4005 /bin/true install mxc6255 /bin/true install mxic_nand /bin/true install mxl111sf_demod /bin/true install mxl111sf_tuner /bin/true install mxl301rf /bin/true install mxl5005s /bin/true install mxl5007t /bin/true install mxl5xx /bin/true install mxl692 /bin/true install mxl_gpy /bin/true install mxm_wmi /bin/true install mxser /bin/true install mxuport /bin/true install myrb /bin/true install myri10ge /bin/true install myrs /bin/true install n411 /bin/true install n5pf /bin/true install n_gsm /bin/true install n_hdlc /bin/true install nand /bin/true install nandcore /bin/true install nandsim /bin/true install national /bin/true install natsemi /bin/true install nau7802 /bin/true install navman /bin/true install nb7vpq904m /bin/true install nbd /bin/true install nci /bin/true install nci_spi /bin/true install nci_uart /bin/true install ncn26000 /bin/true install nct6683 /bin/true install nct6775 /bin/true install nct6775_core /bin/true install nct6775_i2c /bin/true install nct7802 /bin/true install nct7904 /bin/true install nd_btt /bin/true install nd_pmem /bin/true install nd_virtio /bin/true install ne2k_pci /bin/true install neofb /bin/true install net1080 /bin/true install net2272 /bin/true install net2280 /bin/true install netconsole /bin/true install netdevsim /bin/true install netfs /bin/true install netjet /bin/true install netlink_diag /bin/true install netrom /bin/true install nettel /bin/true install netup_unidvb /bin/true install netxen_nic /bin/true install newtonkbd /bin/true install nf_conncount /bin/true install nf_conntrack_amanda /bin/true install nf_conntrack_bridge /bin/true install nf_conntrack_broadcast /bin/true install nf_conntrack_ftp /bin/true install nf_conntrack_h323 /bin/true install nf_conntrack_irc /bin/true install nf_conntrack_netbios_ns /bin/true install nf_conntrack_pptp /bin/true install nf_conntrack_sane /bin/true install nf_conntrack_sip /bin/true install nf_conntrack_snmp /bin/true install nf_conntrack_tftp /bin/true install nf_dup_ipv4 /bin/true install nf_dup_ipv6 /bin/true install nf_dup_netdev /bin/true install nf_flow_table /bin/true install nf_flow_table_inet /bin/true install nf_nat_amanda /bin/true install nf_nat_ftp /bin/true install nf_nat_h323 /bin/true install nf_nat_irc /bin/true install nf_nat_pptp /bin/true install nf_nat_sip /bin/true install nf_nat_snmp_basic /bin/true install nf_nat_tftp /bin/true install nf_socket_ipv4 /bin/true install nf_socket_ipv6 /bin/true install nf_synproxy_core /bin/true install nf_tproxy_ipv4 /bin/true install nf_tproxy_ipv6 /bin/true install nfc /bin/true install nfc_digital /bin/true install nfcmrvl /bin/true install nfcmrvl_i2c /bin/true install nfcmrvl_spi /bin/true install nfcmrvl_uart /bin/true install nfcmrvl_usb /bin/true install nfcsim /bin/true install nfit /bin/true install nfnetlink_acct /bin/true install nfnetlink_cthelper /bin/true install nfnetlink_cttimeout /bin/true install nfnetlink_hook /bin/true install nfnetlink_log /bin/true install nfnetlink_osf /bin/true install nfnetlink_queue /bin/true install nfp /bin/true install nfs /bin/true install nfs_acl /bin/true install nfs_layout_flexfiles /bin/true install nfs_layout_nfsv41_files /bin/true install nfsd /bin/true install nfsv2 /bin/true install nfsv3 /bin/true install nfsv4 /bin/true install nft_connlimit /bin/true install nft_ct /bin/true install nft_dup_ipv4 /bin/true install nft_dup_ipv6 /bin/true install nft_dup_netdev /bin/true install nft_fib /bin/true install nft_fib_inet /bin/true install nft_fib_ipv4 /bin/true install nft_fib_ipv6 /bin/true install nft_fib_netdev /bin/true install nft_flow_offload /bin/true install nft_fwd_netdev /bin/true install nft_hash /bin/true install nft_log /bin/true install nft_masq /bin/true install nft_meta_bridge /bin/true install nft_nat /bin/true install nft_numgen /bin/true install nft_osf /bin/true install nft_queue /bin/true install nft_quota /bin/true install nft_redir /bin/true install nft_reject /bin/true install nft_reject_bridge /bin/true install nft_reject_inet /bin/true install nft_reject_ipv4 /bin/true install nft_reject_ipv6 /bin/true install nft_reject_netdev /bin/true install nft_socket /bin/true install nft_synproxy /bin/true install nft_tproxy /bin/true install nft_tunnel /bin/true install nft_xfrm /bin/true install nftl /bin/true install ngbe /bin/true install ngene /bin/true install nhc_dest /bin/true install nhc_fragment /bin/true install nhc_hop /bin/true install nhc_ipv6 /bin/true install nhc_mobility /bin/true install nhc_routing /bin/true install nhc_udp /bin/true install nhpoly1305 /bin/true install nhpoly1305_avx2 /bin/true install nhpoly1305_sse2 /bin/true install ni903x_wdt /bin/true install ni_6527 /bin/true install ni_65xx /bin/true install ni_660x /bin/true install ni_670x /bin/true install ni_at_a2150 /bin/true install ni_at_ao /bin/true install ni_atmio /bin/true install ni_atmio16d /bin/true install ni_daq_700 /bin/true install ni_daq_dio24 /bin/true install ni_labpc /bin/true install ni_labpc_common /bin/true install ni_labpc_cs /bin/true install ni_labpc_isadma /bin/true install ni_labpc_pci /bin/true install ni_mio_cs /bin/true install ni_pcidio /bin/true install ni_pcimio /bin/true install ni_routes_test /bin/true install ni_routing /bin/true install ni_tio /bin/true install ni_tiocmd /bin/true install ni_usb6501 /bin/true install nic7018_wdt /bin/true install nicpf /bin/true install nicstar /bin/true install nicvf /bin/true install nilfs2 /bin/true install nitro_enclaves /bin/true install niu /bin/true install nixge /bin/true install nlmon /bin/true install nls_ascii /bin/true install nls_cp1250 /bin/true install nls_cp1251 /bin/true install nls_cp1255 /bin/true install nls_cp737 /bin/true install nls_cp775 /bin/true install nls_cp850 /bin/true install nls_cp852 /bin/true install nls_cp855 /bin/true install nls_cp857 /bin/true install nls_cp860 /bin/true install nls_cp861 /bin/true install nls_cp862 /bin/true install nls_cp863 /bin/true install nls_cp864 /bin/true install nls_cp865 /bin/true install nls_cp866 /bin/true install nls_cp869 /bin/true install nls_cp874 /bin/true install nls_cp932 /bin/true install nls_cp936 /bin/true install nls_cp949 /bin/true install nls_cp950 /bin/true install nls_euc_jp /bin/true install nls_iso8859_13 /bin/true install nls_iso8859_14 /bin/true install nls_iso8859_15 /bin/true install nls_iso8859_2 /bin/true install nls_iso8859_3 /bin/true install nls_iso8859_4 /bin/true install nls_iso8859_5 /bin/true install nls_iso8859_6 /bin/true install nls_iso8859_7 /bin/true install nls_iso8859_9 /bin/true install nls_koi8_r /bin/true install nls_koi8_ru /bin/true install nls_koi8_u /bin/true install nls_ucs2_utils /bin/true install nmclan_cs /bin/true install noa1305 /bin/true install nosy /bin/true install notifier_error_inject /bin/true install nouveau /bin/true install novatek_nvt_ts /bin/true install nozomi /bin/true install npcm750_pwm_fan /bin/true install ns83820 /bin/true install nsh /bin/true install nsm /bin/true install ntb /bin/true install ntb_hw_epf /bin/true install ntb_hw_idt /bin/true install ntb_hw_intel /bin/true install ntb_hw_switchtec /bin/true install ntb_netdev /bin/true install ntb_perf /bin/true install ntb_pingpong /bin/true install ntb_tool /bin/true install ntb_transport /bin/true install ntc_thermistor /bin/true install ntfs /bin/true install ntfs3 /bin/true install null_blk /bin/true install nuvoton_cir /bin/true install nv_tco /bin/true install nvidia_wmi_ec_backlight /bin/true install nvidiafb /bin/true install nvme_auth /bin/true install nvme_fabrics /bin/true install nvme_fc /bin/true install nvme_keyring /bin/true install nvme_loop /bin/true install nvme_rdma /bin/true install nvme_tcp /bin/true install nvmem_qcom_spmi_sdam /bin/true install nvmem_rave_sp_eeprom /bin/true install nvmem_rmem /bin/true install nvmet /bin/true install nvmet_fc /bin/true install nvmet_rdma /bin/true install nvmet_tcp /bin/true install nvram /bin/true install nvsw_sn2201 /bin/true install nxp_c45_tja /bin/true install nxp_cbtx /bin/true install nxp_nci /bin/true install nxp_nci_i2c /bin/true install nxp_tja11xx /bin/true install nxt200x /bin/true install nxt6000 /bin/true install nzxt_kraken2 /bin/true install nzxt_smart2 /bin/true install objagg /bin/true install occ_hwmon_common /bin/true install occ_p8_hwmon /bin/true install ocelot_soc /bin/true install ocfb /bin/true install ocfs2 /bin/true install ocfs2_dlm /bin/true install ocfs2_dlmfs /bin/true install ocfs2_nodemanager /bin/true install ocfs2_stack_o2cb /bin/true install ocfs2_stack_user /bin/true install ocfs2_stackglue /bin/true install ocrdma /bin/true install octeon_ep /bin/true install of_mmc_spi /bin/true install of_xilinx_wdt /bin/true install og01a1b /bin/true install omfs /bin/true install omninet /bin/true install on20 /bin/true install on26 /bin/true install onenand /bin/true install opa_vnic /bin/true install opencores_kbd /bin/true install openvswitch /bin/true install opt3001 /bin/true install opt4001 /bin/true install opticon /bin/true install option /bin/true install or51132 /bin/true install or51211 /bin/true install orangefs /bin/true install oti6858 /bin/true install otm3225a /bin/true install ov01a10 /bin/true install ov02a10 /bin/true install ov08d10 /bin/true install ov08x40 /bin/true install ov13858 /bin/true install ov13b10 /bin/true install ov2640 /bin/true install ov2659 /bin/true install ov2680 /bin/true install ov2685 /bin/true install ov2740 /bin/true install ov4689 /bin/true install ov5647 /bin/true install ov5648 /bin/true install ov5670 /bin/true install ov5675 /bin/true install ov5693 /bin/true install ov5695 /bin/true install ov64a40 /bin/true install ov6650 /bin/true install ov7251 /bin/true install ov7640 /bin/true install ov7670 /bin/true install ov772x /bin/true install ov7740 /bin/true install ov8856 /bin/true install ov8858 /bin/true install ov8865 /bin/true install ov9640 /bin/true install ov9650 /bin/true install ov9734 /bin/true install oxp_sensors /bin/true install oxu210hp_hcd /bin/true install p4_clockmod /bin/true install p54common /bin/true install p54pci /bin/true install p54spi /bin/true install p54usb /bin/true install p8022 /bin/true install pa12203001 /bin/true install padlock_aes /bin/true install padlock_sha /bin/true install palmas_gpadc /bin/true install palmas_pwrbutton /bin/true install palmas_regulator /bin/true install panasonic_laptop /bin/true install pandora_bl /bin/true install panel /bin/true install panel_auo_a030jtn01 /bin/true install panel_ilitek_ili9341 /bin/true install panel_mipi_dbi /bin/true install panel_orisetech_ota5601a /bin/true install panel_raspberrypi_touchscreen /bin/true install panel_widechips_ws2401 /bin/true install parkbd /bin/true install parman /bin/true install parport_cs /bin/true install parport_serial /bin/true install pata_acpi /bin/true install pata_ali /bin/true install pata_amd /bin/true install pata_artop /bin/true install pata_atiixp /bin/true install pata_atp867x /bin/true install pata_cmd640 /bin/true install pata_cmd64x /bin/true install pata_cypress /bin/true install pata_efar /bin/true install pata_hpt366 /bin/true install pata_hpt37x /bin/true install pata_hpt3x2n /bin/true install pata_hpt3x3 /bin/true install pata_it8213 /bin/true install pata_it821x /bin/true install pata_jmicron /bin/true install pata_legacy /bin/true install pata_marvell /bin/true install pata_mpiix /bin/true install pata_netcell /bin/true install pata_ninja32 /bin/true install pata_ns87410 /bin/true install pata_ns87415 /bin/true install pata_oldpiix /bin/true install pata_opti /bin/true install pata_optidma /bin/true install pata_parport /bin/true install pata_pcmcia /bin/true install pata_pdc2027x /bin/true install pata_pdc202xx_old /bin/true install pata_piccolo /bin/true install pata_radisys /bin/true install pata_rdc /bin/true install pata_rz1000 /bin/true install pata_sch /bin/true install pata_serverworks /bin/true install pata_sil680 /bin/true install pata_sl82c105 /bin/true install pata_triflex /bin/true install pata_via /bin/true install pc300too /bin/true install pc87360 /bin/true install pc87413_wdt /bin/true install pc87427 /bin/true install pca9450_regulator /bin/true install pcap_keys /bin/true install pcap_regulator /bin/true install pcap_ts /bin/true install pcbc /bin/true install pcengines_apuv2 /bin/true install pcf50633 /bin/true install pcf50633_adc /bin/true install pcf50633_backlight /bin/true install pcf50633_charger /bin/true install pcf50633_gpio /bin/true install pcf50633_input /bin/true install pcf50633_regulator /bin/true install pcf8574_keypad /bin/true install pcf8591 /bin/true install pch_udc /bin/true install pci /bin/true install pci200syn /bin/true install pci_epf_mhi /bin/true install pci_epf_ntb /bin/true install pci_epf_vntb /bin/true install pci_hyperv /bin/true install pci_hyperv_intf /bin/true install pci_pf_stub /bin/true install pci_stub /bin/true install pcips2 /bin/true install pcl711 /bin/true install pcl724 /bin/true install pcl726 /bin/true install pcl730 /bin/true install pcl812 /bin/true install pcl816 /bin/true install pcl818 /bin/true install pcm3724 /bin/true install pcmad /bin/true install pcmcia /bin/true install pcmcia_core /bin/true install pcmcia_rsrc /bin/true install pcmciamtd /bin/true install pcmda12 /bin/true install pcmmio /bin/true install pcmuio /bin/true install pcnet32 /bin/true install pcnet_cs /bin/true install pcrypt /bin/true install pcs_lynx /bin/true install pcs_mtk_lynxi /bin/true install pcs_xpcs /bin/true install pcspkr /bin/true install pcwd_pci /bin/true install pcwd_usb /bin/true install pd6729 /bin/true install pdc_adma /bin/true install pds_core /bin/true install pds_vdpa /bin/true install pds_vfio_pci /bin/true install peak_pci /bin/true install peak_pciefd /bin/true install peak_pcmcia /bin/true install peak_usb /bin/true install peci /bin/true install peci_cpu /bin/true install peci_cputemp /bin/true install peci_dimmtemp /bin/true install pegasus /bin/true install pegasus_notetaker /bin/true install penmount /bin/true install pfr_telemetry /bin/true install pfr_update /bin/true install phantom /bin/true install phonet /bin/true install phram /bin/true install phy_bcm_kona_usb2 /bin/true install phy_can_transceiver /bin/true install phy_cpcap_usb /bin/true install phy_exynos_usb2 /bin/true install phy_generic /bin/true install phy_gpio_vbus_usb /bin/true install phy_intel_lgm_emmc /bin/true install phy_isp1301 /bin/true install phy_lgm_usb /bin/true install phy_pxa_28nm_hsic /bin/true install phy_pxa_28nm_usb2 /bin/true install phy_qcom_usb_hs /bin/true install phy_qcom_usb_hsic /bin/true install phy_tahvo /bin/true install phy_tusb1210 /bin/true install phylink /bin/true install physmap /bin/true install pi3usb30532 /bin/true install pi433 /bin/true install pim4328 /bin/true install pinctrl_alderlake /bin/true install pinctrl_broxton /bin/true install pinctrl_cannonlake /bin/true install pinctrl_cedarfork /bin/true install pinctrl_cs42l43 /bin/true install pinctrl_cy8c95x0 /bin/true install pinctrl_da9062 /bin/true install pinctrl_denverton /bin/true install pinctrl_elkhartlake /bin/true install pinctrl_emmitsburg /bin/true install pinctrl_geminilake /bin/true install pinctrl_icelake /bin/true install pinctrl_intel_platform /bin/true install pinctrl_jasperlake /bin/true install pinctrl_lakefield /bin/true install pinctrl_lewisburg /bin/true install pinctrl_lynxpoint /bin/true install pinctrl_madera /bin/true install pinctrl_mcp23s08 /bin/true install pinctrl_mcp23s08_i2c /bin/true install pinctrl_mcp23s08_spi /bin/true install pinctrl_meteorlake /bin/true install pinctrl_meteorpoint /bin/true install pinctrl_sunrisepoint /bin/true install pinctrl_tigerlake /bin/true install pinephone_keyboard /bin/true install ping /bin/true install pistachio_internal_dac /bin/true install pixcir_i2c_ts /bin/true install pkcs7_test_key /bin/true install pkcs8_key_parser /bin/true install pktgen /bin/true install pl2303 /bin/true install plat_nand /bin/true install plat_ram /bin/true install platform_lcd /bin/true install platform_profile /bin/true install plfxlc /bin/true install pli1209bc /bin/true install plip /bin/true install plusb /bin/true install pluto2 /bin/true install plx_dma /bin/true install plx_pci /bin/true install pm2fb /bin/true install pm3fb /bin/true install pm6764tr /bin/true install pm80xx /bin/true install pm_notifier_error_inject /bin/true install pmbus /bin/true install pmbus_core /bin/true install pmc551 /bin/true install pmcraid /bin/true install pmic_pdcharger_ulog /bin/true install pms7003 /bin/true install pmt_class /bin/true install pmt_crashlog /bin/true install pmt_telemetry /bin/true install pn532_uart /bin/true install pn533 /bin/true install pn533_i2c /bin/true install pn533_usb /bin/true install pn544 /bin/true install pn544_i2c /bin/true install pn544_mei /bin/true install pn_pep /bin/true install pnd2_edac /bin/true install poly1305_generic /bin/true install poly1305_x86_64 /bin/true install polynomial /bin/true install polyval_clmulni /bin/true install polyval_generic /bin/true install port100 /bin/true install powermate /bin/true install powerz /bin/true install powr1220 /bin/true install ppa /bin/true install ppp_async /bin/true install ppp_deflate /bin/true install ppp_mppe /bin/true install ppp_synctty /bin/true install pppoatm /bin/true install pppoe /bin/true install pppox /bin/true install pps_gpio /bin/true install pps_ldisc /bin/true install pps_parport /bin/true install pptp /bin/true install prestera /bin/true install prestera_pci /bin/true install pretimeout_panic /bin/true install prism2_usb /bin/true install processor_thermal_device /bin/true install processor_thermal_device_pci /bin/true install processor_thermal_device_pci_legacy /bin/true install processor_thermal_mbox /bin/true install processor_thermal_power_floor /bin/true install processor_thermal_rapl /bin/true install processor_thermal_rfim /bin/true install processor_thermal_wt_hint /bin/true install processor_thermal_wt_req /bin/true install ps2_gpio /bin/true install ps2mult /bin/true install psample /bin/true install pse_regulator /bin/true install psnap /bin/true install pstore_blk /bin/true install pstore_zone /bin/true install psxpad_spi /bin/true install ptdma /bin/true install ptn36502 /bin/true install ptp_clockmatrix /bin/true install ptp_dfl_tod /bin/true install ptp_idt82p33 /bin/true install ptp_ines /bin/true install ptp_kvm /bin/true install ptp_mock /bin/true install ptp_ocp /bin/true install ptp_vmw /bin/true install pulse8_cec /bin/true install pulsedlight_lidar_lite_v2 /bin/true install punit_atom_debug /bin/true install pv88060_regulator /bin/true install pv88080_regulator /bin/true install pv88090_regulator /bin/true install pvcalls_front /bin/true install pvpanic /bin/true install pvpanic_mmio /bin/true install pvpanic_pci /bin/true install pvrusb2 /bin/true install pwc /bin/true install pwm_beeper /bin/true install pwm_bl /bin/true install pwm_clk /bin/true install pwm_cros_ec /bin/true install pwm_dwc /bin/true install pwm_dwc_core /bin/true install pwm_iqs620a /bin/true install pwm_lp3943 /bin/true install pwm_pca9685 /bin/true install pwm_regulator /bin/true install pwm_twl /bin/true install pwm_twl_led /bin/true install pwm_vibra /bin/true install pxa27x_udc /bin/true install pxe1610 /bin/true install pxrc /bin/true install q54sj108a2 /bin/true install qaic /bin/true install qat_420xx /bin/true install qat_4xxx /bin/true install qat_c3xxx /bin/true install qat_c3xxxvf /bin/true install qat_c62x /bin/true install qat_c62xvf /bin/true install qat_dh895xcc /bin/true install qat_dh895xccvf /bin/true install qca8k /bin/true install qcaux /bin/true install qcom_emac /bin/true install qcom_glink /bin/true install qcom_glink_rpm /bin/true install qcom_labibb_regulator /bin/true install qcom_spmi_adc5 /bin/true install qcom_spmi_iadc /bin/true install qcom_spmi_regulator /bin/true install qcom_spmi_vadc /bin/true install qcom_usb_vbus_regulator /bin/true install qcom_vadc_common /bin/true install qcom_wled /bin/true install qcserial /bin/true install qed /bin/true install qede /bin/true install qedf /bin/true install qedi /bin/true install qedr /bin/true install qinfo_probe /bin/true install qla1280 /bin/true install qla2xxx /bin/true install qla3xxx /bin/true install qla4xxx /bin/true install qlcnic /bin/true install qlogic_cs /bin/true install qlogicfas408 /bin/true install qm1d1b0004 /bin/true install qm1d1c0042 /bin/true install qmi_helpers /bin/true install qmi_wwan /bin/true install qnx4 /bin/true install qnx6 /bin/true install qrtr_mhi /bin/true install qrtr_smd /bin/true install qrtr_tun /bin/true install qsemi /bin/true install qt1010 /bin/true install qt1050 /bin/true install qt1070 /bin/true install qt2160 /bin/true install qtnfmac /bin/true install qtnfmac_pcie /bin/true install quatech2 /bin/true install quatech_daqp_cs /bin/true install quota_tree /bin/true install quota_v1 /bin/true install quota_v2 /bin/true install qwiic_joystick /bin/true install r592 /bin/true install r6040 /bin/true install r8152 /bin/true install r8153_ecm /bin/true install r8192e_pci /bin/true install r820t /bin/true install r852 /bin/true install r8712u /bin/true install r8723bs /bin/true install r8a66597_hcd /bin/true install r8a66597_udc /bin/true install raa215300 /bin/true install radeon /bin/true install radeonfb /bin/true install radio_keene /bin/true install radio_ma901 /bin/true install radio_maxiradio /bin/true install radio_mr800 /bin/true install radio_platform_si4713 /bin/true install radio_raremono /bin/true install radio_shark /bin/true install radio_si470x_common /bin/true install radio_si470x_i2c /bin/true install radio_si470x_usb /bin/true install radio_si476x /bin/true install radio_tea5764 /bin/true install radio_usb_si4713 /bin/true install radio_wl1273 /bin/true install raid0 /bin/true install raid1 /bin/true install raid10 /bin/true install raid456 /bin/true install raid6_pq /bin/true install raid_class /bin/true install rainshadow_cec /bin/true install ramoops /bin/true install rapl /bin/true install rave_sp /bin/true install rave_sp_backlight /bin/true install rave_sp_pwrbutton /bin/true install rave_sp_wdt /bin/true install raw_diag /bin/true install raw_gadget /bin/true install raydium_i2c_ts /bin/true install rbd /bin/true install rc5t583_regulator /bin/true install rc_adstech_dvb_t_pci /bin/true install rc_alink_dtu_m /bin/true install rc_anysee /bin/true install rc_apac_viewcomp /bin/true install rc_astrometa_t2hybrid /bin/true install rc_asus_pc39 /bin/true install rc_asus_ps3_100 /bin/true install rc_ati_tv_wonder_hd_600 /bin/true install rc_ati_x10 /bin/true install rc_avermedia /bin/true install rc_avermedia_a16d /bin/true install rc_avermedia_cardbus /bin/true install rc_avermedia_dvbt /bin/true install rc_avermedia_m135a /bin/true install rc_avermedia_m733a_rm_k6 /bin/true install rc_avermedia_rm_ks /bin/true install rc_avertv_303 /bin/true install rc_azurewave_ad_tu700 /bin/true install rc_beelink_gs1 /bin/true install rc_beelink_mxiii /bin/true install rc_behold /bin/true install rc_behold_columbus /bin/true install rc_budget_ci_old /bin/true install rc_cinergy /bin/true install rc_cinergy_1400 /bin/true install rc_core /bin/true install rc_ct_90405 /bin/true install rc_d680_dmb /bin/true install rc_delock_61959 /bin/true install rc_dib0700_nec /bin/true install rc_dib0700_rc5 /bin/true install rc_digitalnow_tinytwin /bin/true install rc_digittrade /bin/true install rc_dm1105_nec /bin/true install rc_dntv_live_dvb_t /bin/true install rc_dntv_live_dvbt_pro /bin/true install rc_dreambox /bin/true install rc_dtt200u /bin/true install rc_dvbsky /bin/true install rc_dvico_mce /bin/true install rc_dvico_portable /bin/true install rc_em_terratec /bin/true install rc_encore_enltv /bin/true install rc_encore_enltv2 /bin/true install rc_encore_enltv_fm53 /bin/true install rc_evga_indtube /bin/true install rc_eztv /bin/true install rc_flydvb /bin/true install rc_flyvideo /bin/true install rc_fusionhdtv_mce /bin/true install rc_gadmei_rm008z /bin/true install rc_geekbox /bin/true install rc_genius_tvgo_a11mce /bin/true install rc_gotview7135 /bin/true install rc_hauppauge /bin/true install rc_hisi_poplar /bin/true install rc_hisi_tv_demo /bin/true install rc_imon_mce /bin/true install rc_imon_pad /bin/true install rc_imon_rsc /bin/true install rc_iodata_bctv7e /bin/true install rc_it913x_v1 /bin/true install rc_it913x_v2 /bin/true install rc_kaiomy /bin/true install rc_khadas /bin/true install rc_khamsin /bin/true install rc_kworld_315u /bin/true install rc_kworld_pc150u /bin/true install rc_kworld_plus_tv_analog /bin/true install rc_leadtek_y04g0051 /bin/true install rc_lme2510 /bin/true install rc_loopback /bin/true install rc_manli /bin/true install rc_mecool_kii_pro /bin/true install rc_mecool_kiii_pro /bin/true install rc_medion_x10 /bin/true install rc_medion_x10_digitainer /bin/true install rc_medion_x10_or2x /bin/true install rc_minix_neo /bin/true install rc_msi_digivox_ii /bin/true install rc_msi_digivox_iii /bin/true install rc_msi_tvanywhere /bin/true install rc_msi_tvanywhere_plus /bin/true install rc_nebula /bin/true install rc_nec_terratec_cinergy_xs /bin/true install rc_norwood /bin/true install rc_npgtech /bin/true install rc_odroid /bin/true install rc_pctv_sedna /bin/true install rc_pine64 /bin/true install rc_pinnacle_color /bin/true install rc_pinnacle_grey /bin/true install rc_pinnacle_pctv_hd /bin/true install rc_pixelview /bin/true install rc_pixelview_002t /bin/true install rc_pixelview_mk12 /bin/true install rc_pixelview_new /bin/true install rc_powercolor_real_angel /bin/true install rc_proteus_2309 /bin/true install rc_purpletv /bin/true install rc_pv951 /bin/true install rc_rc6_mce /bin/true install rc_real_audio_220_32_keys /bin/true install rc_reddo /bin/true install rc_snapstream_firefly /bin/true install rc_streamzap /bin/true install rc_su3000 /bin/true install rc_tanix_tx3mini /bin/true install rc_tanix_tx5max /bin/true install rc_tbs_nec /bin/true install rc_technisat_ts35 /bin/true install rc_technisat_usb2 /bin/true install rc_terratec_cinergy_c_pci /bin/true install rc_terratec_cinergy_s2_hd /bin/true install rc_terratec_cinergy_xs /bin/true install rc_terratec_slim /bin/true install rc_terratec_slim_2 /bin/true install rc_tevii_nec /bin/true install rc_tivo /bin/true install rc_total_media_in_hand /bin/true install rc_total_media_in_hand_02 /bin/true install rc_trekstor /bin/true install rc_tt_1500 /bin/true install rc_twinhan1027 /bin/true install rc_twinhan_dtv_cab_ci /bin/true install rc_vega_s9x /bin/true install rc_videomate_m1f /bin/true install rc_videomate_s350 /bin/true install rc_videomate_tv_pvr /bin/true install rc_videostrong_kii_pro /bin/true install rc_wetek_hub /bin/true install rc_wetek_play2 /bin/true install rc_winfast /bin/true install rc_winfast_usbii_deluxe /bin/true install rc_x96max /bin/true install rc_xbox_360 /bin/true install rc_xbox_dvd /bin/true install rc_zx_irdec /bin/true install rdacm20 /bin/true install rdacm21 /bin/true install rdc321x_southbridge /bin/true install rdma_cm /bin/true install rdma_rxe /bin/true install rdma_ucm /bin/true install rdmavt /bin/true install rds /bin/true install rds_rdma /bin/true install rds_tcp /bin/true install realtek /bin/true install redboot /bin/true install redrat3 /bin/true install reed_solomon /bin/true install regmap_i3c /bin/true install regmap_sccb /bin/true install regmap_sdw /bin/true install regmap_sdw_mbq /bin/true install regmap_slimbus /bin/true install regmap_spi_avmm /bin/true install regmap_spmi /bin/true install regmap_w1 /bin/true install regulator_haptic /bin/true install reiserfs /bin/true install repaper /bin/true install reset_ti_syscon /bin/true install reset_tps380x /bin/true install resistive_adc_touch /bin/true install retu_mfd /bin/true install retu_pwrbutton /bin/true install retu_wdt /bin/true install rfc1051 /bin/true install rfc1201 /bin/true install rfcomm /bin/true install rfd77402 /bin/true install rfd_ftl /bin/true install rfkill_gpio /bin/true install rio_cm /bin/true install rio_mport_cdev /bin/true install rio_scan /bin/true install rionet /bin/true install rivafb /bin/true install rj54n1cb0c /bin/true install rm3100_core /bin/true install rm3100_i2c /bin/true install rm3100_spi /bin/true install rmd160 /bin/true install rmi_core /bin/true install rmi_i2c /bin/true install rmi_smbus /bin/true install rmi_spi /bin/true install rmnet /bin/true install rnbd_client /bin/true install rnbd_server /bin/true install rndis_host /bin/true install rockchip /bin/true install rocker /bin/true install rohm_bm1390 /bin/true install rohm_bu21023 /bin/true install rohm_bu27008 /bin/true install rohm_bu27034 /bin/true install romfs /bin/true install rose /bin/true install rotary_encoder /bin/true install rp2 /bin/true install rpcrdma /bin/true install rpcsec_gss_krb5 /bin/true install rpmsg_char /bin/true install rpmsg_core /bin/true install rpmsg_ctrl /bin/true install rpmsg_ns /bin/true install rpmsg_tty /bin/true install rpmsg_wwan_ctrl /bin/true install rpr0521 /bin/true install rsi_91x /bin/true install rsi_sdio /bin/true install rsi_usb /bin/true install rt1719 /bin/true install rt2400pci /bin/true install rt2500pci /bin/true install rt2500usb /bin/true install rt2800lib /bin/true install rt2800mmio /bin/true install rt2800pci /bin/true install rt2800usb /bin/true install rt2x00lib /bin/true install rt2x00mmio /bin/true install rt2x00pci /bin/true install rt2x00usb /bin/true install rt4801_regulator /bin/true install rt4803 /bin/true install rt4831 /bin/true install rt4831_backlight /bin/true install rt4831_regulator /bin/true install rt5033 /bin/true install rt5033_battery /bin/true install rt5033_charger /bin/true install rt5033_regulator /bin/true install rt5120 /bin/true install rt5120_pwrkey /bin/true install rt5120_regulator /bin/true install rt5190a_regulator /bin/true install rt5739 /bin/true install rt5759_regulator /bin/true install rt6160_regulator /bin/true install rt6190_regulator /bin/true install rt61pci /bin/true install rt6245_regulator /bin/true install rt73usb /bin/true install rt9455_charger /bin/true install rt9467_charger /bin/true install rt9471 /bin/true install rtc_88pm80x /bin/true install rtc_88pm860x /bin/true install rtc_ab_b5ze_s3 /bin/true install rtc_ab_eoz9 /bin/true install rtc_abx80x /bin/true install rtc_bq32k /bin/true install rtc_cros_ec /bin/true install rtc_da9052 /bin/true install rtc_da9055 /bin/true install rtc_da9063 /bin/true install rtc_ds1286 /bin/true install rtc_ds1302 /bin/true install rtc_ds1305 /bin/true install rtc_ds1307 /bin/true install rtc_ds1343 /bin/true install rtc_ds1347 /bin/true install rtc_ds1374 /bin/true install rtc_ds1390 /bin/true install rtc_ds1511 /bin/true install rtc_ds1553 /bin/true install rtc_ds1672 /bin/true install rtc_ds1685 /bin/true install rtc_ds1742 /bin/true install rtc_ds2404 /bin/true install rtc_ds3232 /bin/true install rtc_em3027 /bin/true install rtc_fm3130 /bin/true install rtc_ftrtc010 /bin/true install rtc_goldfish /bin/true install rtc_hid_sensor_time /bin/true install rtc_isl12022 /bin/true install rtc_isl1208 /bin/true install rtc_lp8788 /bin/true install rtc_m41t80 /bin/true install rtc_m41t93 /bin/true install rtc_m41t94 /bin/true install rtc_m48t35 /bin/true install rtc_m48t59 /bin/true install rtc_m48t86 /bin/true install rtc_max31335 /bin/true install rtc_max6900 /bin/true install rtc_max6902 /bin/true install rtc_max6916 /bin/true install rtc_max8907 /bin/true install rtc_max8925 /bin/true install rtc_max8997 /bin/true install rtc_max8998 /bin/true install rtc_mc13xxx /bin/true install rtc_mcp795 /bin/true install rtc_msm6242 /bin/true install rtc_mt6397 /bin/true install rtc_palmas /bin/true install rtc_pcap /bin/true install rtc_pcf2123 /bin/true install rtc_pcf2127 /bin/true install rtc_pcf50633 /bin/true install rtc_pcf85063 /bin/true install rtc_pcf8523 /bin/true install rtc_pcf85363 /bin/true install rtc_pcf8563 /bin/true install rtc_pcf8583 /bin/true install rtc_r9701 /bin/true install rtc_rc5t583 /bin/true install rtc_rp5c01 /bin/true install rtc_rs5c348 /bin/true install rtc_rs5c372 /bin/true install rtc_rv3028 /bin/true install rtc_rv3029c2 /bin/true install rtc_rv3032 /bin/true install rtc_rv8803 /bin/true install rtc_rx4581 /bin/true install rtc_rx6110 /bin/true install rtc_rx8010 /bin/true install rtc_rx8025 /bin/true install rtc_rx8581 /bin/true install rtc_s35390a /bin/true install rtc_sd3078 /bin/true install rtc_stk17ta8 /bin/true install rtc_tps6586x /bin/true install rtc_tps65910 /bin/true install rtc_tps6594 /bin/true install rtc_wilco_ec /bin/true install rtc_wm831x /bin/true install rtc_wm8350 /bin/true install rtc_x1205 /bin/true install rtd520 /bin/true install rti800 /bin/true install rti802 /bin/true install rtl2830 /bin/true install rtl2832 /bin/true install rtl2832_sdr /bin/true install rtl8150 /bin/true install rtl8187 /bin/true install rtl8188ee /bin/true install rtl818x_pci /bin/true install rtl8192c_common /bin/true install rtl8192ce /bin/true install rtl8192cu /bin/true install rtl8192de /bin/true install rtl8192ee /bin/true install rtl8192se /bin/true install rtl8365mb /bin/true install rtl8366 /bin/true install rtl8723_common /bin/true install rtl8723ae /bin/true install rtl8723be /bin/true install rtl8821ae /bin/true install rtl8xxxu /bin/true install rtl_pci /bin/true install rtl_usb /bin/true install rtllib /bin/true install rtllib_crypt_ccmp /bin/true install rtllib_crypt_tkip /bin/true install rtllib_crypt_wep /bin/true install rtlwifi /bin/true install rtmv20_regulator /bin/true install rtq2134_regulator /bin/true install rtq2208_regulator /bin/true install rtq6056 /bin/true install rtq6752_regulator /bin/true install rtrs_client /bin/true install rtrs_core /bin/true install rtrs_server /bin/true install rts5208 /bin/true install rtsx_pci /bin/true install rtsx_pci_ms /bin/true install rtsx_pci_sdmmc /bin/true install rtsx_usb /bin/true install rtsx_usb_ms /bin/true install rtsx_usb_sdmmc /bin/true install rtw88_8723d /bin/true install rtw88_8723de /bin/true install rtw88_8723ds /bin/true install rtw88_8723du /bin/true install rtw88_8821c /bin/true install rtw88_8821ce /bin/true install rtw88_8821cs /bin/true install rtw88_8821cu /bin/true install rtw88_8822b /bin/true install rtw88_8822be /bin/true install rtw88_8822bs /bin/true install rtw88_8822bu /bin/true install rtw88_8822c /bin/true install rtw88_8822ce /bin/true install rtw88_8822cs /bin/true install rtw88_8822cu /bin/true install rtw88_core /bin/true install rtw88_pci /bin/true install rtw88_sdio /bin/true install rtw88_usb /bin/true install rtw89_8851b /bin/true install rtw89_8851be /bin/true install rtw89_8852a /bin/true install rtw89_8852ae /bin/true install rtw89_8852b /bin/true install rtw89_8852be /bin/true install rtw89_8852c /bin/true install rtw89_8852ce /bin/true install rtw89_core /bin/true install rtw89_pci /bin/true install rx51_battery /bin/true install rxperf /bin/true install rxrpc /bin/true install s1d13xxxfb /bin/true install s2250 /bin/true install s2255drv /bin/true install s2io /bin/true install s3fb /bin/true install s3fwrn5 /bin/true install s3fwrn5_i2c /bin/true install s3fwrn82_uart /bin/true install s526 /bin/true install s5c73m3 /bin/true install s5h1409 /bin/true install s5h1411 /bin/true install s5h1420 /bin/true install s5h1432 /bin/true install s5k5baf /bin/true install s5k6a3 /bin/true install s626 /bin/true install s6sy761 /bin/true install s921 /bin/true install saa6588 /bin/true install saa6752hs /bin/true install saa7110 /bin/true install saa7115 /bin/true install saa7127 /bin/true install saa7134 /bin/true install saa7134_alsa /bin/true install saa7134_dvb /bin/true install saa7134_empress /bin/true install saa7134_go7007 /bin/true install saa7146 /bin/true install saa7146_vv /bin/true install saa7164 /bin/true install saa717x /bin/true install saa7185 /bin/true install saa7706h /bin/true install safe_serial /bin/true install sample_trace_array /bin/true install samsung_keypad /bin/true install samsung_laptop /bin/true install samsung_q10 /bin/true install samsung_sxgbe /bin/true install sata_dwc_460ex /bin/true install sata_inic162x /bin/true install sata_mv /bin/true install sata_nv /bin/true install sata_promise /bin/true install sata_qstor /bin/true install sata_sil /bin/true install sata_sil24 /bin/true install sata_sis /bin/true install sata_svw /bin/true install sata_sx4 /bin/true install sata_uli /bin/true install sata_via /bin/true install sata_vsc /bin/true install savagefb /bin/true install sb1000 /bin/true install sb_edac /bin/true install sbc60xxwdt /bin/true install sbc_epx_c3 /bin/true install sbc_fitpc2_wdt /bin/true install sbc_gxx /bin/true install sbp_target /bin/true install sbrmi /bin/true install sbs /bin/true install sbs_battery /bin/true install sbs_charger /bin/true install sbs_manager /bin/true install sbshc /bin/true install sbtsi_temp /bin/true install sc1200wdt /bin/true install sc16is7xx /bin/true install sc92031 /bin/true install sca3000 /bin/true install sca3300 /bin/true install scb2_flash /bin/true install scd30_core /bin/true install scd30_i2c /bin/true install scd30_serial /bin/true install scd4x /bin/true install sch311x_wdt /bin/true install sch5627 /bin/true install sch5636 /bin/true install sch56xx_common /bin/true install sch_cake /bin/true install sch_cbs /bin/true install sch_choke /bin/true install sch_codel /bin/true install sch_drr /bin/true install sch_etf /bin/true install sch_ets /bin/true install sch_fq /bin/true install sch_fq_pie /bin/true install sch_gred /bin/true install sch_hfsc /bin/true install sch_hhf /bin/true install sch_htb /bin/true install sch_ingress /bin/true install sch_mqprio /bin/true install sch_mqprio_lib /bin/true install sch_multiq /bin/true install sch_netem /bin/true install sch_pie /bin/true install sch_plug /bin/true install sch_prio /bin/true install sch_qfq /bin/true install sch_red /bin/true install sch_sfb /bin/true install sch_sfq /bin/true install sch_skbprio /bin/true install sch_taprio /bin/true install sch_tbf /bin/true install sch_teql /bin/true install scsi_debug /bin/true install scsi_dh_alua /bin/true install scsi_dh_emc /bin/true install scsi_dh_hp_sw /bin/true install scsi_dh_rdac /bin/true install scsi_transport_fc /bin/true install scsi_transport_iscsi /bin/true install scsi_transport_sas /bin/true install scsi_transport_spi /bin/true install scsi_transport_srp /bin/true install sctp /bin/true install sctp_diag /bin/true install sd_adc_modulator /bin/true install sdhci /bin/true install sdhci_acpi /bin/true install sdhci_f_sdh30 /bin/true install sdhci_pci /bin/true install sdhci_pltfm /bin/true install sdhci_xenon_driver /bin/true install sdio_uart /bin/true install sdricoh_cs /bin/true install seco_cec /bin/true install sel3350_platform /bin/true install sensehat_joystick /bin/true install sensorhub /bin/true install serial_cs /bin/true install serial_ir /bin/true install serial_multi_instantiate /bin/true install sermouse /bin/true install serpent_avx2 /bin/true install serpent_avx_x86_64 /bin/true install serpent_generic /bin/true install serpent_sse2_x86_64 /bin/true install serport /bin/true install ses /bin/true install sev_guest /bin/true install sf_pdma /bin/true install sfc /bin/true install sfc_falcon /bin/true install sfc_siena /bin/true install sfp /bin/true install sgi_w1 /bin/true install sgp30 /bin/true install sgp40 /bin/true install sha1_ssse3 /bin/true install sha256_ssse3 /bin/true install shark2 /bin/true install sht15 /bin/true install sht21 /bin/true install sht3x /bin/true install sht4x /bin/true install shtc1 /bin/true install si1133 /bin/true install si1145 /bin/true install si2157 /bin/true install si2165 /bin/true install si2168 /bin/true install si21xx /bin/true install si4713 /bin/true install si476x_core /bin/true install si7005 /bin/true install si7020 /bin/true install sidewinder /bin/true install sierra /bin/true install sierra_net /bin/true install sil164 /bin/true install silead /bin/true install silicom_platform /bin/true install simatic_ipc /bin/true install simatic_ipc_batt /bin/true install simatic_ipc_batt_apollolake /bin/true install simatic_ipc_batt_elkhartlake /bin/true install simatic_ipc_batt_f7188x /bin/true install simatic_ipc_leds /bin/true install simatic_ipc_leds_gpio_apollolake /bin/true install simatic_ipc_leds_gpio_core /bin/true install simatic_ipc_leds_gpio_elkhartlake /bin/true install simatic_ipc_leds_gpio_f7188x /bin/true install simatic_ipc_wdt /bin/true install simple_mfd_i2c /bin/true install siox_bus_gpio /bin/true install siox_core /bin/true install sis190 /bin/true install sis5595 /bin/true install sis900 /bin/true install sis_agp /bin/true install sis_i2c /bin/true install sisfb /bin/true install sisusbvga /bin/true install sit /bin/true install siw /bin/true install sja1000 /bin/true install sja1000_isa /bin/true install sja1000_platform /bin/true install sja1105 /bin/true install skfp /bin/true install skge /bin/true install skx_edac /bin/true install skx_edac_common /bin/true install sky2 /bin/true install sky81452 /bin/true install sky81452_backlight /bin/true install sky81452_regulator /bin/true install sl811_cs /bin/true install sl811_hcd /bin/true install slcan /bin/true install slg51000_regulator /bin/true install slicoss /bin/true install slim_qcom_ctrl /bin/true install slimbus /bin/true install slip /bin/true install slram /bin/true install sm2_generic /bin/true install sm3 /bin/true install sm3_avx_x86_64 /bin/true install sm3_generic /bin/true install sm4 /bin/true install sm4_aesni_avx2_x86_64 /bin/true install sm4_aesni_avx_x86_64 /bin/true install sm4_generic /bin/true install sm501 /bin/true install sm501fb /bin/true install sm712fb /bin/true install sm750fb /bin/true install sm_common /bin/true install sm_ftl /bin/true install smartpqi /bin/true install smb347_charger /bin/true install smc /bin/true install smc91c92_cs /bin/true install smc_diag /bin/true install smipcie /bin/true install smpro_core /bin/true install smpro_errmon /bin/true install smpro_hwmon /bin/true install smpro_misc /bin/true install smsc /bin/true install smsc37b787_wdt /bin/true install smsc47b397 /bin/true install smsc47m1 /bin/true install smsc47m192 /bin/true install smsc75xx /bin/true install smsc911x /bin/true install smsc9420 /bin/true install smsc95xx /bin/true install smscufx /bin/true install smsdvb /bin/true install smsmdtv /bin/true install smssdio /bin/true install smsusb /bin/true install snd_acp3x_i2s /bin/true install snd_acp3x_pcm_dma /bin/true install snd_acp3x_pdm_dma /bin/true install snd_acp3x_rn /bin/true install snd_acp5x_i2s /bin/true install snd_acp5x_pcm_dma /bin/true install snd_acp63 /bin/true install snd_acp6x_pdm_dma /bin/true install snd_acp70 /bin/true install snd_acp_config /bin/true install snd_acp_i2s /bin/true install snd_acp_legacy_common /bin/true install snd_acp_legacy_mach /bin/true install snd_acp_mach /bin/true install snd_acp_pci /bin/true install snd_acp_pcm /bin/true install snd_acp_pdm /bin/true install snd_acp_rembrandt /bin/true install snd_acp_renoir /bin/true install snd_acp_sof_mach /bin/true install snd_ad1889 /bin/true install snd_ak4113 /bin/true install snd_ak4114 /bin/true install snd_ak4117 /bin/true install snd_ak4xxx_adda /bin/true install snd_ali5451 /bin/true install snd_aloop /bin/true install snd_als300 /bin/true install snd_als4000 /bin/true install snd_asihpi /bin/true install snd_atiixp /bin/true install snd_atiixp_modem /bin/true install snd_au8810 /bin/true install snd_au8820 /bin/true install snd_au8830 /bin/true install snd_aw2 /bin/true install snd_azt3328 /bin/true install snd_bcd2000 /bin/true install snd_bebob /bin/true install snd_bt87x /bin/true install snd_ca0106 /bin/true install snd_cmipci /bin/true install snd_compress /bin/true install snd_cs4281 /bin/true install snd_cs46xx /bin/true install snd_cs8427 /bin/true install snd_ctl_led /bin/true install snd_ctxfi /bin/true install snd_darla20 /bin/true install snd_darla24 /bin/true install snd_dice /bin/true install snd_dummy /bin/true install snd_echo3g /bin/true install snd_emu10k1 /bin/true install snd_emu10k1_synth /bin/true install snd_emu10k1x /bin/true install snd_emux_synth /bin/true install snd_ens1370 /bin/true install snd_ens1371 /bin/true install snd_es1938 /bin/true install snd_es1968 /bin/true install snd_fireface /bin/true install snd_firewire_digi00x /bin/true install snd_firewire_lib /bin/true install snd_firewire_motu /bin/true install snd_firewire_tascam /bin/true install snd_fireworks /bin/true install snd_fm801 /bin/true install snd_gina20 /bin/true install snd_gina24 /bin/true install snd_hda_cirrus_scodec /bin/true install snd_hda_codec_analog /bin/true install snd_hda_codec_ca0110 /bin/true install snd_hda_codec_ca0132 /bin/true install snd_hda_codec_cirrus /bin/true install snd_hda_codec_cmedia /bin/true install snd_hda_codec_conexant /bin/true install snd_hda_codec_cs8409 /bin/true install snd_hda_codec_generic /bin/true install snd_hda_codec_hdmi /bin/true install snd_hda_codec_idt /bin/true install snd_hda_codec_realtek /bin/true install snd_hda_codec_si3054 /bin/true install snd_hda_codec_via /bin/true install snd_hda_cs_dsp_ctls /bin/true install snd_hda_ext_core /bin/true install snd_hda_scodec_cs35l41 /bin/true install snd_hda_scodec_cs35l41_i2c /bin/true install snd_hda_scodec_cs35l41_spi /bin/true install snd_hda_scodec_cs35l56 /bin/true install snd_hda_scodec_cs35l56_i2c /bin/true install snd_hda_scodec_cs35l56_spi /bin/true install snd_hda_scodec_tas2781_i2c /bin/true install snd_hdmi_lpe_audio /bin/true install snd_hdsp /bin/true install snd_hdspm /bin/true install snd_i2c /bin/true install snd_ice1712 /bin/true install snd_ice1724 /bin/true install snd_ice17xx_ak4xxx /bin/true install snd_indigo /bin/true install snd_indigodj /bin/true install snd_indigodjx /bin/true install snd_indigoio /bin/true install snd_indigoiox /bin/true install snd_intel8x0m /bin/true install snd_intel_sst_acpi /bin/true install snd_intel_sst_core /bin/true install snd_intel_sst_pci /bin/true install snd_isight /bin/true install snd_korg1212 /bin/true install snd_layla20 /bin/true install snd_layla24 /bin/true install snd_lola /bin/true install snd_lx6464es /bin/true install snd_maestro3 /bin/true install snd_mia /bin/true install snd_mixart /bin/true install snd_mixer_oss /bin/true install snd_mona /bin/true install snd_mpu401 /bin/true install snd_mpu401_uart /bin/true install snd_mtpav /bin/true install snd_mts64 /bin/true install snd_nm256 /bin/true install snd_opl3_lib /bin/true install snd_opl3_synth /bin/true install snd_oxfw /bin/true install snd_oxygen /bin/true install snd_oxygen_lib /bin/true install snd_pci_acp3x /bin/true install snd_pci_acp5x /bin/true install snd_pci_acp6x /bin/true install snd_pci_ps /bin/true install snd_pcm_dmaengine /bin/true install snd_pcmtest /bin/true install snd_pcsp /bin/true install snd_pcxhr /bin/true install snd_pdaudiocf /bin/true install snd_portman2x4 /bin/true install snd_ps_pdm_dma /bin/true install snd_ps_sdw_dma /bin/true install snd_pt2258 /bin/true install snd_riptide /bin/true install snd_rme32 /bin/true install snd_rme96 /bin/true install snd_rme9652 /bin/true install snd_rn_pci_acp3x /bin/true install snd_rpl_pci_acp6x /bin/true install snd_sb_common /bin/true install snd_seq_midi_emul /bin/true install snd_seq_ump_client /bin/true install snd_seq_virmidi /bin/true install snd_serial_u16550 /bin/true install snd_skl_nau88l25_max98357a /bin/true install snd_soc_63xx /bin/true install snd_soc_ac97 /bin/true install snd_soc_acp5x_mach /bin/true install snd_soc_acp6x_mach /bin/true install snd_soc_acp_da7219mx98357_mach /bin/true install snd_soc_acp_es8336_mach /bin/true install snd_soc_acp_rt5645_mach /bin/true install snd_soc_acp_rt5682_mach /bin/true install snd_soc_acpi /bin/true install snd_soc_acpi_intel_match /bin/true install snd_soc_adau1372 /bin/true install snd_soc_adau1372_i2c /bin/true install snd_soc_adau1372_spi /bin/true install snd_soc_adau1701 /bin/true install snd_soc_adau1761 /bin/true install snd_soc_adau1761_i2c /bin/true install snd_soc_adau1761_spi /bin/true install snd_soc_adau17x1 /bin/true install snd_soc_adau7002 /bin/true install snd_soc_adau7118 /bin/true install snd_soc_adau7118_hw /bin/true install snd_soc_adau7118_i2c /bin/true install snd_soc_adau_utils /bin/true install snd_soc_adi_axi_i2s /bin/true install snd_soc_adi_axi_spdif /bin/true install snd_soc_ak4104 /bin/true install snd_soc_ak4118 /bin/true install snd_soc_ak4375 /bin/true install snd_soc_ak4458 /bin/true install snd_soc_ak4554 /bin/true install snd_soc_ak4613 /bin/true install snd_soc_ak4642 /bin/true install snd_soc_ak5386 /bin/true install snd_soc_ak5558 /bin/true install snd_soc_alc5623 /bin/true install snd_soc_arizona /bin/true install snd_soc_audio_iio_aux /bin/true install snd_soc_avs /bin/true install snd_soc_avs_da7219 /bin/true install snd_soc_avs_dmic /bin/true install snd_soc_avs_es8336 /bin/true install snd_soc_avs_hdaudio /bin/true install snd_soc_avs_i2s_test /bin/true install snd_soc_avs_max98357a /bin/true install snd_soc_avs_max98373 /bin/true install snd_soc_avs_max98927 /bin/true install snd_soc_avs_nau8825 /bin/true install snd_soc_avs_probe /bin/true install snd_soc_avs_rt274 /bin/true install snd_soc_avs_rt286 /bin/true install snd_soc_avs_rt298 /bin/true install snd_soc_avs_rt5514 /bin/true install snd_soc_avs_rt5663 /bin/true install snd_soc_avs_rt5682 /bin/true install snd_soc_avs_ssm4567 /bin/true install snd_soc_aw8738 /bin/true install snd_soc_aw87390 /bin/true install snd_soc_aw88261 /bin/true install snd_soc_aw88395 /bin/true install snd_soc_aw88395_lib /bin/true install snd_soc_aw88399 /bin/true install snd_soc_bd28623 /bin/true install snd_soc_bdw_rt286 /bin/true install snd_soc_bt_sco /bin/true install snd_soc_catpt /bin/true install snd_soc_chv3_codec /bin/true install snd_soc_cml_rt1011_rt5682 /bin/true install snd_soc_core /bin/true install snd_soc_cros_ec_codec /bin/true install snd_soc_cs35l32 /bin/true install snd_soc_cs35l33 /bin/true install snd_soc_cs35l34 /bin/true install snd_soc_cs35l35 /bin/true install snd_soc_cs35l36 /bin/true install snd_soc_cs35l41 /bin/true install snd_soc_cs35l41_i2c /bin/true install snd_soc_cs35l41_lib /bin/true install snd_soc_cs35l41_spi /bin/true install snd_soc_cs35l45 /bin/true install snd_soc_cs35l45_i2c /bin/true install snd_soc_cs35l45_spi /bin/true install snd_soc_cs35l56 /bin/true install snd_soc_cs35l56_i2c /bin/true install snd_soc_cs35l56_sdw /bin/true install snd_soc_cs35l56_shared /bin/true install snd_soc_cs35l56_spi /bin/true install snd_soc_cs4234 /bin/true install snd_soc_cs4265 /bin/true install snd_soc_cs4270 /bin/true install snd_soc_cs4271 /bin/true install snd_soc_cs4271_i2c /bin/true install snd_soc_cs4271_spi /bin/true install snd_soc_cs42l42 /bin/true install snd_soc_cs42l42_i2c /bin/true install snd_soc_cs42l42_sdw /bin/true install snd_soc_cs42l43 /bin/true install snd_soc_cs42l43_sdw /bin/true install snd_soc_cs42l51 /bin/true install snd_soc_cs42l51_i2c /bin/true install snd_soc_cs42l52 /bin/true install snd_soc_cs42l56 /bin/true install snd_soc_cs42l73 /bin/true install snd_soc_cs42l83_i2c /bin/true install snd_soc_cs42xx8 /bin/true install snd_soc_cs42xx8_i2c /bin/true install snd_soc_cs43130 /bin/true install snd_soc_cs4341 /bin/true install snd_soc_cs4349 /bin/true install snd_soc_cs53l30 /bin/true install snd_soc_cx2072x /bin/true install snd_soc_da7213 /bin/true install snd_soc_da7219 /bin/true install snd_soc_dmic /bin/true install snd_soc_ehl_rt5660 /bin/true install snd_soc_es7134 /bin/true install snd_soc_es7241 /bin/true install snd_soc_es8316 /bin/true install snd_soc_es8326 /bin/true install snd_soc_es8328 /bin/true install snd_soc_es8328_i2c /bin/true install snd_soc_es8328_spi /bin/true install snd_soc_es83xx_dsm_common /bin/true install snd_soc_fsl_asrc /bin/true install snd_soc_fsl_audmix /bin/true install snd_soc_fsl_easrc /bin/true install snd_soc_fsl_esai /bin/true install snd_soc_fsl_micfil /bin/true install snd_soc_fsl_mqs /bin/true install snd_soc_fsl_sai /bin/true install snd_soc_fsl_spdif /bin/true install snd_soc_fsl_ssi /bin/true install snd_soc_fsl_utils /bin/true install snd_soc_fsl_xcvr /bin/true install snd_soc_gtm601 /bin/true install snd_soc_hda_codec /bin/true install snd_soc_hdac_hda /bin/true install snd_soc_hdac_hdmi /bin/true install snd_soc_hdmi_codec /bin/true install snd_soc_hsw_rt5640 /bin/true install snd_soc_ics43432 /bin/true install snd_soc_idt821034 /bin/true install snd_soc_imx_audmux /bin/true install snd_soc_inno_rk3036 /bin/true install snd_soc_intel_hda_dsp_common /bin/true install snd_soc_intel_sof_board_helpers /bin/true install snd_soc_intel_sof_cirrus_common /bin/true install snd_soc_intel_sof_maxim_common /bin/true install snd_soc_intel_sof_nuvoton_common /bin/true install snd_soc_intel_sof_realtek_common /bin/true install snd_soc_intel_sof_ssp_common /bin/true install snd_soc_kbl_da7219_max98357a /bin/true install snd_soc_kbl_da7219_max98927 /bin/true install snd_soc_kbl_rt5660 /bin/true install snd_soc_kbl_rt5663_max98927 /bin/true install snd_soc_kbl_rt5663_rt5514_max98927 /bin/true install snd_soc_lpass_macro_common /bin/true install snd_soc_lpass_rx_macro /bin/true install snd_soc_lpass_tx_macro /bin/true install snd_soc_lpass_va_macro /bin/true install snd_soc_lpass_wsa_macro /bin/true install snd_soc_max9759 /bin/true install snd_soc_max98088 /bin/true install snd_soc_max98090 /bin/true install snd_soc_max98357a /bin/true install snd_soc_max98363 /bin/true install snd_soc_max98373 /bin/true install snd_soc_max98373_i2c /bin/true install snd_soc_max98373_sdw /bin/true install snd_soc_max98388 /bin/true install snd_soc_max98390 /bin/true install snd_soc_max98396 /bin/true install snd_soc_max98504 /bin/true install snd_soc_max98520 /bin/true install snd_soc_max9860 /bin/true install snd_soc_max9867 /bin/true install snd_soc_max98927 /bin/true install snd_soc_msm8916_analog /bin/true install snd_soc_msm8916_digital /bin/true install snd_soc_mt6351 /bin/true install snd_soc_mt6358 /bin/true install snd_soc_mt6660 /bin/true install snd_soc_nau8315 /bin/true install snd_soc_nau8540 /bin/true install snd_soc_nau8810 /bin/true install snd_soc_nau8821 /bin/true install snd_soc_nau8822 /bin/true install snd_soc_nau8824 /bin/true install snd_soc_nau8825 /bin/true install snd_soc_pcm1681 /bin/true install snd_soc_pcm1789_codec /bin/true install snd_soc_pcm1789_i2c /bin/true install snd_soc_pcm179x_codec /bin/true install snd_soc_pcm179x_i2c /bin/true install snd_soc_pcm179x_spi /bin/true install snd_soc_pcm186x /bin/true install snd_soc_pcm186x_i2c /bin/true install snd_soc_pcm186x_spi /bin/true install snd_soc_pcm3060 /bin/true install snd_soc_pcm3060_i2c /bin/true install snd_soc_pcm3060_spi /bin/true install snd_soc_pcm3168a /bin/true install snd_soc_pcm3168a_i2c /bin/true install snd_soc_pcm3168a_spi /bin/true install snd_soc_pcm5102a /bin/true install snd_soc_pcm512x /bin/true install snd_soc_pcm512x_i2c /bin/true install snd_soc_pcm512x_spi /bin/true install snd_soc_peb2466 /bin/true install snd_soc_ps_mach /bin/true install snd_soc_rk3328 /bin/true install snd_soc_rl6231 /bin/true install snd_soc_rl6347a /bin/true install snd_soc_rt1011 /bin/true install snd_soc_rt1015 /bin/true install snd_soc_rt1015p /bin/true install snd_soc_rt1017_sdca /bin/true install snd_soc_rt1019 /bin/true install snd_soc_rt1308 /bin/true install snd_soc_rt1308_sdw /bin/true install snd_soc_rt1316_sdw /bin/true install snd_soc_rt1318_sdw /bin/true install snd_soc_rt274 /bin/true install snd_soc_rt286 /bin/true install snd_soc_rt298 /bin/true install snd_soc_rt5514 /bin/true install snd_soc_rt5514_spi /bin/true install snd_soc_rt5616 /bin/true install snd_soc_rt5631 /bin/true install snd_soc_rt5640 /bin/true install snd_soc_rt5645 /bin/true install snd_soc_rt5651 /bin/true install snd_soc_rt5659 /bin/true install snd_soc_rt5660 /bin/true install snd_soc_rt5663 /bin/true install snd_soc_rt5670 /bin/true install snd_soc_rt5677 /bin/true install snd_soc_rt5677_spi /bin/true install snd_soc_rt5682 /bin/true install snd_soc_rt5682_i2c /bin/true install snd_soc_rt5682_sdw /bin/true install snd_soc_rt5682s /bin/true install snd_soc_rt700 /bin/true install snd_soc_rt711 /bin/true install snd_soc_rt711_sdca /bin/true install snd_soc_rt712_sdca /bin/true install snd_soc_rt712_sdca_dmic /bin/true install snd_soc_rt715 /bin/true install snd_soc_rt715_sdca /bin/true install snd_soc_rt722_sdca /bin/true install snd_soc_rt9120 /bin/true install snd_soc_rtq9128 /bin/true install snd_soc_sdw_mockup /bin/true install snd_soc_sgtl5000 /bin/true install snd_soc_si476x /bin/true install snd_soc_sigmadsp /bin/true install snd_soc_sigmadsp_i2c /bin/true install snd_soc_sigmadsp_regmap /bin/true install snd_soc_simple_amplifier /bin/true install snd_soc_simple_card /bin/true install snd_soc_simple_card_utils /bin/true install snd_soc_simple_mux /bin/true install snd_soc_skl /bin/true install snd_soc_skl_hda_dsp /bin/true install snd_soc_skl_nau88l25_ssm4567 /bin/true install snd_soc_skl_rt286 /bin/true install snd_soc_skl_ssp_clk /bin/true install snd_soc_sma1303 /bin/true install snd_soc_sof_cs42l42 /bin/true install snd_soc_sof_da7219 /bin/true install snd_soc_sof_es8336 /bin/true install snd_soc_sof_nau8825 /bin/true install snd_soc_sof_rt5682 /bin/true install snd_soc_sof_sdw /bin/true install snd_soc_sof_ssp_amp /bin/true install snd_soc_spdif_rx /bin/true install snd_soc_spdif_tx /bin/true install snd_soc_src4xxx /bin/true install snd_soc_src4xxx_i2c /bin/true install snd_soc_ssm2305 /bin/true install snd_soc_ssm2518 /bin/true install snd_soc_ssm2602 /bin/true install snd_soc_ssm2602_i2c /bin/true install snd_soc_ssm2602_spi /bin/true install snd_soc_ssm4567 /bin/true install snd_soc_sst_atom_hifi2_platform /bin/true install snd_soc_sst_bdw_rt5650_mach /bin/true install snd_soc_sst_bdw_rt5677_mach /bin/true install snd_soc_sst_bxt_da7219_max98357a /bin/true install snd_soc_sst_bxt_rt298 /bin/true install snd_soc_sst_byt_cht_cx2072x /bin/true install snd_soc_sst_byt_cht_da7213 /bin/true install snd_soc_sst_byt_cht_es8316 /bin/true install snd_soc_sst_bytcr_rt5640 /bin/true install snd_soc_sst_bytcr_rt5651 /bin/true install snd_soc_sst_bytcr_wm5102 /bin/true install snd_soc_sst_cht_bsw_max98090_ti /bin/true install snd_soc_sst_cht_bsw_nau8824 /bin/true install snd_soc_sst_cht_bsw_rt5645 /bin/true install snd_soc_sst_cht_bsw_rt5672 /bin/true install snd_soc_sst_dsp /bin/true install snd_soc_sst_glk_rt5682_max98357a /bin/true install snd_soc_sst_ipc /bin/true install snd_soc_sst_sof_pcm512x /bin/true install snd_soc_sst_sof_wm8804 /bin/true install snd_soc_sta32x /bin/true install snd_soc_sta350 /bin/true install snd_soc_sti_sas /bin/true install snd_soc_tas2552 /bin/true install snd_soc_tas2562 /bin/true install snd_soc_tas2764 /bin/true install snd_soc_tas2770 /bin/true install snd_soc_tas2780 /bin/true install snd_soc_tas2781_comlib /bin/true install snd_soc_tas2781_fmwlib /bin/true install snd_soc_tas2781_i2c /bin/true install snd_soc_tas5086 /bin/true install snd_soc_tas571x /bin/true install snd_soc_tas5720 /bin/true install snd_soc_tas5805m /bin/true install snd_soc_tas6424 /bin/true install snd_soc_tda7419 /bin/true install snd_soc_tfa9879 /bin/true install snd_soc_tfa989x /bin/true install snd_soc_tlv320adc3xxx /bin/true install snd_soc_tlv320adcx140 /bin/true install snd_soc_tlv320aic23 /bin/true install snd_soc_tlv320aic23_i2c /bin/true install snd_soc_tlv320aic23_spi /bin/true install snd_soc_tlv320aic31xx /bin/true install snd_soc_tlv320aic32x4 /bin/true install snd_soc_tlv320aic32x4_i2c /bin/true install snd_soc_tlv320aic32x4_spi /bin/true install snd_soc_tlv320aic3x /bin/true install snd_soc_tlv320aic3x_i2c /bin/true install snd_soc_tlv320aic3x_spi /bin/true install snd_soc_tpa6130a2 /bin/true install snd_soc_ts3a227e /bin/true install snd_soc_tscs42xx /bin/true install snd_soc_tscs454 /bin/true install snd_soc_uda1334 /bin/true install snd_soc_wcd9335 /bin/true install snd_soc_wcd934x /bin/true install snd_soc_wcd938x /bin/true install snd_soc_wcd938x_sdw /bin/true install snd_soc_wcd_classh /bin/true install snd_soc_wcd_mbhc /bin/true install snd_soc_wm5102 /bin/true install snd_soc_wm8510 /bin/true install snd_soc_wm8523 /bin/true install snd_soc_wm8524 /bin/true install snd_soc_wm8580 /bin/true install snd_soc_wm8711 /bin/true install snd_soc_wm8728 /bin/true install snd_soc_wm8731 /bin/true install snd_soc_wm8731_i2c /bin/true install snd_soc_wm8731_spi /bin/true install snd_soc_wm8737 /bin/true install snd_soc_wm8741 /bin/true install snd_soc_wm8750 /bin/true install snd_soc_wm8753 /bin/true install snd_soc_wm8770 /bin/true install snd_soc_wm8776 /bin/true install snd_soc_wm8782 /bin/true install snd_soc_wm8804 /bin/true install snd_soc_wm8804_i2c /bin/true install snd_soc_wm8804_spi /bin/true install snd_soc_wm8903 /bin/true install snd_soc_wm8904 /bin/true install snd_soc_wm8940 /bin/true install snd_soc_wm8960 /bin/true install snd_soc_wm8961 /bin/true install snd_soc_wm8962 /bin/true install snd_soc_wm8974 /bin/true install snd_soc_wm8978 /bin/true install snd_soc_wm8985 /bin/true install snd_soc_wm_adsp /bin/true install snd_soc_wsa881x /bin/true install snd_soc_wsa883x /bin/true install snd_soc_wsa884x /bin/true install snd_soc_xlnx_formatter_pcm /bin/true install snd_soc_xlnx_i2s /bin/true install snd_soc_xlnx_spdif /bin/true install snd_soc_xtfpga_i2s /bin/true install snd_soc_zl38060 /bin/true install snd_sof /bin/true install snd_sof_acpi /bin/true install snd_sof_acpi_intel_bdw /bin/true install snd_sof_acpi_intel_byt /bin/true install snd_sof_amd_acp /bin/true install snd_sof_amd_acp63 /bin/true install snd_sof_amd_rembrandt /bin/true install snd_sof_amd_renoir /bin/true install snd_sof_amd_vangogh /bin/true install snd_sof_intel_atom /bin/true install snd_sof_intel_hda /bin/true install snd_sof_intel_hda_common /bin/true install snd_sof_intel_hda_mlink /bin/true install snd_sof_pci /bin/true install snd_sof_pci_intel_apl /bin/true install snd_sof_pci_intel_cnl /bin/true install snd_sof_pci_intel_icl /bin/true install snd_sof_pci_intel_lnl /bin/true install snd_sof_pci_intel_mtl /bin/true install snd_sof_pci_intel_skl /bin/true install snd_sof_pci_intel_tgl /bin/true install snd_sof_pci_intel_tng /bin/true install snd_sof_probes /bin/true install snd_sof_utils /bin/true install snd_sof_xtensa_dsp /bin/true install snd_sonicvibes /bin/true install snd_trident /bin/true install snd_ua101 /bin/true install snd_ump /bin/true install snd_usb_6fire /bin/true install snd_usb_audio /bin/true install snd_usb_caiaq /bin/true install snd_usb_hiface /bin/true install snd_usb_line6 /bin/true install snd_usb_pod /bin/true install snd_usb_podhd /bin/true install snd_usb_toneport /bin/true install snd_usb_us122l /bin/true install snd_usb_usx2y /bin/true install snd_usb_variax /bin/true install snd_usbmidi_lib /bin/true install snd_util_mem /bin/true install snd_via82xx /bin/true install snd_via82xx_modem /bin/true install snd_virmidi /bin/true install snd_virtuoso /bin/true install snd_vx222 /bin/true install snd_vx_lib /bin/true install snd_vxpocket /bin/true install snd_xen_front /bin/true install snd_ymfpci /bin/true install snet_vdpa /bin/true install snic /bin/true install snps_udc_core /bin/true install soc_button_array /bin/true install softdog /bin/true install softing /bin/true install softing_cs /bin/true install solo6x10 /bin/true install solos_pci /bin/true install sony_btf_mpx /bin/true install sony_laptop /bin/true install soundwire_amd /bin/true install soundwire_bus /bin/true install soundwire_cadence /bin/true install soundwire_generic_allocation /bin/true install soundwire_intel /bin/true install soundwire_qcom /bin/true install sp2 /bin/true install sp5100_tco /bin/true install sp8870 /bin/true install sp887x /bin/true install spaceball /bin/true install spaceorb /bin/true install sparse_keymap /bin/true install spcp8x5 /bin/true install speakup /bin/true install speakup_acntsa /bin/true install speakup_apollo /bin/true install speakup_audptr /bin/true install speakup_bns /bin/true install speakup_decext /bin/true install speakup_dectlk /bin/true install speakup_dummy /bin/true install speakup_ltlk /bin/true install speakup_soft /bin/true install speakup_spkout /bin/true install speakup_txprt /bin/true install speedfax /bin/true install speedstep_lib /bin/true install speedtch /bin/true install spi_altera_core /bin/true install spi_altera_dfl /bin/true install spi_altera_platform /bin/true install spi_amd /bin/true install spi_axi_spi_engine /bin/true install spi_bitbang /bin/true install spi_butterfly /bin/true install spi_cadence /bin/true install spi_cs42l43 /bin/true install spi_dln2 /bin/true install spi_dw /bin/true install spi_dw_mmio /bin/true install spi_dw_pci /bin/true install spi_gpio /bin/true install spi_intel /bin/true install spi_intel_pci /bin/true install spi_intel_platform /bin/true install spi_ks8995 /bin/true install spi_lantiq_ssc /bin/true install spi_ljca /bin/true install spi_lm70llp /bin/true install spi_loopback_test /bin/true install spi_microchip_core /bin/true install spi_microchip_core_qspi /bin/true install spi_mux /bin/true install spi_mxic /bin/true install spi_nor /bin/true install spi_oc_tiny /bin/true install spi_pci1xxxx /bin/true install spi_pxa2xx_pci /bin/true install spi_pxa2xx_platform /bin/true install spi_sc18is602 /bin/true install spi_sifive /bin/true install spi_slave_system_control /bin/true install spi_slave_time /bin/true install spi_tle62x0 /bin/true install spi_xcomm /bin/true install spi_xilinx /bin/true install spi_zynqmp_gqspi /bin/true install spidev /bin/true install spinand /bin/true install spl /bin/true install spmi /bin/true install spmi_devres /bin/true install sprd_serial /bin/true install sps30 /bin/true install sps30_i2c /bin/true install sps30_serial /bin/true install sr9700 /bin/true install sr9800 /bin/true install srf04 /bin/true install srf08 /bin/true install ssb /bin/true install ssb_hcd /bin/true install ssd1307fb /bin/true install ssd130x /bin/true install ssd130x_i2c /bin/true install ssd130x_spi /bin/true install ssfdc /bin/true install ssp_accel_sensor /bin/true install ssp_gyro_sensor /bin/true install ssp_iio /bin/true install sst25l /bin/true install sstfb /bin/true install ssu100 /bin/true install st /bin/true install st1232 /bin/true install st21nfca_hci /bin/true install st21nfca_i2c /bin/true install st7586 /bin/true install st7735r /bin/true install st95hf /bin/true install st_accel /bin/true install st_accel_i2c /bin/true install st_accel_spi /bin/true install st_drv /bin/true install st_gyro /bin/true install st_gyro_i2c /bin/true install st_gyro_spi /bin/true install st_lsm6dsx /bin/true install st_lsm6dsx_i2c /bin/true install st_lsm6dsx_i3c /bin/true install st_lsm6dsx_spi /bin/true install st_lsm9ds0 /bin/true install st_lsm9ds0_i2c /bin/true install st_lsm9ds0_spi /bin/true install st_magn /bin/true install st_magn_i2c /bin/true install st_magn_spi /bin/true install st_mipid02 /bin/true install st_nci /bin/true install st_nci_i2c /bin/true install st_nci_spi /bin/true install st_pressure /bin/true install st_pressure_i2c /bin/true install st_pressure_spi /bin/true install st_sensors /bin/true install st_sensors_i2c /bin/true install st_sensors_spi /bin/true install st_uvis25_core /bin/true install st_uvis25_i2c /bin/true install st_uvis25_spi /bin/true install starfire /bin/true install stb0899 /bin/true install stb6000 /bin/true install stb6100 /bin/true install ste10Xp /bin/true install stex /bin/true install stinger /bin/true install stk1160 /bin/true install stk3310 /bin/true install stk8312 /bin/true install stk8ba50 /bin/true install stm_console /bin/true install stm_core /bin/true install stm_ftrace /bin/true install stm_heartbeat /bin/true install stm_p_basic /bin/true install stm_p_sys_t /bin/true install stmfts /bin/true install stmmac /bin/true install stmmac_pci /bin/true install stmmac_platform /bin/true install stowaway /bin/true install stpddc60 /bin/true install streamzap /bin/true install streebog_generic /bin/true install stts751 /bin/true install stusb160x /bin/true install stv0288 /bin/true install stv0297 /bin/true install stv0299 /bin/true install stv0367 /bin/true install stv0900 /bin/true install stv090x /bin/true install stv0910 /bin/true install stv6110 /bin/true install stv6110x /bin/true install stv6111 /bin/true install stx104 /bin/true install sundance /bin/true install sungem /bin/true install sungem_phy /bin/true install sunhme /bin/true install suni /bin/true install sunkbd /bin/true install sunrise_co2 /bin/true install sunrpc /bin/true install sur40 /bin/true install surface3_power /bin/true install surface3_spi /bin/true install surface3_wmi /bin/true install surface_acpi_notify /bin/true install surface_aggregator /bin/true install surface_aggregator_cdev /bin/true install surface_aggregator_hub /bin/true install surface_aggregator_registry /bin/true install surface_aggregator_tabletsw /bin/true install surface_battery /bin/true install surface_charger /bin/true install surface_dtx /bin/true install surface_gpe /bin/true install surface_hid /bin/true install surface_hid_core /bin/true install surface_hotplug /bin/true install surface_kbd /bin/true install surface_platform_profile /bin/true install surfacepro3_button /bin/true install svc_i3c_master /bin/true install svgalib /bin/true install switchtec /bin/true install sx8654 /bin/true install sx9310 /bin/true install sx9324 /bin/true install sx9360 /bin/true install sx9500 /bin/true install sx_common /bin/true install sy7636a_hwmon /bin/true install sy7636a_regulator /bin/true install sym53c500_cs /bin/true install sym53c8xx /bin/true install symbolserial /bin/true install synaptics_i2c /bin/true install synaptics_usb /bin/true install system76_acpi /bin/true install sysv /bin/true install t5403 /bin/true install tag_ar9331 /bin/true install tag_brcm /bin/true install tag_dsa /bin/true install tag_gswip /bin/true install tag_hellcreek /bin/true install tag_ksz /bin/true install tag_lan9303 /bin/true install tag_mtk /bin/true install tag_none /bin/true install tag_ocelot /bin/true install tag_ocelot_8021q /bin/true install tag_qca /bin/true install tag_rtl4_a /bin/true install tag_rtl8_4 /bin/true install tag_rzn1_a5psw /bin/true install tag_sja1105 /bin/true install tag_trailer /bin/true install tag_xrs700x /bin/true install tap /bin/true install target_core_file /bin/true install target_core_iblock /bin/true install target_core_mod /bin/true install target_core_pscsi /bin/true install target_core_user /bin/true install tc358743 /bin/true install tc358746 /bin/true install tc654 /bin/true install tc74 /bin/true install tc90522 /bin/true install tc_dwc_g210 /bin/true install tc_dwc_g210_pci /bin/true install tca6416_keypad /bin/true install tca8418_keypad /bin/true install tcan4x5x /bin/true install tcm_fc /bin/true install tcm_loop /bin/true install tcm_qla2xxx /bin/true install tcm_remote /bin/true install tcm_usb_gadget /bin/true install tcp_bbr /bin/true install tcp_bic /bin/true install tcp_cdg /bin/true install tcp_dctcp /bin/true install tcp_highspeed /bin/true install tcp_htcp /bin/true install tcp_hybla /bin/true install tcp_illinois /bin/true install tcp_lp /bin/true install tcp_nv /bin/true install tcp_scalable /bin/true install tcp_vegas /bin/true install tcp_veno /bin/true install tcp_westwood /bin/true install tcp_yeah /bin/true install tcpci /bin/true install tcpci_maxim /bin/true install tcpci_mt6360 /bin/true install tcpci_mt6370 /bin/true install tcpci_rt1711h /bin/true install tcpm /bin/true install tcrypt /bin/true install tcs3414 /bin/true install tcs3472 /bin/true install tda10021 /bin/true install tda10023 /bin/true install tda10048 /bin/true install tda1004x /bin/true install tda10071 /bin/true install tda10086 /bin/true install tda18212 /bin/true install tda18218 /bin/true install tda18250 /bin/true install tda18271 /bin/true install tda18271c2dd /bin/true install tda1997x /bin/true install tda38640 /bin/true install tda665x /bin/true install tda7432 /bin/true install tda8083 /bin/true install tda8261 /bin/true install tda826x /bin/true install tda827x /bin/true install tda8290 /bin/true install tda9840 /bin/true install tda9887 /bin/true install tda9950 /bin/true install tda998x /bin/true install tdfxfb /bin/true install tdo24m /bin/true install tdx_guest /bin/true install tea575x /bin/true install tea5761 /bin/true install tea5767 /bin/true install tea6415c /bin/true install tea6420 /bin/true install team /bin/true install team_mode_activebackup /bin/true install team_mode_broadcast /bin/true install team_mode_loadbalance /bin/true install team_mode_random /bin/true install team_mode_roundrobin /bin/true install tee /bin/true install tef6862 /bin/true install tehuti /bin/true install teranetics /bin/true install test_blackhole_dev /bin/true install test_bpf /bin/true install test_power /bin/true install thermal_generic_adc /bin/true install think_lmi /bin/true install thinkpad_acpi /bin/true install thmc50 /bin/true install thp7312 /bin/true install ths7303 /bin/true install ths8200 /bin/true install thunder_bgx /bin/true install thunder_xcv /bin/true install thunderbolt /bin/true install thunderbolt_net /bin/true install ti_adc081c /bin/true install ti_adc0832 /bin/true install ti_adc084s021 /bin/true install ti_adc108s102 /bin/true install ti_adc12138 /bin/true install ti_adc128s052 /bin/true install ti_adc161s626 /bin/true install ti_ads1015 /bin/true install ti_ads1100 /bin/true install ti_ads124s08 /bin/true install ti_ads131e08 /bin/true install ti_ads7924 /bin/true install ti_ads7950 /bin/true install ti_ads8344 /bin/true install ti_ads8688 /bin/true install ti_dac082s085 /bin/true install ti_dac5571 /bin/true install ti_dac7311 /bin/true install ti_dac7612 /bin/true install ti_lmp92064 /bin/true install ti_lmu /bin/true install ti_tlc4541 /bin/true install ti_tsc2046 /bin/true install ti_usb_3410_5052 /bin/true install tifm_7xx1 /bin/true install tifm_core /bin/true install tifm_ms /bin/true install tifm_sd /bin/true install timeriomem_rng /bin/true install tipc /bin/true install tlan /bin/true install tlclk /bin/true install tlv320aic23b /bin/true install tm2_touchkey /bin/true install tmag5273 /bin/true install tmdc /bin/true install tmp006 /bin/true install tmp007 /bin/true install tmp102 /bin/true install tmp103 /bin/true install tmp108 /bin/true install tmp117 /bin/true install tmp401 /bin/true install tmp421 /bin/true install tmp464 /bin/true install tmp513 /bin/true install topstar_laptop /bin/true install toshiba_acpi /bin/true install toshiba_bluetooth /bin/true install toshiba_haps /bin/true install toshsd /bin/true install touchit213 /bin/true install touchright /bin/true install touchwin /bin/true install tpci200 /bin/true install tpl0102 /bin/true install tpm_atmel /bin/true install tpm_i2c_atmel /bin/true install tpm_i2c_infineon /bin/true install tpm_i2c_nuvoton /bin/true install tpm_infineon /bin/true install tpm_nsc /bin/true install tpm_st33zp24 /bin/true install tpm_st33zp24_i2c /bin/true install tpm_st33zp24_spi /bin/true install tpm_tis_i2c /bin/true install tpm_tis_i2c_cr50 /bin/true install tpm_tis_spi /bin/true install tpm_vtpm_proxy /bin/true install tps23861 /bin/true install tps40422 /bin/true install tps51632_regulator /bin/true install tps53679 /bin/true install tps546d24 /bin/true install tps6105x /bin/true install tps6105x_regulator /bin/true install tps62360_regulator /bin/true install tps65010 /bin/true install tps65023_regulator /bin/true install tps6507x /bin/true install tps6507x_regulator /bin/true install tps6507x_ts /bin/true install tps65086 /bin/true install tps65086_regulator /bin/true install tps65090_charger /bin/true install tps65090_regulator /bin/true install tps65132_regulator /bin/true install tps6524x_regulator /bin/true install tps6586x_regulator /bin/true install tps65910_regulator /bin/true install tps65912_regulator /bin/true install tps6594_core /bin/true install tps6594_esm /bin/true install tps6594_i2c /bin/true install tps6594_pfsm /bin/true install tps6594_spi /bin/true install tps6598x /bin/true install tps68470_regulator /bin/true install tqmx86 /bin/true install tqmx86_wdt /bin/true install trace_printk /bin/true install trancevibrator /bin/true install trf7970a /bin/true install tridentfb /bin/true install ts2020 /bin/true install ts_bm /bin/true install ts_fsm /bin/true install ts_kmp /bin/true install tsc2004 /bin/true install tsc2005 /bin/true install tsc2007 /bin/true install tsc200x_core /bin/true install tsc40 /bin/true install tsi721_mport /bin/true install tsl2550 /bin/true install tsl2563 /bin/true install tsl2583 /bin/true install tsl2591 /bin/true install tsl2772 /bin/true install tsl4531 /bin/true install tsm /bin/true install tsnep /bin/true install tsys01 /bin/true install tsys02d /bin/true install ttpci_eeprom /bin/true install ttusb_dec /bin/true install ttusbdecfe /bin/true install ttusbir /bin/true install ttynull /bin/true install tua6100 /bin/true install tua9001 /bin/true install tulip /bin/true install tuner /bin/true install tuner_simple /bin/true install tuner_types /bin/true install tunnel4 /bin/true install tunnel6 /bin/true install turbografx /bin/true install tvaudio /bin/true install tveeprom /bin/true install tvp514x /bin/true install tvp5150 /bin/true install tvp7002 /bin/true install tw2804 /bin/true install tw5864 /bin/true install tw68 /bin/true install tw686x /bin/true install tw9900 /bin/true install tw9903 /bin/true install tw9906 /bin/true install tw9910 /bin/true install twidjoy /bin/true install twl4030_charger /bin/true install twl4030_keypad /bin/true install twl4030_madc /bin/true install twl4030_madc_battery /bin/true install twl4030_pwrbutton /bin/true install twl4030_vibra /bin/true install twl4030_wdt /bin/true install twl6030_gpadc /bin/true install twl6030_regulator /bin/true install twl6040_vibra /bin/true install twl_regulator /bin/true install twofish_avx_x86_64 /bin/true install twofish_common /bin/true install twofish_generic /bin/true install twofish_x86_64 /bin/true install twofish_x86_64_3way /bin/true install txgbe /bin/true install typec /bin/true install typec_displayport /bin/true install typec_nvidia /bin/true install typec_ucsi /bin/true install typec_wcove /bin/true install typhoon /bin/true install uPD60620 /bin/true install u_audio /bin/true install u_ether /bin/true install u_serial /bin/true install uacce /bin/true install uartlite /bin/true install ubi /bin/true install ubifs /bin/true install ublk_drv /bin/true install ubuntu_host /bin/true install ucan /bin/true install ucd9000 /bin/true install ucd9200 /bin/true install ucsi_acpi /bin/true install ucsi_ccg /bin/true install ucsi_stm32g0 /bin/true install uda1342 /bin/true install udc_core /bin/true install udf /bin/true install udl /bin/true install udlfb /bin/true install ueagle_atm /bin/true install ufs /bin/true install ufshcd_core /bin/true install ufshcd_dwc /bin/true install ufshcd_pci /bin/true install ufshcd_pltfrm /bin/true install ug3105_battery /bin/true install uhid /bin/true install uio /bin/true install uio_aec /bin/true install uio_cif /bin/true install uio_dfl /bin/true install uio_dmem_genirq /bin/true install uio_hv_generic /bin/true install uio_mf624 /bin/true install uio_netx /bin/true install uio_pci_generic /bin/true install uio_pdrv_genirq /bin/true install uio_pruss /bin/true install uio_sercos3 /bin/true install uleds /bin/true install uli526x /bin/true install ulpi /bin/true install ums_alauda /bin/true install ums_cypress /bin/true install ums_datafab /bin/true install ums_eneub6250 /bin/true install ums_freecom /bin/true install ums_isd200 /bin/true install ums_jumpshot /bin/true install ums_karma /bin/true install ums_onetouch /bin/true install ums_realtek /bin/true install ums_sddr09 /bin/true install ums_sddr55 /bin/true install ums_usbat /bin/true install unix_diag /bin/true install upd64031a /bin/true install upd64083 /bin/true install upd78f0730 /bin/true install us5182d /bin/true install usb251xb /bin/true install usb3503 /bin/true install usb4604 /bin/true install usb8xxx /bin/true install usb_8dev /bin/true install usb_conn_gpio /bin/true install usb_debug /bin/true install usb_f_acm /bin/true install usb_f_ecm /bin/true install usb_f_ecm_subset /bin/true install usb_f_eem /bin/true install usb_f_fs /bin/true install usb_f_hid /bin/true install usb_f_mass_storage /bin/true install usb_f_midi /bin/true install usb_f_midi2 /bin/true install usb_f_ncm /bin/true install usb_f_obex /bin/true install usb_f_phonet /bin/true install usb_f_printer /bin/true install usb_f_rndis /bin/true install usb_f_serial /bin/true install usb_f_ss_lb /bin/true install usb_f_tcm /bin/true install usb_f_uac1 /bin/true install usb_f_uac1_legacy /bin/true install usb_f_uac2 /bin/true install usb_f_uvc /bin/true install usb_ljca /bin/true install usb_serial_simple /bin/true install usb_wwan /bin/true install usbatm /bin/true install usbdux /bin/true install usbduxfast /bin/true install usbduxsigma /bin/true install usbip_core /bin/true install usbip_host /bin/true install usbip_vudc /bin/true install usbkbd /bin/true install usblcd /bin/true install usblp /bin/true install usbmon /bin/true install usbmouse /bin/true install usbnet /bin/true install usbserial /bin/true install usbsevseg /bin/true install usbtest /bin/true install usbtmc /bin/true install usbtouchscreen /bin/true install usbtv /bin/true install usdhi6rol0 /bin/true install userio /bin/true install userspace_consumer /bin/true install ushc /bin/true install usnic_verbs /bin/true install uss720 /bin/true install uv_mmtimer /bin/true install uv_sysfs /bin/true install uvc /bin/true install uvcvideo /bin/true install uvesafb /bin/true install v4l2_async /bin/true install v4l2_cci /bin/true install v4l2_dv_timings /bin/true install v4l2_flash_led_class /bin/true install v4l2_fwnode /bin/true install v4l2_mem2mem /bin/true install v4l2_tpg /bin/true install v4l2loopback /bin/true install vboxguest /bin/true install vboxsf /bin/true install vboxvideo /bin/true install vcan /bin/true install vcnl3020 /bin/true install vcnl4000 /bin/true install vcnl4035 /bin/true install vdpa /bin/true install vdpa_sim /bin/true install vdpa_sim_blk /bin/true install vdpa_sim_net /bin/true install vduse /bin/true install veml6030 /bin/true install veml6070 /bin/true install veml6075 /bin/true install ves1820 /bin/true install ves1x93 /bin/true install vf610_adc /bin/true install vf610_dac /bin/true install vfio /bin/true install vfio_iommu_type1 /bin/true install vfio_pci /bin/true install vfio_pci_core /bin/true install vga16fb /bin/true install vgastate /bin/true install vgem /bin/true install vgg2432a4 /bin/true install vhci_hcd /bin/true install vhost /bin/true install vhost_iotlb /bin/true install vhost_net /bin/true install vhost_scsi /bin/true install vhost_vdpa /bin/true install vhost_vsock /bin/true install via686a /bin/true install via_camera /bin/true install via_cputemp /bin/true install via_rhine /bin/true install via_rng /bin/true install via_sdmmc /bin/true install via_velocity /bin/true install via_wdt /bin/true install viafb /bin/true install vicodec /bin/true install video /bin/true install video_i2c /bin/true install videobuf2_common /bin/true install videobuf2_dma_contig /bin/true install videobuf2_dma_sg /bin/true install videobuf2_dvb /bin/true install videobuf2_memops /bin/true install videobuf2_v4l2 /bin/true install videobuf2_vmalloc /bin/true install videodev /bin/true install vim2m /bin/true install vimc /bin/true install viperboard /bin/true install viperboard_adc /bin/true install virt_wifi /bin/true install virtio_bt /bin/true install virtio_crypto /bin/true install virtio_dma_buf /bin/true install virtio_gpu /bin/true install virtio_input /bin/true install virtio_mem /bin/true install virtio_pmem /bin/true install virtio_rpmsg_bus /bin/true install virtio_snd /bin/true install virtio_vdpa /bin/true install virtio_vfio_pci /bin/true install virtiofs /bin/true install virtual /bin/true install virtual_ncidev /bin/true install visl /bin/true install visor /bin/true install vitesse /bin/true install vitesse_vsc73xx_core /bin/true install vitesse_vsc73xx_platform /bin/true install vitesse_vsc73xx_spi /bin/true install vivid /bin/true install vkms /bin/true install vl53l0x_i2c /bin/true install vl6180 /bin/true install vmac /bin/true install vmd /bin/true install vme_fake /bin/true install vme_tsi148 /bin/true install vme_user /bin/true install vmk80xx /bin/true install vmw_balloon /bin/true install vmw_pvrdma /bin/true install vmw_pvscsi /bin/true install vmw_vmci /bin/true install vmw_vsock_virtio_transport /bin/true install vmw_vsock_virtio_transport_common /bin/true install vmw_vsock_vmci_transport /bin/true install vmwgfx /bin/true install vmxnet3 /bin/true install vp27smpx /bin/true install vp_vdpa /bin/true install vport_geneve /bin/true install vport_gre /bin/true install vport_vxlan /bin/true install vpx3220 /bin/true install vrf /bin/true install vringh /bin/true install vsock /bin/true install vsock_diag /bin/true install vsock_loopback /bin/true install vsockmon /bin/true install vsxxxaa /bin/true install vt1211 /bin/true install vt6655_stage /bin/true install vt6656_stage /bin/true install vt8231 /bin/true install vt8623fb /bin/true install vub300 /bin/true install vx855 /bin/true install vxcan /bin/true install vz89x /bin/true install w1_ds2405 /bin/true install w1_ds2406 /bin/true install w1_ds2408 /bin/true install w1_ds2413 /bin/true install w1_ds2423 /bin/true install w1_ds2430 /bin/true install w1_ds2431 /bin/true install w1_ds2433 /bin/true install w1_ds2438 /bin/true install w1_ds250x /bin/true install w1_ds2780 /bin/true install w1_ds2781 /bin/true install w1_ds2805 /bin/true install w1_ds28e04 /bin/true install w1_ds28e17 /bin/true install w1_gpio /bin/true install w1_smem /bin/true install w1_therm /bin/true install w5100 /bin/true install w5100_spi /bin/true install w5300 /bin/true install w6692 /bin/true install w83627ehf /bin/true install w83627hf /bin/true install w83627hf_wdt /bin/true install w83773g /bin/true install w83781d /bin/true install w83791d /bin/true install w83792d /bin/true install w83793 /bin/true install w83795 /bin/true install w83877f_wdt /bin/true install w83977f_wdt /bin/true install w83l785ts /bin/true install w83l786ng /bin/true install wacom /bin/true install wacom_i2c /bin/true install wacom_serial4 /bin/true install wacom_w8001 /bin/true install wafer5823wdt /bin/true install walkera0701 /bin/true install wanxl /bin/true install warrior /bin/true install wbsd /bin/true install wcd934x /bin/true install wcd939x_usbss /bin/true install wcn36xx /bin/true install wd719x /bin/true install wdat_wdt /bin/true install wdt87xx_i2c /bin/true install wdt_pci /bin/true install wfx /bin/true install whiteheat /bin/true install wil6210 /bin/true install wilc1000 /bin/true install wilc1000_sdio /bin/true install wilc1000_spi /bin/true install wilco_charger /bin/true install wilco_ec /bin/true install wilco_ec_debugfs /bin/true install wilco_ec_events /bin/true install wilco_ec_telem /bin/true install winbond_840 /bin/true install winbond_cir /bin/true install winmate_fm07_keys /bin/true install wire /bin/true install wireguard /bin/true install wireless_hotkey /bin/true install wishbone_serial /bin/true install wl1251 /bin/true install wl1251_sdio /bin/true install wl1251_spi /bin/true install wl1273_core /bin/true install wl12xx /bin/true install wl18xx /bin/true install wlcore /bin/true install wlcore_sdio /bin/true install wm831x_backup /bin/true install wm831x_bl /bin/true install wm831x_dcdc /bin/true install wm831x_hwmon /bin/true install wm831x_isink /bin/true install wm831x_ldo /bin/true install wm831x_on /bin/true install wm831x_power /bin/true install wm831x_ts /bin/true install wm831x_wdt /bin/true install wm8350_hwmon /bin/true install wm8350_power /bin/true install wm8350_regulator /bin/true install wm8350_wdt /bin/true install wm8400_regulator /bin/true install wm8739 /bin/true install wm8775 /bin/true install wm8994 /bin/true install wm8994_regulator /bin/true install wm97xx_ts /bin/true install wmi /bin/true install wmi_bmof /bin/true install wp512 /bin/true install wpcm450_soc /bin/true install wusb3801 /bin/true install wwan /bin/true install wwan_hwsim /bin/true install x25 /bin/true install x38_edac /bin/true install x86_android_tablets /bin/true install x86_pkg_temp_thermal /bin/true install x9250 /bin/true install xbox_remote /bin/true install xc2028 /bin/true install xc4000 /bin/true install xc5000 /bin/true install xcbc /bin/true install xctr /bin/true install xdma /bin/true install xdpe12284 /bin/true install xdpe152c4 /bin/true install xe /bin/true install xen_blkback /bin/true install xen_evtchn /bin/true install xen_fbfront /bin/true install xen_front_pgdir_shbuf /bin/true install xen_gntalloc /bin/true install xen_gntdev /bin/true install xen_hcd /bin/true install xen_kbdfront /bin/true install xen_netback /bin/true install xen_pciback /bin/true install xen_pcifront /bin/true install xen_privcmd /bin/true install xen_scsiback /bin/true install xen_scsifront /bin/true install xen_tpmfront /bin/true install xen_wdt /bin/true install xenfs /bin/true install xfrm4_tunnel /bin/true install xfrm6_tunnel /bin/true install xfrm_compat /bin/true install xfrm_interface /bin/true install xfrm_ipcomp /bin/true install xgene_hwmon /bin/true install xhci_pci /bin/true install xhci_pci_renesas /bin/true install xhci_plat_hcd /bin/true install xiaomi_wmi /bin/true install xilinx_dma /bin/true install xilinx_emac /bin/true install xilinx_emaclite /bin/true install xilinx_gmii2rgmii /bin/true install xilinx_pr_decoupler /bin/true install xilinx_sdfec /bin/true install xilinx_spi /bin/true install xilinx_xadc /bin/true install xillybus_class /bin/true install xillybus_core /bin/true install xillybus_pcie /bin/true install xillyusb /bin/true install xiphera_trng /bin/true install xirc2ps_cs /bin/true install xircom_cb /bin/true install xlnx_vcu /bin/true install xor /bin/true install xp /bin/true install xpad /bin/true install xpc /bin/true install xpnet /bin/true install xr_serial /bin/true install xrs700x /bin/true install xrs700x_i2c /bin/true install xrs700x_mdio /bin/true install xsens_mt /bin/true install xsk_diag /bin/true install xt_AUDIT /bin/true install xt_CHECKSUM /bin/true install xt_CLASSIFY /bin/true install xt_CONNSECMARK /bin/true install xt_CT /bin/true install xt_DSCP /bin/true install xt_HL /bin/true install xt_HMARK /bin/true install xt_IDLETIMER /bin/true install xt_LED /bin/true install xt_NETMAP /bin/true install xt_NFLOG /bin/true install xt_NFQUEUE /bin/true install xt_RATEEST /bin/true install xt_REDIRECT /bin/true install xt_SECMARK /bin/true install xt_TCPMSS /bin/true install xt_TCPOPTSTRIP /bin/true install xt_TEE /bin/true install xt_TPROXY /bin/true install xt_TRACE /bin/true install xt_bpf /bin/true install xt_cgroup /bin/true install xt_cluster /bin/true install xt_comment /bin/true install xt_connbytes /bin/true install xt_connlabel /bin/true install xt_connlimit /bin/true install xt_connmark /bin/true install xt_cpu /bin/true install xt_dccp /bin/true install xt_devgroup /bin/true install xt_dscp /bin/true install xt_ecn /bin/true install xt_esp /bin/true install xt_hashlimit /bin/true install xt_helper /bin/true install xt_ipcomp /bin/true install xt_iprange /bin/true install xt_ipvs /bin/true install xt_l2tp /bin/true install xt_length /bin/true install xt_mac /bin/true install xt_mark /bin/true install xt_multiport /bin/true install xt_nat /bin/true install xt_nfacct /bin/true install xt_osf /bin/true install xt_owner /bin/true install xt_physdev /bin/true install xt_pkttype /bin/true install xt_policy /bin/true install xt_quota /bin/true install xt_rateest /bin/true install xt_realm /bin/true install xt_sctp /bin/true install xt_socket /bin/true install xt_state /bin/true install xt_statistic /bin/true install xt_string /bin/true install xt_tcpmss /bin/true install xt_time /bin/true install xt_u32 /bin/true install xtkbd /bin/true install xusbatm /bin/true install xxhash_generic /bin/true install xz_dec_test /bin/true install yam /bin/true install yamaha_yas530 /bin/true install yealink /bin/true install yellowfin /bin/true install yenta_socket /bin/true install yurex /bin/true install z3fold /bin/true install zaurus /bin/true install zd1211rw /bin/true install zd1301 /bin/true install zd1301_demod /bin/true install zet6223 /bin/true install zforce_ts /bin/true install zfs /bin/true install zhenhua /bin/true install ziirave_wdt /bin/true install zinitix /bin/true install zl10036 /bin/true install zl10039 /bin/true install zl10353 /bin/true install zl6100 /bin/true install zonefs /bin/true install zopt2201 /bin/true install zpa2326 /bin/true install zpa2326_i2c /bin/true install zpa2326_spi /bin/true install zram /bin/true install zstd /bin/true jnuyens-modulejail-06d8d74/tests/fixtures/v1.1.4-regression/kver000066400000000000000000000000221520651617500246060ustar00rootroot000000000000006.8.0-110-generic jnuyens-modulejail-06d8d74/tests/fixtures/v1.1.4-regression/modules-list000066400000000000000000003525161520651617500263020ustar00rootroot00000000000000104-quad-8.ko.zst 3c574_cs.ko.zst 3c589_cs.ko.zst 3c59x.ko.zst 3w-9xxx.ko.zst 3w-sas.ko.zst 3w-xxxx.ko.zst 6lowpan.ko.zst 6pack.ko.zst 8021q.ko.zst 8139cp.ko.zst 8139too.ko.zst 8250_dfl.ko.zst 8250_dw.ko.zst 8250_exar.ko.zst 8250_lpss.ko.zst 8250_men_mcb.ko.zst 8250_pci1xxxx.ko.zst 8250_pericom.ko.zst 8255.ko.zst 8255_pci.ko.zst 8390.ko.zst 842.ko.zst 842_compress.ko.zst 842_decompress.ko.zst 88pg86x.ko.zst 88pm800-regulator.ko.zst 88pm800.ko.zst 88pm805.ko.zst 88pm80x.ko.zst 88pm80x_onkey.ko.zst 88pm8607.ko.zst 88pm860x-ts.ko.zst 88pm860x_battery.ko.zst 88pm860x_bl.ko.zst 88pm860x_charger.ko.zst 88pm860x_onkey.ko.zst 9p.ko.zst 9pnet.ko.zst 9pnet_fd.ko.zst 9pnet_rdma.ko.zst 9pnet_virtio.ko.zst 9pnet_xen.ko.zst BusLogic.ko.zst a100u2w.ko.zst a3d.ko.zst a8293.ko.zst aacraid.ko.zst aat2870-regulator.ko.zst aat2870_bl.ko.zst abituguru.ko.zst abituguru3.ko.zst abp060mg.ko.zst ac97_bus.ko.zst acard-ahci.ko.zst acbel-fsg032.ko.zst acecad.ko.zst acenic.ko.zst acer-wireless.ko.zst acer-wmi.ko.zst acerhdf.ko.zst acp_audio_dma.ko.zst acpi-als.ko.zst acpi_configfs.ko.zst acpi_extlog.ko.zst acpi_ipmi.ko.zst acpi_pad.ko.zst acpi_power_meter.ko.zst acpi_tad.ko.zst acpi_thermal_rel.ko.zst acpiphp_ibm.ko.zst acquirewdt.ko.zst acrn.ko.zst act8865-regulator.ko.zst act_bpf.ko.zst act_connmark.ko.zst act_csum.ko.zst act_ct.ko.zst act_ctinfo.ko.zst act_gact.ko.zst act_gate.ko.zst act_mirred.ko.zst act_mpls.ko.zst act_nat.ko.zst act_pedit.ko.zst act_police.ko.zst act_sample.ko.zst act_simple.ko.zst act_skbedit.ko.zst act_skbmod.ko.zst act_tunnel_key.ko.zst act_vlan.ko.zst ad2s1200.ko.zst ad2s1210.ko.zst ad2s90.ko.zst ad3552r.ko.zst ad4130.ko.zst ad5064.ko.zst ad5110.ko.zst ad525x_dpot-i2c.ko.zst ad525x_dpot-spi.ko.zst ad525x_dpot.ko.zst ad5272.ko.zst ad5360.ko.zst ad5380.ko.zst ad5398.ko.zst ad5421.ko.zst ad5446.ko.zst ad5449.ko.zst ad5504.ko.zst ad5592r-base.ko.zst ad5592r.ko.zst ad5593r.ko.zst ad5624r_spi.ko.zst ad5686-spi.ko.zst ad5686.ko.zst ad5696-i2c.ko.zst ad5755.ko.zst ad5758.ko.zst ad5761.ko.zst ad5764.ko.zst ad5766.ko.zst ad5770r.ko.zst ad5791.ko.zst ad5820.ko.zst ad5933.ko.zst ad7091r-base.ko.zst ad7091r5.ko.zst ad7091r8.ko.zst ad7124.ko.zst ad714x-i2c.ko.zst ad714x-spi.ko.zst ad714x.ko.zst ad7150.ko.zst ad7192.ko.zst ad7266.ko.zst ad7280a.ko.zst ad7291.ko.zst ad7292.ko.zst ad7293.ko.zst ad7298.ko.zst ad7303.ko.zst ad7314.ko.zst ad74115.ko.zst ad7414.ko.zst ad7418.ko.zst ad74413r.ko.zst ad7476.ko.zst ad7606.ko.zst ad7606_par.ko.zst ad7606_spi.ko.zst ad7746.ko.zst ad7766.ko.zst ad7768-1.ko.zst ad7780.ko.zst ad7791.ko.zst ad7793.ko.zst ad7816.ko.zst ad7877.ko.zst ad7879-i2c.ko.zst ad7879-spi.ko.zst ad7879.ko.zst ad7887.ko.zst ad7923.ko.zst ad7949.ko.zst ad799x.ko.zst ad8366.ko.zst ad8801.ko.zst ad9467.ko.zst ad9523.ko.zst ad9832.ko.zst ad9834.ko.zst ad_sigma_delta.ko.zst ada4250.ko.zst adafruit-seesaw.ko.zst adc-joystick.ko.zst adc-keys.ko.zst adc128d818.ko.zst adcxx.ko.zst addi_apci_1032.ko.zst addi_apci_1500.ko.zst addi_apci_1516.ko.zst addi_apci_1564.ko.zst addi_apci_16xx.ko.zst addi_apci_2032.ko.zst addi_apci_2200.ko.zst addi_apci_3120.ko.zst addi_apci_3501.ko.zst addi_apci_3xxx.ko.zst addi_watchdog.ko.zst adf4350.ko.zst adf4371.ko.zst adf4377.ko.zst adf7242.ko.zst adfs.ko.zst adi-axi-adc.ko.zst adi.ko.zst adiantum.ko.zst adin.ko.zst adin1100.ko.zst adin1110.ko.zst adis16080.ko.zst adis16130.ko.zst adis16136.ko.zst adis16201.ko.zst adis16203.ko.zst adis16209.ko.zst adis16240.ko.zst adis16260.ko.zst adis16400.ko.zst adis16460.ko.zst adis16475.ko.zst adis16480.ko.zst adis_lib.ko.zst adjd_s311.ko.zst adl_pci6208.ko.zst adl_pci7x3x.ko.zst adl_pci8164.ko.zst adl_pci9111.ko.zst adl_pci9118.ko.zst adm1025.ko.zst adm1026.ko.zst adm1029.ko.zst adm1031.ko.zst adm1177.ko.zst adm1266.ko.zst adm1275.ko.zst adm8211.ko.zst adm9240.ko.zst admv1013.ko.zst admv1014.ko.zst admv4420.ko.zst admv8818.ko.zst adp1653.ko.zst adp5061.ko.zst adp5520-keys.ko.zst adp5520_bl.ko.zst adp5588-keys.ko.zst adp5589-keys.ko.zst adp8860_bl.ko.zst adp8870_bl.ko.zst adq12b.ko.zst adrf6780.ko.zst ads7828.ko.zst ads7846.ko.zst ads7871.ko.zst adt7310.ko.zst adt7316-i2c.ko.zst adt7316-spi.ko.zst adt7316.ko.zst adt7410.ko.zst adt7411.ko.zst adt7462.ko.zst adt7470.ko.zst adt7475.ko.zst adt7x10.ko.zst adummy.ko.zst adutux.ko.zst adux1020.ko.zst adv7170.ko.zst adv7175.ko.zst adv7180.ko.zst adv7183.ko.zst adv7343.ko.zst adv7393.ko.zst adv7511-v4l2.ko.zst adv7604.ko.zst adv7842.ko.zst adv_pci1710.ko.zst adv_pci1720.ko.zst adv_pci1723.ko.zst adv_pci1724.ko.zst adv_pci1760.ko.zst adv_pci_dio.ko.zst adv_swbutton.ko.zst advansys.ko.zst advantech_ec_wdt.ko.zst advantechwdt.ko.zst adxl313_core.ko.zst adxl313_i2c.ko.zst adxl313_spi.ko.zst adxl34x-i2c.ko.zst adxl34x-spi.ko.zst adxl34x.ko.zst adxl355_core.ko.zst adxl355_i2c.ko.zst adxl355_spi.ko.zst adxl367.ko.zst adxl367_i2c.ko.zst adxl367_spi.ko.zst adxl372.ko.zst adxl372_i2c.ko.zst adxl372_spi.ko.zst adxrs290.ko.zst adxrs450.ko.zst aegis128-aesni.ko.zst aegis128.ko.zst aes_ti.ko.zst aesni-intel.ko.zst af9013.ko.zst af9033.ko.zst af_alg.ko.zst af_key.ko.zst af_packet_diag.ko.zst afe4403.ko.zst afe4404.ko.zst affs.ko.zst ags02ma.ko.zst ah4.ko.zst ah6.ko.zst aha152x_cs.ko.zst ahci.ko.zst ahci_dwc.ko.zst ahci_platform.ko.zst aht10.ko.zst aic79xx.ko.zst aic7xxx.ko.zst aic94xx.ko.zst aio_aio12_8.ko.zst aio_iiro_16.ko.zst aiptek.ko.zst aircable.ko.zst airspy.ko.zst ak7375.ko.zst ak881x.ko.zst ak8974.ko.zst ak8975.ko.zst al3010.ko.zst al3320a.ko.zst alcor.ko.zst alcor_pci.ko.zst algif_aead.ko.zst algif_hash.ko.zst algif_rng.ko.zst algif_skcipher.ko.zst alienware-wmi.ko.zst alim1535_wdt.ko.zst alim7101_wdt.ko.zst altera-ci.ko.zst altera-cvp.ko.zst altera-freeze-bridge.ko.zst altera-msgdma.ko.zst altera-pr-ip-core.ko.zst altera-ps-spi.ko.zst altera-stapl.ko.zst altera_jtaguart.ko.zst altera_ps2.ko.zst altera_tse.ko.zst altera_uart.ko.zst alvium-csi2.ko.zst alx.ko.zst am2315.ko.zst am53c974.ko.zst amc6821.ko.zst amd-pmc.ko.zst amd-pmf.ko.zst amd-rng.ko.zst amd-uncore.ko.zst amd-xgbe.ko.zst amd.ko.zst amd5536udc_pci.ko.zst amd64_edac.ko.zst amd76xrom.ko.zst amd8111e.ko.zst amd_axi_w1.ko.zst amd_freq_sensitivity.ko.zst amd_hsmp.ko.zst amd_sfh.ko.zst amdgpu.ko.zst amdtee.ko.zst amdxcp.ko.zst amilo-rfkill.ko.zst amlogic-gxl-crypto.ko.zst amplc_dio200.ko.zst amplc_dio200_common.ko.zst amplc_dio200_pci.ko.zst amplc_pc236.ko.zst amplc_pc236_common.ko.zst amplc_pc263.ko.zst amplc_pci224.ko.zst amplc_pci230.ko.zst amplc_pci236.ko.zst amplc_pci263.ko.zst ams-iaq-core.ko.zst ams369fg06.ko.zst amt.ko.zst analog.ko.zst analogix-anx78xx.ko.zst analogix_dp.ko.zst ansi_cprng.ko.zst anx7411.ko.zst aoe.ko.zst apanel.ko.zst apds9300.ko.zst apds9802als.ko.zst apds990x.ko.zst apds9960.ko.zst apple-gmux.ko.zst apple-mfi-fastcharge.ko.zst apple_bl.ko.zst appledisplay.ko.zst applesmc.ko.zst applespi.ko.zst appletalk.ko.zst appletouch.ko.zst applicom.ko.zst aptina-pll.ko.zst aqc111.ko.zst aquacomputer_d5next.ko.zst aquantia.ko.zst ar0521.ko.zst ar5523.ko.zst ar9331.ko.zst arasan-nand-controller.ko.zst arc-rawmode.ko.zst arc-rimi.ko.zst arc_ps2.ko.zst arc_uart.ko.zst arcfb.ko.zst arcmsr.ko.zst arcnet.ko.zst arcxcnn_bl.ko.zst aria-aesni-avx-x86_64.ko.zst aria-aesni-avx2-x86_64.ko.zst aria-gfni-avx512-x86_64.ko.zst aria_generic.ko.zst arizona-haptics.ko.zst arizona-i2c.ko.zst arizona-ldo1.ko.zst arizona-micsupp.ko.zst arizona-spi.ko.zst arizona.ko.zst ark3116.ko.zst arkfb.ko.zst arp_tables.ko.zst arpt_mangle.ko.zst arptable_filter.ko.zst as102_fe.ko.zst as370-hwmon.ko.zst as3711-regulator.ko.zst as3711_bl.ko.zst as3935.ko.zst as5011.ko.zst as73211.ko.zst asb100.ko.zst asc7621.ko.zst ascot2e.ko.zst asix.ko.zst ast.ko.zst asus-ec-sensors.ko.zst asus-laptop.ko.zst asus-nb-wmi.ko.zst asus-tf103c-dock.ko.zst asus-wireless.ko.zst asus-wmi.ko.zst asus_atk0110.ko.zst asus_wmi_sensors.ko.zst async_memcpy.ko.zst async_pq.ko.zst async_raid6_recov.ko.zst async_tx.ko.zst async_xor.ko.zst at24.ko.zst at25.ko.zst at76c50x-usb.ko.zst at803x.ko.zst at86rf230.ko.zst atbm8830.ko.zst atc260x-core.ko.zst atc260x-i2c.ko.zst atc260x-onkey.ko.zst atc260x-poweroff.ko.zst atc260x-regulator.ko.zst aten.ko.zst ath.ko.zst ath10k_core.ko.zst ath10k_pci.ko.zst ath10k_sdio.ko.zst ath10k_usb.ko.zst ath11k.ko.zst ath11k_ahb.ko.zst ath11k_pci.ko.zst ath12k.ko.zst ath3k.ko.zst ath5k.ko.zst ath6kl_core.ko.zst ath6kl_sdio.ko.zst ath6kl_usb.ko.zst ath9k.ko.zst ath9k_common.ko.zst ath9k_htc.ko.zst ath9k_hw.ko.zst ath9k_pci_owl_loader.ko.zst ati_remote.ko.zst ati_remote2.ko.zst atl1.ko.zst atl1c.ko.zst atl1e.ko.zst atl2.ko.zst atlantic.ko.zst atlas-ezo-sensor.ko.zst atlas-sensor.ko.zst atlas_btns.ko.zst atm.ko.zst atmel-ecc.ko.zst atmel-i2c.ko.zst atmel-sha204a.ko.zst atmel_mxt_ts.ko.zst atmtcp.ko.zst atp.ko.zst atp870u.ko.zst atusb.ko.zst atxp1.ko.zst aty128fb.ko.zst atyfb.ko.zst au0828.ko.zst au8522_common.ko.zst au8522_decoder.ko.zst au8522_dig.ko.zst auo-pixcir-ts.ko.zst auth_rpcgss.ko.zst authenc.ko.zst authencesn.ko.zst autofs4.ko.zst avmfritz.ko.zst aw37503-regulator.ko.zst ax25.ko.zst ax88179_178a.ko.zst ax88796b.ko.zst ax88796c.ko.zst axi-fan-control.ko.zst axnet_cs.ko.zst axp20x-i2c.ko.zst axp20x-pek.ko.zst axp20x-regulator.ko.zst axp20x.ko.zst axp20x_ac_power.ko.zst axp20x_adc.ko.zst axp20x_battery.ko.zst axp20x_usb_power.ko.zst axp288_adc.ko.zst axp288_charger.ko.zst axp288_fuel_gauge.ko.zst b2c2-flexcop-pci.ko.zst b2c2-flexcop-usb.ko.zst b2c2-flexcop.ko.zst b43.ko.zst b43legacy.ko.zst b44.ko.zst b53_common.ko.zst b53_mdio.ko.zst b53_mmap.ko.zst b53_serdes.ko.zst b53_spi.ko.zst b53_srab.ko.zst ba431-rng.ko.zst barco-p50-gpio.ko.zst bareudp.ko.zst batman-adv.ko.zst baycom_par.ko.zst baycom_ser_fdx.ko.zst baycom_ser_hdx.ko.zst bcache.ko.zst bcachefs.ko.zst bch.ko.zst bcm-phy-lib.ko.zst bcm-phy-ptp.ko.zst bcm-sf2.ko.zst bcm203x.ko.zst bcm3510.ko.zst bcm54140.ko.zst bcm590xx-regulator.ko.zst bcm590xx.ko.zst bcm5974.ko.zst bcm7xxx.ko.zst bcm87xx.ko.zst bcm_vk.ko.zst bcma-hcd.ko.zst bcma.ko.zst bcmsysport.ko.zst bd6107.ko.zst bd9571mwv-regulator.ko.zst bd9571mwv.ko.zst bd99954-charger.ko.zst bdc.ko.zst be2iscsi.ko.zst be2net.ko.zst befs.ko.zst bel-pfe.ko.zst belkin_sa.ko.zst bfa.ko.zst bfq.ko.zst bfs.ko.zst bfusb.ko.zst bh1750.ko.zst bh1770glc.ko.zst bh1780.ko.zst binder_linux.ko.zst binfmt_misc.ko.zst blake2b_generic.ko.zst block2mtd.ko.zst blocklayoutdriver.ko.zst blowfish-x86_64.ko.zst blowfish_common.ko.zst blowfish_generic.ko.zst bluecard_cs.ko.zst bluetooth.ko.zst bluetooth_6lowpan.ko.zst bma150.ko.zst bma220_spi.ko.zst bma400_core.ko.zst bma400_i2c.ko.zst bma400_spi.ko.zst bmc150-accel-core.ko.zst bmc150-accel-i2c.ko.zst bmc150-accel-spi.ko.zst bmc150_magn.ko.zst bmc150_magn_i2c.ko.zst bmc150_magn_spi.ko.zst bme680_core.ko.zst bme680_i2c.ko.zst bme680_spi.ko.zst bmg160_core.ko.zst bmg160_i2c.ko.zst bmg160_spi.ko.zst bmi088-accel-core.ko.zst bmi088-accel-spi.ko.zst bmi160_core.ko.zst bmi160_i2c.ko.zst bmi160_spi.ko.zst bmi323_core.ko.zst bmi323_i2c.ko.zst bmi323_spi.ko.zst bmp280-i2c.ko.zst bmp280-spi.ko.zst bmp280.ko.zst bna.ko.zst bnep.ko.zst bno055.ko.zst bno055_i2c.ko.zst bno055_ser.ko.zst bnx2.ko.zst bnx2fc.ko.zst bnx2i.ko.zst bnx2x.ko.zst bnxt_en.ko.zst bnxt_re.ko.zst bochs.ko.zst bonding.ko.zst bpa-rs600.ko.zst bpa10x.ko.zst bpck.ko.zst bpck6.ko.zst bpqether.ko.zst bq2415x_charger.ko.zst bq24190_charger.ko.zst bq24257_charger.ko.zst bq24735-charger.ko.zst bq2515x_charger.ko.zst bq256xx_charger.ko.zst bq25890_charger.ko.zst bq25980_charger.ko.zst bq27xxx_battery.ko.zst bq27xxx_battery_hdq.ko.zst bq27xxx_battery_i2c.ko.zst br2684.ko.zst br_netfilter.ko.zst brcmfmac-bca.ko.zst brcmfmac-cyw.ko.zst brcmfmac-wcc.ko.zst brcmfmac.ko.zst brcmsmac.ko.zst brcmutil.ko.zst brd.ko.zst bridge.ko.zst broadcom.ko.zst bsd_comp.ko.zst bt3c_cs.ko.zst bt819.ko.zst bt856.ko.zst bt866.ko.zst bt878.ko.zst btbcm.ko.zst btcoexist.ko.zst btintel.ko.zst btmrvl.ko.zst btmrvl_sdio.ko.zst btmtk.ko.zst btmtksdio.ko.zst btmtkuart.ko.zst btnxpuart.ko.zst btqca.ko.zst btrfs.ko.zst btrsi.ko.zst btrtl.ko.zst btsdio.ko.zst bttv.ko.zst btusb.ko.zst bu21013_ts.ko.zst bu21029_ts.ko.zst budget-av.ko.zst budget-ci.ko.zst budget-core.ko.zst budget-patch.ko.zst budget.ko.zst c2port-duramar2150.ko.zst c67x00.ko.zst c6xdigio.ko.zst c_can.ko.zst c_can_pci.ko.zst c_can_platform.ko.zst ca8210.ko.zst cachefiles.ko.zst cadence_wdt.ko.zst cafe_ccic.ko.zst cafe_nand.ko.zst caif.ko.zst caif_serial.ko.zst caif_socket.ko.zst caif_usb.ko.zst caif_virtio.ko.zst camellia-aesni-avx-x86_64.ko.zst camellia-aesni-avx2.ko.zst camellia-x86_64.ko.zst camellia_generic.ko.zst can-bcm.ko.zst can-dev.ko.zst can-gw.ko.zst can-isotp.ko.zst can-j1939.ko.zst can-raw.ko.zst can.ko.zst can327.ko.zst capmode.ko.zst capsule-loader.ko.zst carl9170.ko.zst carminefb.ko.zst cassini.ko.zst cast5-avx-x86_64.ko.zst cast5_generic.ko.zst cast6-avx-x86_64.ko.zst cast6_generic.ko.zst cast_common.ko.zst catc.ko.zst cavium_ptp.ko.zst cb710-mmc.ko.zst cb710.ko.zst cb_das16_cs.ko.zst cb_pcidas.ko.zst cb_pcidas64.ko.zst cb_pcidda.ko.zst cb_pcimdas.ko.zst cb_pcimdda.ko.zst cc10001_adc.ko.zst cc2520.ko.zst cc770.ko.zst cc770_isa.ko.zst cc770_platform.ko.zst ccm.ko.zst ccp-crypto.ko.zst ccp.ko.zst ccs-pll.ko.zst ccs.ko.zst ccs811.ko.zst cdc-acm.ko.zst cdc-phonet.ko.zst cdc-wdm.ko.zst cdc_eem.ko.zst cdc_ether.ko.zst cdc_mbim.ko.zst cdc_ncm.ko.zst cdc_subset.ko.zst cdns-csi2rx.ko.zst cdns-csi2tx.ko.zst cdns-pltfrm.ko.zst cdns-usb-common.ko.zst cdns2-udc-pci.ko.zst cdns3-pci-wrap.ko.zst cdns3.ko.zst cdnsp-udc-pci.ko.zst cec-gpio.ko.zst cec.ko.zst ceph.ko.zst cfag12864b.ko.zst cfag12864bfb.ko.zst cfg80211.ko.zst cfi_cmdset_0001.ko.zst cfi_cmdset_0002.ko.zst cfi_cmdset_0020.ko.zst cfi_probe.ko.zst cfi_util.ko.zst ch.ko.zst ch341.ko.zst ch7006.ko.zst ch7322.ko.zst ch9200.ko.zst ch_ipsec.ko.zst ch_ktls.ko.zst chacha-x86_64.ko.zst chacha20poly1305.ko.zst chacha_generic.ko.zst chaoskey.ko.zst charlcd.ko.zst chcr.ko.zst chipone_icn8505.ko.zst chipreg.ko.zst chnl_net.ko.zst chromeos_acpi.ko.zst chromeos_laptop.ko.zst chromeos_privacy_screen.ko.zst chromeos_pstore.ko.zst chromeos_tbmc.ko.zst chv3-i2s.ko.zst ci_hdrc.ko.zst ci_hdrc_msm.ko.zst ci_hdrc_npcm.ko.zst ci_hdrc_pci.ko.zst ci_hdrc_usb2.ko.zst cicada.ko.zst cifs.ko.zst cifs_arc4.ko.zst cifs_md4.ko.zst cio-dac.ko.zst cirrus.ko.zst cirrusfb.ko.zst ck804xrom.ko.zst classmate-laptop.ko.zst clip.ko.zst clk-cdce706.ko.zst clk-cs2000-cp.ko.zst clk-lmk04832.ko.zst clk-max9485.ko.zst clk-palmas.ko.zst clk-pwm.ko.zst clk-si5341.ko.zst clk-si5351.ko.zst clk-si544.ko.zst clk-tps68470.ko.zst clk-twl.ko.zst clk-twl6040.ko.zst clk-wm831x.ko.zst cls_basic.ko.zst cls_bpf.ko.zst cls_cgroup.ko.zst cls_flow.ko.zst cls_flower.ko.zst cls_fw.ko.zst cls_matchall.ko.zst cls_route.ko.zst cls_u32.ko.zst cm109.ko.zst cm32181.ko.zst cm3232.ko.zst cm3323.ko.zst cm3605.ko.zst cm36651.ko.zst cma3000_d0x.ko.zst cma3000_d0x_i2c.ko.zst cmac.ko.zst cmdlinepart.ko.zst cmtp.ko.zst cnic.ko.zst cobalt.ko.zst cobra.ko.zst coda.ko.zst colibri-vf50-ts.ko.zst com20020-pci.ko.zst com20020.ko.zst com20020_cs.ko.zst com90io.ko.zst com90xx.ko.zst comedi.ko.zst comedi_8254.ko.zst comedi_8255.ko.zst comedi_bond.ko.zst comedi_example_test.ko.zst comedi_isadma.ko.zst comedi_parport.ko.zst comedi_pci.ko.zst comedi_pcmcia.ko.zst comedi_test.ko.zst comedi_usb.ko.zst comm.ko.zst compal-laptop.ko.zst contec_pci_dio.ko.zst cordic.ko.zst core.ko.zst coretemp.ko.zst corsair-cpro.ko.zst corsair-psu.ko.zst cortina.ko.zst counter.ko.zst cp210x.ko.zst cpcihp_generic.ko.zst cpcihp_zt5550.ko.zst cpu5wdt.ko.zst cpuid.ko.zst cpuidle-haltpoll.ko.zst cqhci.ko.zst cramfs.ko.zst crc-itu-t.ko.zst crc32-pclmul.ko.zst crc32_generic.ko.zst crc4.ko.zst crc7.ko.zst crc8.ko.zst crct10dif-pclmul.ko.zst cros-ec-cec.ko.zst cros-ec-sensorhub.ko.zst cros-ec-typec.ko.zst cros_ec.ko.zst cros_ec_accel_legacy.ko.zst cros_ec_baro.ko.zst cros_ec_chardev.ko.zst cros_ec_debugfs.ko.zst cros_ec_dev.ko.zst cros_ec_i2c.ko.zst cros_ec_ishtp.ko.zst cros_ec_keyb.ko.zst cros_ec_lid_angle.ko.zst cros_ec_light_prox.ko.zst cros_ec_lightbar.ko.zst cros_ec_lpcs.ko.zst cros_ec_mkbp_proximity.ko.zst cros_ec_sensors.ko.zst cros_ec_sensors_core.ko.zst cros_ec_spi.ko.zst cros_ec_sysfs.ko.zst cros_ec_uart.ko.zst cros_hps_i2c.ko.zst cros_kbd_led_backlight.ko.zst cros_peripheral_charger.ko.zst cros_typec_switch.ko.zst cros_usbpd-charger.ko.zst cros_usbpd_logger.ko.zst cros_usbpd_notify.ko.zst cryptd.ko.zst crypto_engine.ko.zst crypto_safexcel.ko.zst crypto_simd.ko.zst crypto_user.ko.zst cs3308.ko.zst cs42l43-i2c.ko.zst cs42l43-sdw.ko.zst cs42l43.ko.zst cs5345.ko.zst cs53l32a.ko.zst cs_dsp.ko.zst csiostor.ko.zst ct82c710.ko.zst ctucanfd.ko.zst ctucanfd_pci.ko.zst curve25519-generic.ko.zst curve25519-x86_64.ko.zst cuse.ko.zst cw1200_core.ko.zst cw1200_wlan_sdio.ko.zst cw1200_wlan_spi.ko.zst cw2015_battery.ko.zst cx18-alsa.ko.zst cx18.ko.zst cx22700.ko.zst cx22702.ko.zst cx231xx-alsa.ko.zst cx231xx-dvb.ko.zst cx231xx.ko.zst cx2341x.ko.zst cx23885.ko.zst cx24110.ko.zst cx24113.ko.zst cx24116.ko.zst cx24117.ko.zst cx24120.ko.zst cx24123.ko.zst cx25821-alsa.ko.zst cx25821.ko.zst cx25840.ko.zst cx82310_eth.ko.zst cx88-alsa.ko.zst cx88-blackbird.ko.zst cx88-dvb.ko.zst cx88-vp3054-i2c.ko.zst cx8800.ko.zst cx8802.ko.zst cx88xx.ko.zst cxacru.ko.zst cxd2099.ko.zst cxd2820r.ko.zst cxd2841er.ko.zst cxd2880-spi.ko.zst cxd2880.ko.zst cxgb.ko.zst cxgb3.ko.zst cxgb3i.ko.zst cxgb4.ko.zst cxgb4i.ko.zst cxgb4vf.ko.zst cxgbit.ko.zst cxl_acpi.ko.zst cxl_core.ko.zst cxl_mem.ko.zst cxl_pci.ko.zst cxl_pmem.ko.zst cxl_pmu.ko.zst cxl_port.ko.zst cy8ctma140.ko.zst cy8ctmg110_ts.ko.zst cyapatp.ko.zst cyber2000fb.ko.zst cyberjack.ko.zst cypress-sf.ko.zst cypress_cy7c63.ko.zst cypress_firmware.ko.zst cypress_m8.ko.zst cytherm.ko.zst cyttsp4_core.ko.zst cyttsp4_i2c.ko.zst cyttsp4_spi.ko.zst cyttsp5.ko.zst cyttsp_core.ko.zst cyttsp_i2c.ko.zst cyttsp_i2c_common.ko.zst cyttsp_spi.ko.zst da280.ko.zst da311.ko.zst da7280.ko.zst da9030_battery.ko.zst da9034-ts.ko.zst da903x-regulator.ko.zst da903x_bl.ko.zst da9052-battery.ko.zst da9052-hwmon.ko.zst da9052-regulator.ko.zst da9052_bl.ko.zst da9052_onkey.ko.zst da9052_tsi.ko.zst da9052_wdt.ko.zst da9055-hwmon.ko.zst da9055-regulator.ko.zst da9055_onkey.ko.zst da9055_wdt.ko.zst da9062-core.ko.zst da9062-regulator.ko.zst da9062_wdt.ko.zst da9063_onkey.ko.zst da9063_wdt.ko.zst da9150-charger.ko.zst da9150-core.ko.zst da9150-fg.ko.zst da9150-gpadc.ko.zst da9210-regulator.ko.zst da9211-regulator.ko.zst dac02.ko.zst daqboard2000.ko.zst das08.ko.zst das08_cs.ko.zst das08_isa.ko.zst das08_pci.ko.zst das16.ko.zst das16m1.ko.zst das1800.ko.zst das6402.ko.zst das800.ko.zst davicom.ko.zst dax_cxl.ko.zst dax_hmem.ko.zst dax_pmem.ko.zst db9.ko.zst dc395x.ko.zst dca.ko.zst dccp.ko.zst dccp_diag.ko.zst dccp_ipv4.ko.zst dccp_ipv6.ko.zst dcdbas.ko.zst ddbridge-dummy-fe.ko.zst ddbridge.ko.zst de2104x.ko.zst defxx.ko.zst dell-laptop.ko.zst dell-rbtn.ko.zst dell-smbios.ko.zst dell-smm-hwmon.ko.zst dell-smo8800.ko.zst dell-uart-backlight.ko.zst dell-wmi-aio.ko.zst dell-wmi-ddv.ko.zst dell-wmi-descriptor.ko.zst dell-wmi-led.ko.zst dell-wmi-sysman.ko.zst dell-wmi.ko.zst dell_rbu.ko.zst delta-ahe50dc-fan.ko.zst denali.ko.zst denali_pci.ko.zst des3_ede-x86_64.ko.zst des_generic.ko.zst designware_i2s.ko.zst dev-sync-probe.ko.zst device_dax.ko.zst dfl-afu.ko.zst dfl-emif.ko.zst dfl-fme-br.ko.zst dfl-fme-mgr.ko.zst dfl-fme-region.ko.zst dfl-fme.ko.zst dfl-n3000-nios.ko.zst dfl-pci.ko.zst dfl.ko.zst dht11.ko.zst diag.ko.zst dib0070.ko.zst dib0090.ko.zst dib3000mb.ko.zst dib3000mc.ko.zst dib7000m.ko.zst dib7000p.ko.zst dib8000.ko.zst dib9000.ko.zst dibx000_common.ko.zst digi_acceleport.ko.zst diskonchip.ko.zst dl2k.ko.zst dlhl60d.ko.zst dlink-dir685-touchkeys.ko.zst dlm.ko.zst dln2-adc.ko.zst dln2.ko.zst dm-bio-prison.ko.zst dm-bufio.ko.zst dm-cache-smq.ko.zst dm-cache.ko.zst dm-clone.ko.zst dm-crypt.ko.zst dm-delay.ko.zst dm-ebs.ko.zst dm-era.ko.zst dm-flakey.ko.zst dm-historical-service-time.ko.zst dm-integrity.ko.zst dm-io-affinity.ko.zst dm-log-userspace.ko.zst dm-log-writes.ko.zst dm-log.ko.zst dm-mirror.ko.zst dm-multipath.ko.zst dm-persistent-data.ko.zst dm-queue-length.ko.zst dm-raid.ko.zst dm-region-hash.ko.zst dm-round-robin.ko.zst dm-service-time.ko.zst dm-snapshot.ko.zst dm-switch.ko.zst dm-thin-pool.ko.zst dm-unstripe.ko.zst dm-verity.ko.zst dm-writecache.ko.zst dm-zero.ko.zst dm-zoned.ko.zst dm1105.ko.zst dm9601.ko.zst dmard06.ko.zst dmard09.ko.zst dmard10.ko.zst dme1737.ko.zst dmfe.ko.zst dmi-sysfs.ko.zst dmm32at.ko.zst dmx3191d.ko.zst dnet.ko.zst dp83640.ko.zst dp83822.ko.zst dp83848.ko.zst dp83867.ko.zst dp83869.ko.zst dp83tc811.ko.zst dp83td510.ko.zst dp83tg720.ko.zst dpot-dac.ko.zst dps310.ko.zst dps920ab.ko.zst dptf_pch_fivr.ko.zst dptf_power.ko.zst drbd.ko.zst drivetemp.ko.zst drm_buddy.ko.zst drm_display_helper.ko.zst drm_dma_helper.ko.zst drm_exec.ko.zst drm_gpuvm.ko.zst drm_mipi_dbi.ko.zst drm_suballoc_helper.ko.zst drm_ttm_helper.ko.zst drm_vram_helper.ko.zst drm_xen_front.ko.zst drv260x.ko.zst drv2665.ko.zst drv2667.ko.zst drx39xyj.ko.zst drxd.ko.zst drxk.ko.zst ds1621.ko.zst ds1682.ko.zst ds1803.ko.zst ds2482.ko.zst ds2490.ko.zst ds2760_battery.ko.zst ds2780_battery.ko.zst ds2781_battery.ko.zst ds2782_battery.ko.zst ds3000.ko.zst ds4424.ko.zst ds620.ko.zst dsa_core.ko.zst dsbr100.ko.zst dst.ko.zst dst_ca.ko.zst dstr.ko.zst dt2801.ko.zst dt2811.ko.zst dt2814.ko.zst dt2815.ko.zst dt2817.ko.zst dt282x.ko.zst dt3000.ko.zst dt3155.ko.zst dt9812.ko.zst dtl1_cs.ko.zst dummy-irq.ko.zst dummy.ko.zst dummy_stm.ko.zst dvb-as102.ko.zst dvb-bt8xx.ko.zst dvb-core.ko.zst dvb-pll.ko.zst dvb-ttpci.ko.zst dvb-ttusb-budget.ko.zst dvb-usb-a800.ko.zst dvb-usb-af9005-remote.ko.zst dvb-usb-af9005.ko.zst dvb-usb-af9015.ko.zst dvb-usb-af9035.ko.zst dvb-usb-anysee.ko.zst dvb-usb-au6610.ko.zst dvb-usb-az6007.ko.zst dvb-usb-az6027.ko.zst dvb-usb-ce6230.ko.zst dvb-usb-cinergyT2.ko.zst dvb-usb-cxusb.ko.zst dvb-usb-dib0700.ko.zst dvb-usb-dibusb-common.ko.zst dvb-usb-dibusb-mb.ko.zst dvb-usb-dibusb-mc-common.ko.zst dvb-usb-dibusb-mc.ko.zst dvb-usb-digitv.ko.zst dvb-usb-dtt200u.ko.zst dvb-usb-dtv5100.ko.zst dvb-usb-dvbsky.ko.zst dvb-usb-dw2102.ko.zst dvb-usb-ec168.ko.zst dvb-usb-gl861.ko.zst dvb-usb-gp8psk.ko.zst dvb-usb-lmedm04.ko.zst dvb-usb-m920x.ko.zst dvb-usb-mxl111sf.ko.zst dvb-usb-nova-t-usb2.ko.zst dvb-usb-opera.ko.zst dvb-usb-pctv452e.ko.zst dvb-usb-rtl28xxu.ko.zst dvb-usb-technisat-usb2.ko.zst dvb-usb-ttusb2.ko.zst dvb-usb-umt-010.ko.zst dvb-usb-vp702x.ko.zst dvb-usb-vp7045.ko.zst dvb-usb.ko.zst dvb_dummy_fe.ko.zst dvb_usb_v2.ko.zst dw-edma-pcie.ko.zst dw-edma.ko.zst dw-i3c-master.ko.zst dw-xdata-pcie.ko.zst dw9714.ko.zst dw9719.ko.zst dw9768.ko.zst dw9807-vcm.ko.zst dw_dmac.ko.zst dw_dmac_core.ko.zst dw_dmac_pci.ko.zst dw_wdt.ko.zst dwc-xlgmac.ko.zst dwc2_pci.ko.zst dwc3-haps.ko.zst dwc3-pci.ko.zst dwc3.ko.zst dwc_pcie_pmu.ko.zst dwmac-generic.ko.zst dwmac-intel.ko.zst dyna_pci10xx.ko.zst dynapro.ko.zst e100.ko.zst e1000.ko.zst e1000e.ko.zst e3x0-button.ko.zst e4000.ko.zst e752x_edac.ko.zst earth-pt1.ko.zst earth-pt3.ko.zst ebc-c384_wdt.ko.zst ebt_802_3.ko.zst ebt_among.ko.zst ebt_arp.ko.zst ebt_arpreply.ko.zst ebt_dnat.ko.zst ebt_ip.ko.zst ebt_ip6.ko.zst ebt_limit.ko.zst ebt_log.ko.zst ebt_mark.ko.zst ebt_mark_m.ko.zst ebt_nflog.ko.zst ebt_pkttype.ko.zst ebt_redirect.ko.zst ebt_snat.ko.zst ebt_stp.ko.zst ebt_vlan.ko.zst ebtable_broute.ko.zst ebtable_filter.ko.zst ebtable_nat.ko.zst ebtables.ko.zst ec100.ko.zst ec_bhf.ko.zst ec_sys.ko.zst ecc.ko.zst ecdh_generic.ko.zst ecdsa_generic.ko.zst echainiv.ko.zst echo.ko.zst ecrdsa_generic.ko.zst edac_mce_amd.ko.zst edt-ft5x06.ko.zst ee1004.ko.zst eeepc-laptop.ko.zst eeepc-wmi.ko.zst eeprom_93cx6.ko.zst eeprom_93xx46.ko.zst eeti_ts.ko.zst efa.ko.zst efct.ko.zst efi-pstore.ko.zst efi_secret.ko.zst efi_test.ko.zst efibc.ko.zst efs.ko.zst egalax_ts_serial.ko.zst ehci-fsl.ko.zst ehset.ko.zst einj.ko.zst ektf2127.ko.zst elan_i2c.ko.zst elo.ko.zst em28xx-alsa.ko.zst em28xx-dvb.ko.zst em28xx-rc.ko.zst em28xx-v4l.ko.zst em28xx.ko.zst em_canid.ko.zst em_cmp.ko.zst em_ipset.ko.zst em_ipt.ko.zst em_meta.ko.zst em_nbyte.ko.zst em_text.ko.zst em_u32.ko.zst emc1403.ko.zst emc2103.ko.zst emc2305.ko.zst emc6w201.ko.zst emi26.ko.zst emi62.ko.zst empeg.ko.zst ems_pci.ko.zst ems_pcmcia.ko.zst ems_usb.ko.zst emu10k1-gp.ko.zst ena.ko.zst enc28j60.ko.zst enclosure.ko.zst encx24j600-regmap.ko.zst encx24j600.ko.zst ene_ir.ko.zst eni.ko.zst eni_vdpa.ko.zst enic.ko.zst envelope-detector.ko.zst epat.ko.zst epia.ko.zst epic100.ko.zst eql.ko.zst erdma.ko.zst erofs.ko.zst esas2r.ko.zst esb2rom.ko.zst esd_usb.ko.zst esp4.ko.zst esp4_offload.ko.zst esp6.ko.zst esp6_offload.ko.zst esp_scsi.ko.zst essiv.ko.zst et1011c.ko.zst et131x.ko.zst et8ek8.ko.zst etas_es58x.ko.zst ethoc.ko.zst eurotechwdt.ko.zst evbug.ko.zst exar_wdt.ko.zst exc3000.ko.zst exfat.ko.zst extcon-adc-jack.ko.zst extcon-axp288.ko.zst extcon-fsa9480.ko.zst extcon-gpio.ko.zst extcon-intel-cht-wc.ko.zst extcon-intel-int3496.ko.zst extcon-intel-mrfld.ko.zst extcon-max14577.ko.zst extcon-max3355.ko.zst extcon-max77693.ko.zst extcon-max77843.ko.zst extcon-max8997.ko.zst extcon-palmas.ko.zst extcon-ptn5150.ko.zst extcon-rt8973a.ko.zst extcon-sm5502.ko.zst extcon-usb-gpio.ko.zst extcon-usbc-cros-ec.ko.zst extcon-usbc-tusb320.ko.zst ezusb.ko.zst f2fs.ko.zst f71805f.ko.zst f71808e_wdt.ko.zst f71882fg.ko.zst f75375s.ko.zst f81232.ko.zst f81534.ko.zst f81601.ko.zst f81604.ko.zst fakelb.ko.zst fam15h_power.ko.zst fan53555.ko.zst farsync.ko.zst fb_agm1264k-fl.ko.zst fb_bd663474.ko.zst fb_ddc.ko.zst fb_hx8340bn.ko.zst fb_hx8347d.ko.zst fb_hx8353d.ko.zst fb_hx8357d.ko.zst fb_ili9163.ko.zst fb_ili9320.ko.zst fb_ili9325.ko.zst fb_ili9340.ko.zst fb_ili9341.ko.zst fb_ili9481.ko.zst fb_ili9486.ko.zst fb_pcd8544.ko.zst fb_ra8875.ko.zst fb_s6d02a1.ko.zst fb_s6d1121.ko.zst fb_seps525.ko.zst fb_sh1106.ko.zst fb_ssd1289.ko.zst fb_ssd1305.ko.zst fb_ssd1306.ko.zst fb_ssd1325.ko.zst fb_ssd1331.ko.zst fb_ssd1351.ko.zst fb_st7735r.ko.zst fb_st7789v.ko.zst fb_tinylcd.ko.zst fb_tls8204.ko.zst fb_uc1611.ko.zst fb_uc1701.ko.zst fb_upd161704.ko.zst fbtft.ko.zst fc0011.ko.zst fc0012.ko.zst fc0013.ko.zst fc2580.ko.zst fcoe.ko.zst fcrypt.ko.zst fdomain.ko.zst fdomain_cs.ko.zst fdomain_pci.ko.zst fdp.ko.zst fdp_i2c.ko.zst fealnx.ko.zst ff-memless.ko.zst fieldbus_dev.ko.zst fintek-cir.ko.zst firedtv.ko.zst firewire-core.ko.zst firewire-net.ko.zst firewire-ohci.ko.zst firewire-sbp2.ko.zst firmware_attributes_class.ko.zst fit2.ko.zst fit3.ko.zst fixed.ko.zst fjes.ko.zst fl512.ko.zst floppy.ko.zst fm10k.ko.zst fm801-gp.ko.zst fm_drv.ko.zst fmvj18x_cs.ko.zst fnic.ko.zst forcedeth.ko.zst fore_200e.ko.zst fou.ko.zst fou6.ko.zst fpga-bridge.ko.zst fpga-mgr.ko.zst fpga-region.ko.zst freevxfs.ko.zst friq.ko.zst frpw.ko.zst fsa4480.ko.zst fschmd.ko.zst fsia6b.ko.zst fsl-mph-dr-of.ko.zst fsl_linflexuart.ko.zst fsl_lpuart.ko.zst fsp-3y.ko.zst ftdi_sio.ko.zst ftl.ko.zst ftrace-direct-modify.ko.zst ftrace-direct-too.ko.zst ftrace-direct.ko.zst ftsteutates.ko.zst fujitsu-laptop.ko.zst fujitsu-tablet.ko.zst fujitsu_ts.ko.zst funcore.ko.zst funeth.ko.zst fusb302.ko.zst fxas21002c_core.ko.zst fxas21002c_i2c.ko.zst fxas21002c_spi.ko.zst fxls8962af-core.ko.zst fxls8962af-i2c.ko.zst fxls8962af-spi.ko.zst fxos8700_core.ko.zst fxos8700_i2c.ko.zst fxos8700_spi.ko.zst g450_pll.ko.zst g760a.ko.zst g762.ko.zst g_acm_ms.ko.zst g_audio.ko.zst g_cdc.ko.zst g_dbgp.ko.zst g_ether.ko.zst g_ffs.ko.zst g_hid.ko.zst g_mass_storage.ko.zst g_midi.ko.zst g_ncm.ko.zst g_nokia.ko.zst g_printer.ko.zst g_serial.ko.zst g_webcam.ko.zst g_zero.ko.zst gadgetfs.ko.zst gamecon.ko.zst gameport.ko.zst garmin_gps.ko.zst garp.ko.zst gb-audio-apbridgea.ko.zst gb-audio-codec.ko.zst gb-audio-gb.ko.zst gb-audio-manager.ko.zst gb-audio-module.ko.zst gb-beagleplay.ko.zst gb-bootrom.ko.zst gb-es2.ko.zst gb-firmware.ko.zst gb-gbphy.ko.zst gb-gpio.ko.zst gb-hid.ko.zst gb-i2c.ko.zst gb-light.ko.zst gb-log.ko.zst gb-loopback.ko.zst gb-power-supply.ko.zst gb-pwm.ko.zst gb-raw.ko.zst gb-sdio.ko.zst gb-spi.ko.zst gb-spilib.ko.zst gb-uart.ko.zst gb-usb.ko.zst gb-vibrator.ko.zst gc0308.ko.zst gc2145.ko.zst gdmtty.ko.zst gdmulte.ko.zst gen_probe.ko.zst generic-adc-battery.ko.zst generic.ko.zst genet.ko.zst geneve.ko.zst genwqe_card.ko.zst gf2k.ko.zst gfs2.ko.zst ghash-clmulni-intel.ko.zst gigabyte-wmi.ko.zst gigabyte_waterforce.ko.zst gl518sm.ko.zst gl520sm.ko.zst gl620a.ko.zst gluebi.ko.zst gm12u320.ko.zst gma500_gfx.ko.zst gnss-mtk.ko.zst gnss-serial.ko.zst gnss-sirf.ko.zst gnss-ubx.ko.zst gnss-usb.ko.zst gnss.ko.zst go7007-loader.ko.zst go7007-usb.ko.zst go7007.ko.zst goku_udc.ko.zst goldfish_battery.ko.zst goodix_ts.ko.zst gp2ap002.ko.zst gp2ap020a00f.ko.zst gp8psk-fe.ko.zst gpd-pocket-fan.ko.zst gpio-104-dio-48e.ko.zst gpio-104-idi-48.ko.zst gpio-104-idio-16.ko.zst gpio-aaeon.ko.zst gpio-adp5520.ko.zst gpio-aggregator.ko.zst gpio-amd-fch.ko.zst gpio-amd8111.ko.zst gpio-amdpt.ko.zst gpio-arizona.ko.zst gpio-bd9571mwv.ko.zst gpio-beeper.ko.zst gpio-charger.ko.zst gpio-da9052.ko.zst gpio-da9055.ko.zst gpio-dln2.ko.zst gpio-ds4520.ko.zst gpio-dwapb.ko.zst gpio-elkhartlake.ko.zst gpio-exar.ko.zst gpio-f7188x.ko.zst gpio-fxl6408.ko.zst gpio-gpio-mm.ko.zst gpio-i8255.ko.zst gpio-ich.ko.zst gpio-idio-16.ko.zst gpio-it87.ko.zst gpio-janz-ttl.ko.zst gpio-kempld.ko.zst gpio-latch.ko.zst gpio-ljca.ko.zst gpio-lp3943.ko.zst gpio-lp873x.ko.zst gpio-madera.ko.zst gpio-max3191x.ko.zst gpio-max7300.ko.zst gpio-max7301.ko.zst gpio-max730x.ko.zst gpio-max732x.ko.zst gpio-mb86s7x.ko.zst gpio-mc33880.ko.zst gpio-menz127.ko.zst gpio-ml-ioh.ko.zst gpio-pca953x.ko.zst gpio-pca9570.ko.zst gpio-pcf857x.ko.zst gpio-pci-idio-16.ko.zst gpio-pcie-idio-24.ko.zst gpio-pisosr.ko.zst gpio-rdc321x.ko.zst gpio-regmap.ko.zst gpio-regulator.ko.zst gpio-sbu-mux.ko.zst gpio-sch.ko.zst gpio-sch311x.ko.zst gpio-sim.ko.zst gpio-siox.ko.zst gpio-tangier.ko.zst gpio-tpic2810.ko.zst gpio-tps65086.ko.zst gpio-tps65912.ko.zst gpio-tps68470.ko.zst gpio-tqmx86.ko.zst gpio-twl4030.ko.zst gpio-twl6040.ko.zst gpio-vibra.ko.zst gpio-viperboard.ko.zst gpio-virtio.ko.zst gpio-vx855.ko.zst gpio-wcove.ko.zst gpio-winbond.ko.zst gpio-wm831x.ko.zst gpio-wm8350.ko.zst gpio-wm8994.ko.zst gpio-ws16c48.ko.zst gpio-xra1403.ko.zst gpio.ko.zst gpio_backlight.ko.zst gpio_decoder.ko.zst gpio_keys.ko.zst gpio_keys_polled.ko.zst gpio_mouse.ko.zst gpu-sched.ko.zst gr_udc.ko.zst grace.ko.zst gre.ko.zst greybus.ko.zst grip.ko.zst grip_mp.ko.zst gru.ko.zst gs1662.ko.zst gs_usb.ko.zst gsc_hpdi.ko.zst gspca_benq.ko.zst gspca_conex.ko.zst gspca_cpia1.ko.zst gspca_dtcs033.ko.zst gspca_etoms.ko.zst gspca_finepix.ko.zst gspca_gl860.ko.zst gspca_jeilinj.ko.zst gspca_jl2005bcd.ko.zst gspca_kinect.ko.zst gspca_konica.ko.zst gspca_m5602.ko.zst gspca_main.ko.zst gspca_mars.ko.zst gspca_mr97310a.ko.zst gspca_nw80x.ko.zst gspca_ov519.ko.zst gspca_ov534.ko.zst gspca_ov534_9.ko.zst gspca_pac207.ko.zst gspca_pac7302.ko.zst gspca_pac7311.ko.zst gspca_se401.ko.zst gspca_sn9c2028.ko.zst gspca_sn9c20x.ko.zst gspca_sonixb.ko.zst gspca_sonixj.ko.zst gspca_spca1528.ko.zst gspca_spca500.ko.zst gspca_spca501.ko.zst gspca_spca505.ko.zst gspca_spca506.ko.zst gspca_spca508.ko.zst gspca_spca561.ko.zst gspca_sq905.ko.zst gspca_sq905c.ko.zst gspca_sq930x.ko.zst gspca_stk014.ko.zst gspca_stk1135.ko.zst gspca_stv0680.ko.zst gspca_stv06xx.ko.zst gspca_sunplus.ko.zst gspca_t613.ko.zst gspca_topro.ko.zst gspca_touptek.ko.zst gspca_tv8532.ko.zst gspca_vc032x.ko.zst gspca_vicam.ko.zst gspca_xirlink_cit.ko.zst gspca_zc3xx.ko.zst gtp.ko.zst gud.ko.zst guillemot.ko.zst gunze.ko.zst gve.ko.zst habanalabs.ko.zst hackrf.ko.zst hamachi.ko.zst hampshire.ko.zst hangcheck-timer.ko.zst hanwang.ko.zst hci.ko.zst hci_bcm4377.ko.zst hci_nokia.ko.zst hci_uart.ko.zst hci_vhci.ko.zst hctr2.ko.zst hd3ss3220.ko.zst hd44780.ko.zst hd44780_common.ko.zst hdaps.ko.zst hdc100x.ko.zst hdc2010.ko.zst hdc3020.ko.zst hdlc.ko.zst hdlc_cisco.ko.zst hdlc_fr.ko.zst hdlc_ppp.ko.zst hdlc_raw.ko.zst hdlc_raw_eth.ko.zst hdlc_x25.ko.zst hdlcdrv.ko.zst hdma.ko.zst hdma_mgmt.ko.zst hdpvr.ko.zst he.ko.zst hecubafb.ko.zst helene.ko.zst hellcreek_sw.ko.zst hexium_gemini.ko.zst hexium_orion.ko.zst hfcmulti.ko.zst hfcpci.ko.zst hfcsusb.ko.zst hfi1.ko.zst hfs.ko.zst hfsplus.ko.zst hgafb.ko.zst hi311x.ko.zst hi556.ko.zst hi6210-i2s.ko.zst hi8435.ko.zst hi846.ko.zst hi847.ko.zst hid-a4tech.ko.zst hid-accutouch.ko.zst hid-alps.ko.zst hid-apple.ko.zst hid-appleir.ko.zst hid-asus.ko.zst hid-aureal.ko.zst hid-axff.ko.zst hid-belkin.ko.zst hid-betopff.ko.zst hid-bigbenff.ko.zst hid-cherry.ko.zst hid-chicony.ko.zst hid-cmedia.ko.zst hid-corsair.ko.zst hid-cougar.ko.zst hid-cp2112.ko.zst hid-creative-sb0540.ko.zst hid-cypress.ko.zst hid-dr.ko.zst hid-elan.ko.zst hid-elecom.ko.zst hid-elo.ko.zst hid-emsff.ko.zst hid-evision.ko.zst hid-ezkey.ko.zst hid-ft260.ko.zst hid-gaff.ko.zst hid-gembird.ko.zst hid-generic.ko.zst hid-gfrm.ko.zst hid-glorious.ko.zst hid-google-hammer.ko.zst hid-google-stadiaff.ko.zst hid-gt683r.ko.zst hid-gyration.ko.zst hid-holtek-kbd.ko.zst hid-holtek-mouse.ko.zst hid-holtekff.ko.zst hid-hyperv.ko.zst hid-icade.ko.zst hid-ite.ko.zst hid-jabra.ko.zst hid-kensington.ko.zst hid-keytouch.ko.zst hid-kye.ko.zst hid-lcpower.ko.zst hid-led.ko.zst hid-lenovo.ko.zst hid-letsketch.ko.zst hid-lg-g15.ko.zst hid-logitech-dj.ko.zst hid-logitech-hidpp.ko.zst hid-logitech.ko.zst hid-macally.ko.zst hid-magicmouse.ko.zst hid-maltron.ko.zst hid-mcp2200.ko.zst hid-mcp2221.ko.zst hid-megaworld.ko.zst hid-mf.ko.zst hid-microsoft.ko.zst hid-monterey.ko.zst hid-multitouch.ko.zst hid-nintendo.ko.zst hid-nti.ko.zst hid-ntrig.ko.zst hid-nvidia-shield.ko.zst hid-ortek.ko.zst hid-penmount.ko.zst hid-petalynx.ko.zst hid-picolcd.ko.zst hid-pl.ko.zst hid-plantronics.ko.zst hid-playstation.ko.zst hid-primax.ko.zst hid-prodikeys.ko.zst hid-pxrc.ko.zst hid-razer.ko.zst hid-redragon.ko.zst hid-retrode.ko.zst hid-rmi.ko.zst hid-roccat-arvo.ko.zst hid-roccat-common.ko.zst hid-roccat-isku.ko.zst hid-roccat-kone.ko.zst hid-roccat-koneplus.ko.zst hid-roccat-konepure.ko.zst hid-roccat-kovaplus.ko.zst hid-roccat-lua.ko.zst hid-roccat-pyra.ko.zst hid-roccat-ryos.ko.zst hid-roccat-savu.ko.zst hid-roccat.ko.zst hid-saitek.ko.zst hid-samsung.ko.zst hid-semitek.ko.zst hid-sensor-accel-3d.ko.zst hid-sensor-als.ko.zst hid-sensor-custom-intel-hinge.ko.zst hid-sensor-custom.ko.zst hid-sensor-gyro-3d.ko.zst hid-sensor-hub.ko.zst hid-sensor-humidity.ko.zst hid-sensor-iio-common.ko.zst hid-sensor-incl-3d.ko.zst hid-sensor-magn-3d.ko.zst hid-sensor-press.ko.zst hid-sensor-prox.ko.zst hid-sensor-rotation.ko.zst hid-sensor-temperature.ko.zst hid-sensor-trigger.ko.zst hid-sigmamicro.ko.zst hid-sjoy.ko.zst hid-sony.ko.zst hid-speedlink.ko.zst hid-steam.ko.zst hid-steelseries.ko.zst hid-sunplus.ko.zst hid-thrustmaster.ko.zst hid-tivo.ko.zst hid-tmff.ko.zst hid-topre.ko.zst hid-topseed.ko.zst hid-twinhan.ko.zst hid-u2fzero.ko.zst hid-uclogic.ko.zst hid-udraw-ps3.ko.zst hid-universal-pidff.ko.zst hid-viewsonic.ko.zst hid-vivaldi-common.ko.zst hid-vivaldi.ko.zst hid-vrc2.ko.zst hid-waltop.ko.zst hid-wiimote.ko.zst hid-xiaomi.ko.zst hid-xinmo.ko.zst hid-zpff.ko.zst hid-zydacron.ko.zst hid.ko.zst hideep.ko.zst hidp.ko.zst hih6130.ko.zst himax_hx83112b.ko.zst hinic.ko.zst hisi-spmi-controller.ko.zst hmc425a.ko.zst hmc5843_core.ko.zst hmc5843_i2c.ko.zst hmc5843_spi.ko.zst hmc6352.ko.zst hopper.ko.zst horus3a.ko.zst hp-bioscfg.ko.zst hp-wmi-sensors.ko.zst hp-wmi.ko.zst hp03.ko.zst hp206c.ko.zst hp_accel.ko.zst hpfs.ko.zst hpilo.ko.zst hpsa.ko.zst hptiop.ko.zst hpwdt.ko.zst hs3001.ko.zst hsc030pa.ko.zst hsc030pa_i2c.ko.zst hsc030pa_spi.ko.zst hsi.ko.zst hsi_char.ko.zst hso.ko.zst hsr.ko.zst ht16k33.ko.zst hts221.ko.zst hts221_i2c.ko.zst hts221_spi.ko.zst htu21.ko.zst huawei-wmi.ko.zst huawei_cdc_ncm.ko.zst hv_balloon.ko.zst hv_netvsc.ko.zst hv_sock.ko.zst hv_storvsc.ko.zst hv_utils.ko.zst hv_vmbus.ko.zst hwmon-aaeon.ko.zst hwmon-vid.ko.zst hwpoison-inject.ko.zst hx711.ko.zst hx8357.ko.zst hx8357d.ko.zst hycon-hy46xx.ko.zst hynitron_cstxxx.ko.zst hyperbus-core.ko.zst hyperv-keyboard.ko.zst hyperv_drm.ko.zst i10nm_edac.ko.zst i2c-algo-bit.ko.zst i2c-algo-pca.ko.zst i2c-ali1535.ko.zst i2c-ali1563.ko.zst i2c-ali15x3.ko.zst i2c-amd-mp2-pci.ko.zst i2c-amd-mp2-plat.ko.zst i2c-amd756-s4882.ko.zst i2c-amd756.ko.zst i2c-amd8111.ko.zst i2c-cbus-gpio.ko.zst i2c-ccgx-ucsi.ko.zst i2c-cht-wc.ko.zst i2c-cp2615.ko.zst i2c-cros-ec-tunnel.ko.zst i2c-designware-pci.ko.zst i2c-diolan-u2c.ko.zst i2c-dln2.ko.zst i2c-gpio.ko.zst i2c-hid-acpi.ko.zst i2c-hid-of.ko.zst i2c-hid.ko.zst i2c-i801.ko.zst i2c-isch.ko.zst i2c-ismt.ko.zst i2c-kempld.ko.zst i2c-ljca.ko.zst i2c-matroxfb.ko.zst i2c-mchp-pci1xxxx.ko.zst i2c-mlxcpld.ko.zst i2c-mux-gpio.ko.zst i2c-mux-ltc4306.ko.zst i2c-mux-mlxcpld.ko.zst i2c-mux-pca9541.ko.zst i2c-mux-pca954x.ko.zst i2c-mux-reg.ko.zst i2c-mux.ko.zst i2c-nforce2-s4985.ko.zst i2c-nforce2.ko.zst i2c-nvidia-gpu.ko.zst i2c-ocores.ko.zst i2c-parport.ko.zst i2c-pca-platform.ko.zst i2c-piix4.ko.zst i2c-robotfuzz-osif.ko.zst i2c-scmi.ko.zst i2c-simtec.ko.zst i2c-sis5595.ko.zst i2c-sis630.ko.zst i2c-sis96x.ko.zst i2c-smbus.ko.zst i2c-stub.ko.zst i2c-taos-evm.ko.zst i2c-tiny-usb.ko.zst i2c-via.ko.zst i2c-viapro.ko.zst i2c-viperboard.ko.zst i2c-virtio.ko.zst i2c-xiic.ko.zst i3000_edac.ko.zst i3200_edac.ko.zst i3c-master-cdns.ko.zst i3c.ko.zst i40e.ko.zst i5100_edac.ko.zst i5400_edac.ko.zst i5500_temp.ko.zst i5k_amb.ko.zst i6300esb.ko.zst i7300_edac.ko.zst i740fb.ko.zst i7core_edac.ko.zst i82092.ko.zst i8254.ko.zst i82975x_edac.ko.zst i915.ko.zst iTCO_vendor_support.ko.zst iTCO_wdt.ko.zst iaa_crypto.ko.zst iavf.ko.zst ib700wdt.ko.zst ib_cm.ko.zst ib_core.ko.zst ib_ipoib.ko.zst ib_iser.ko.zst ib_isert.ko.zst ib_mthca.ko.zst ib_qib.ko.zst ib_srp.ko.zst ib_srpt.ko.zst ib_umad.ko.zst ib_uverbs.ko.zst ibm-cffps.ko.zst ibm_rtl.ko.zst ibmaem.ko.zst ibmasm.ko.zst ibmasr.ko.zst ibmpex.ko.zst ice.ko.zst ichxrom.ko.zst icp10100.ko.zst icp_multi.ko.zst icplus.ko.zst ics932s401.ko.zst ideapad-laptop.ko.zst ideapad_slidebar.ko.zst idma64.ko.zst idmouse.ko.zst idpf.ko.zst idt77252.ko.zst idt_89hpesx.ko.zst idt_gen2.ko.zst idt_gen3.ko.zst idtcps.ko.zst idxd.ko.zst idxd_bus.ko.zst ie31200_edac.ko.zst ie6xx_wdt.ko.zst ieee802154.ko.zst ieee802154_6lowpan.ko.zst ieee802154_socket.ko.zst ifb.ko.zst ifcvf.ko.zst ife.ko.zst ifi_canfd.ko.zst iforce-serio.ko.zst iforce-usb.ko.zst iforce.ko.zst igb.ko.zst igbvf.ko.zst igc.ko.zst igen6_edac.ko.zst igorplugusb.ko.zst iguanair.ko.zst ii_pci20kc.ko.zst iio-mux.ko.zst iio-rescale.ko.zst iio-trig-hrtimer.ko.zst iio-trig-interrupt.ko.zst iio-trig-loop.ko.zst iio-trig-sysfs.ko.zst iio_dummy.ko.zst iio_hwmon.ko.zst ila.ko.zst ili210x.ko.zst ili9163.ko.zst ili9225.ko.zst ili922x.ko.zst ili9320.ko.zst ili9341.ko.zst ili9486.ko.zst ilitek_ts_i2c.ko.zst imagis.ko.zst img-ascii-lcd.ko.zst img-i2s-in.ko.zst img-i2s-out.ko.zst img-parallel-out.ko.zst img-spdif-in.ko.zst img-spdif-out.ko.zst imm.ko.zst imon.ko.zst imon_raw.ko.zst ims-pcu.ko.zst imx208.ko.zst imx214.ko.zst imx219.ko.zst imx258.ko.zst imx274.ko.zst imx290.ko.zst imx296.ko.zst imx319.ko.zst imx355.ko.zst ina209.ko.zst ina238.ko.zst ina2xx-adc.ko.zst ina2xx.ko.zst ina3221.ko.zst industrialio-backend.ko.zst industrialio-buffer-cb.ko.zst industrialio-buffer-dma.ko.zst industrialio-buffer-dmaengine.ko.zst industrialio-configfs.ko.zst industrialio-gts-helper.ko.zst industrialio-hw-consumer.ko.zst industrialio-sw-device.ko.zst industrialio-sw-trigger.ko.zst industrialio-triggered-buffer.ko.zst industrialio-triggered-event.ko.zst industrialio.ko.zst inet_diag.ko.zst inexio.ko.zst inftl.ko.zst initio.ko.zst input-leds.ko.zst inspur-ipsps.ko.zst inspur_platform_profile.ko.zst int3400_thermal.ko.zst int3401_thermal.ko.zst int3402_thermal.ko.zst int3403_thermal.ko.zst int3406_thermal.ko.zst int340x_thermal_zone.ko.zst int51x1.ko.zst intel-cstate.ko.zst intel-hid.ko.zst intel-ish-ipc.ko.zst intel-ishtp-hid.ko.zst intel-ishtp-loader.ko.zst intel-ishtp.ko.zst intel-lpss-acpi.ko.zst intel-lpss-pci.ko.zst intel-lpss.ko.zst intel-m10-bmc-core.ko.zst intel-m10-bmc-hwmon.ko.zst intel-m10-bmc-pmci.ko.zst intel-m10-bmc-spi.ko.zst intel-qep.ko.zst intel-rng.ko.zst intel-rst.ko.zst intel-smartconnect.ko.zst intel-uncore-frequency-common.ko.zst intel-uncore-frequency-tpmi.ko.zst intel-uncore-frequency.ko.zst intel-vbtn.ko.zst intel-wmi-sbl-fw-update.ko.zst intel-wmi-thunderbolt.ko.zst intel-xhci-usb-role-switch.ko.zst intel-xway.ko.zst intel_atomisp2_led.ko.zst intel_atomisp2_pm.ko.zst intel_bxt_pmic_thermal.ko.zst intel_bxtwc_tmu.ko.zst intel_bytcrc_pwrsrc.ko.zst intel_chtdc_ti_pwrbtn.ko.zst intel_chtwc_int33fe.ko.zst intel_crystal_cove_charger.ko.zst intel_ifs.ko.zst intel_int0002_vgpio.ko.zst intel_ips.ko.zst intel_mrfld_adc.ko.zst intel_mrfld_pwrbtn.ko.zst intel_oaktrail.ko.zst intel_pch_thermal.ko.zst intel_pmc_bxt.ko.zst intel_pmc_core.ko.zst intel_pmc_core_pltdrv.ko.zst intel_pmc_mux.ko.zst intel_powerclamp.ko.zst intel_punit_ipc.ko.zst intel_qat.ko.zst intel_quark_i2c_gpio.ko.zst intel_rapl_common.ko.zst intel_rapl_msr.ko.zst intel_rapl_tpmi.ko.zst intel_sar.ko.zst intel_scu_ipcutil.ko.zst intel_scu_pltdrv.ko.zst intel_sdsi.ko.zst intel_skl_int3472_discrete.ko.zst intel_skl_int3472_tps68470.ko.zst intel_soc_dts_iosf.ko.zst intel_soc_dts_thermal.ko.zst intel_soc_pmic_bxtwc.ko.zst intel_soc_pmic_chtdc_ti.ko.zst intel_soc_pmic_mrfld.ko.zst intel_tcc_cooling.ko.zst intel_telemetry_core.ko.zst intel_telemetry_debugfs.ko.zst intel_telemetry_pltdrv.ko.zst intel_th.ko.zst intel_th_acpi.ko.zst intel_th_gth.ko.zst intel_th_msu.ko.zst intel_th_msu_sink.ko.zst intel_th_pci.ko.zst intel_th_pti.ko.zst intel_th_sth.ko.zst intel_vpu.ko.zst intel_vr_nor.ko.zst intel_vsec.ko.zst intel_vsec_tpmi.ko.zst interact.ko.zst interrupt-cnt.ko.zst inv-icm42600-i2c.ko.zst inv-icm42600-spi.ko.zst inv-icm42600.ko.zst inv-mpu6050-i2c.ko.zst inv-mpu6050-spi.ko.zst inv-mpu6050.ko.zst inv_sensors_timestamp.ko.zst io_edgeport.ko.zst io_ti.ko.zst ioatdma.ko.zst iommufd.ko.zst ionic.ko.zst iosm.ko.zst iowarrior.ko.zst ip5xxx_power.ko.zst ip6_gre.ko.zst ip6_tables.ko.zst ip6_tunnel.ko.zst ip6_udp_tunnel.ko.zst ip6_vti.ko.zst ip6t_NPT.ko.zst ip6t_REJECT.ko.zst ip6t_SYNPROXY.ko.zst ip6t_ah.ko.zst ip6t_eui64.ko.zst ip6t_frag.ko.zst ip6t_hbh.ko.zst ip6t_ipv6header.ko.zst ip6t_mh.ko.zst ip6t_rpfilter.ko.zst ip6t_rt.ko.zst ip6t_srh.ko.zst ip6table_filter.ko.zst ip6table_mangle.ko.zst ip6table_nat.ko.zst ip6table_raw.ko.zst ip6table_security.ko.zst ip_gre.ko.zst ip_set.ko.zst ip_set_bitmap_ip.ko.zst ip_set_bitmap_ipmac.ko.zst ip_set_bitmap_port.ko.zst ip_set_hash_ip.ko.zst ip_set_hash_ipmac.ko.zst ip_set_hash_ipmark.ko.zst ip_set_hash_ipport.ko.zst ip_set_hash_ipportip.ko.zst ip_set_hash_ipportnet.ko.zst ip_set_hash_mac.ko.zst ip_set_hash_net.ko.zst ip_set_hash_netiface.ko.zst ip_set_hash_netnet.ko.zst ip_set_hash_netport.ko.zst ip_set_hash_netportnet.ko.zst ip_set_list_set.ko.zst ip_tables.ko.zst ip_tunnel.ko.zst ip_vs.ko.zst ip_vs_dh.ko.zst ip_vs_fo.ko.zst ip_vs_ftp.ko.zst ip_vs_lblc.ko.zst ip_vs_lblcr.ko.zst ip_vs_lc.ko.zst ip_vs_mh.ko.zst ip_vs_nq.ko.zst ip_vs_ovf.ko.zst ip_vs_pe_sip.ko.zst ip_vs_rr.ko.zst ip_vs_sed.ko.zst ip_vs_sh.ko.zst ip_vs_twos.ko.zst ip_vs_wlc.ko.zst ip_vs_wrr.ko.zst ip_vti.ko.zst ipack.ko.zst ipaq.ko.zst ipcomp.ko.zst ipcomp6.ko.zst iphase.ko.zst ipheth.ko.zst ipip.ko.zst ipmi_devintf.ko.zst ipmi_msghandler.ko.zst ipmi_poweroff.ko.zst ipmi_si.ko.zst ipmi_ssif.ko.zst ipmi_watchdog.ko.zst ipoctal.ko.zst ipr.ko.zst ips.ko.zst ipt_ECN.ko.zst ipt_REJECT.ko.zst ipt_SYNPROXY.ko.zst ipt_ah.ko.zst ipt_rpfilter.ko.zst iptable_filter.ko.zst iptable_mangle.ko.zst iptable_nat.ko.zst iptable_raw.ko.zst iptable_security.ko.zst ipu-bridge.ko.zst ipu3-cio2.ko.zst ipu3-imgu.ko.zst ipvlan.ko.zst ipvtap.ko.zst ipw.ko.zst ipw2100.ko.zst ipw2200.ko.zst ipwireless.ko.zst iqs269a.ko.zst iqs5xx.ko.zst iqs620at-temp.ko.zst iqs621-als.ko.zst iqs624-pos.ko.zst iqs626a.ko.zst iqs62x-keys.ko.zst iqs62x.ko.zst iqs7211.ko.zst iqs7222.ko.zst ir-imon-decoder.ko.zst ir-jvc-decoder.ko.zst ir-kbd-i2c.ko.zst ir-mce_kbd-decoder.ko.zst ir-nec-decoder.ko.zst ir-rc5-decoder.ko.zst ir-rc6-decoder.ko.zst ir-rcmm-decoder.ko.zst ir-sanyo-decoder.ko.zst ir-sharp-decoder.ko.zst ir-sony-decoder.ko.zst ir-usb.ko.zst ir-xmp-decoder.ko.zst ir35221.ko.zst ir36021.ko.zst ir38064.ko.zst ir_toy.ko.zst irdma.ko.zst irps5401.ko.zst irq-madera.ko.zst irqbypass.ko.zst irsd200.ko.zst isci.ko.zst iscsi_boot_sysfs.ko.zst iscsi_ibft.ko.zst iscsi_target_mod.ko.zst iscsi_tcp.ko.zst isdnhdlc.ko.zst ishtp_eclite.ko.zst isight_firmware.ko.zst isl29003.ko.zst isl29018.ko.zst isl29020.ko.zst isl29028.ko.zst isl29125.ko.zst isl29501.ko.zst isl6271a-regulator.ko.zst isl6405.ko.zst isl6421.ko.zst isl6423.ko.zst isl68137.ko.zst isl76682.ko.zst isl9305.ko.zst isofs.ko.zst isp116x-hcd.ko.zst isp1704_charger.ko.zst isp1760.ko.zst isst_if_common.ko.zst isst_if_mbox_msr.ko.zst isst_if_mbox_pci.ko.zst isst_if_mmio.ko.zst isst_tpmi.ko.zst isst_tpmi_core.ko.zst it87.ko.zst it8712f_wdt.ko.zst it87_wdt.ko.zst it913x.ko.zst itd1000.ko.zst ite-cir.ko.zst itg3200.ko.zst iuu_phoenix.ko.zst ivsc-ace.ko.zst ivsc-csi.ko.zst ivtv-alsa.ko.zst ivtv.ko.zst ivtvfb.ko.zst iw_cm.ko.zst iw_cxgb4.ko.zst iwl3945.ko.zst iwl4965.ko.zst iwldvm.ko.zst iwlegacy.ko.zst iwlmvm.ko.zst iwlwifi.ko.zst ix2505v.ko.zst ixgbe.ko.zst ixgbevf.ko.zst janz-cmodio.ko.zst janz-ican3.ko.zst jc42.ko.zst jedec_probe.ko.zst jffs2.ko.zst jfs.ko.zst jmb38x_ms.ko.zst jme.ko.zst joydev.ko.zst joydump.ko.zst jr3_pci.ko.zst jsa1212.ko.zst jsm.ko.zst k10temp.ko.zst k8temp.ko.zst kafs.ko.zst kalmia.ko.zst kaweth.ko.zst kb3886_bl.ko.zst kbic.ko.zst kbtab.ko.zst kcm.ko.zst kcomedilib.ko.zst ke_counter.ko.zst kempld-core.ko.zst kempld_wdt.ko.zst kernelcapi.ko.zst keyspan.ko.zst keyspan_pda.ko.zst keyspan_remote.ko.zst keywrap.ko.zst kfifo_buf.ko.zst kheaders.ko.zst kionix-kx022a-i2c.ko.zst kionix-kx022a-spi.ko.zst kionix-kx022a.ko.zst kl5kusb105.ko.zst kmem.ko.zst kmx61.ko.zst kobil_sct.ko.zst ks0108.ko.zst ks0127.ko.zst ks7010.ko.zst ks8842.ko.zst ks8851_common.ko.zst ks8851_par.ko.zst ks8851_spi.ko.zst ksmbd.ko.zst ksz884x.ko.zst ksz8863_smi.ko.zst ksz9477_i2c.ko.zst ksz_spi.ko.zst ksz_switch.ko.zst ktd253-backlight.ko.zst ktti.ko.zst ktz8866.ko.zst kvaser_pci.ko.zst kvaser_pciefd.ko.zst kvaser_usb.ko.zst kvm-amd.ko.zst kvm-intel.ko.zst kvm.ko.zst kvmgt.ko.zst kxcjk-1013.ko.zst kxsd9-i2c.ko.zst kxsd9-spi.ko.zst kxsd9.ko.zst kxtj9.ko.zst kyber-iosched.ko.zst kyrofb.ko.zst l1oip.ko.zst l2tp_core.ko.zst l2tp_debugfs.ko.zst l2tp_eth.ko.zst l2tp_ip.ko.zst l2tp_ip6.ko.zst l2tp_netlink.ko.zst l2tp_ppp.ko.zst l440gx.ko.zst l4f00242t03.ko.zst l64781.ko.zst lan743x.ko.zst lan78xx.ko.zst lan9303-core.ko.zst lan9303_i2c.ko.zst lan9303_mdio.ko.zst lanai.ko.zst lantiq.ko.zst lantiq_gswip.ko.zst lapb.ko.zst lapbether.ko.zst lattice-ecp3-config.ko.zst lattice-sysconfig-spi.ko.zst lattice-sysconfig.ko.zst lcd.ko.zst lcd2s.ko.zst ldusb.ko.zst lec.ko.zst led-class-flash.ko.zst led-class-multicolor.ko.zst leds-88pm860x.ko.zst leds-aaeon.ko.zst leds-adp5520.ko.zst leds-apu.ko.zst leds-as3645a.ko.zst leds-aw200xx.ko.zst leds-bd2606mvv.ko.zst leds-bd2802.ko.zst leds-blinkm.ko.zst leds-cht-wcove.ko.zst leds-da903x.ko.zst leds-da9052.ko.zst leds-dac124s085.ko.zst leds-gpio.ko.zst leds-is31fl319x.ko.zst leds-lm3530.ko.zst leds-lm3532.ko.zst leds-lm3533.ko.zst leds-lm355x.ko.zst leds-lm3601x.ko.zst leds-lm36274.ko.zst leds-lm3642.ko.zst leds-lp3944.ko.zst leds-lp3952.ko.zst leds-lp50xx.ko.zst leds-lp8788.ko.zst leds-lt3593.ko.zst leds-max8997.ko.zst leds-mc13783.ko.zst leds-menf21bmc.ko.zst leds-mlxcpld.ko.zst leds-mlxreg.ko.zst leds-mt6323.ko.zst leds-mt6370-flash.ko.zst leds-mt6370-rgb.ko.zst leds-nic78bx.ko.zst leds-pca9532.ko.zst leds-pca955x.ko.zst leds-pca963x.ko.zst leds-pca995x.ko.zst leds-pwm-multicolor.ko.zst leds-pwm.ko.zst leds-regulator.ko.zst leds-rt8515.ko.zst leds-sgm3140.ko.zst leds-ss4200.ko.zst leds-tca6507.ko.zst leds-ti-lmu-common.ko.zst leds-tlc591xx.ko.zst leds-tps6105x.ko.zst leds-wm831x-status.ko.zst leds-wm8350.ko.zst ledtrig-activity.ko.zst ledtrig-audio.ko.zst ledtrig-backlight.ko.zst ledtrig-camera.ko.zst ledtrig-default-on.ko.zst ledtrig-gpio.ko.zst ledtrig-heartbeat.ko.zst ledtrig-netdev.ko.zst ledtrig-oneshot.ko.zst ledtrig-pattern.ko.zst ledtrig-timer.ko.zst ledtrig-transient.ko.zst ledtrig-tty.ko.zst ledtrig-usbport.ko.zst legousbtower.ko.zst lenovo-wmi-hotkey-utilities.ko.zst lenovo-ymc.ko.zst lenovo-yogabook.ko.zst lg-laptop.ko.zst lg-vl600.ko.zst lg2160.ko.zst lgdt3305.ko.zst lgdt3306a.ko.zst lgdt330x.ko.zst lgs8gl5.ko.zst lgs8gxx.ko.zst lib80211.ko.zst lib80211_crypt_ccmp.ko.zst lib80211_crypt_tkip.ko.zst lib80211_crypt_wep.ko.zst libahci.ko.zst libahci_platform.ko.zst libarc4.ko.zst libceph.ko.zst libchacha.ko.zst libchacha20poly1305.ko.zst libcomposite.ko.zst libcrc32c.ko.zst libcurve25519-generic.ko.zst libcurve25519.ko.zst libcxgb.ko.zst libcxgbi.ko.zst libdes.ko.zst libertas.ko.zst libertas_sdio.ko.zst libertas_spi.ko.zst libertas_tf.ko.zst libertas_tf_usb.ko.zst libfc.ko.zst libfcoe.ko.zst libipw.ko.zst libiscsi.ko.zst libiscsi_tcp.ko.zst libpoly1305.ko.zst libsas.ko.zst libwx.ko.zst line-display.ko.zst lineage-pem.ko.zst liquidio-core.ko.zst liquidio.ko.zst liquidio_vf.ko.zst lis3lv02d.ko.zst lis3lv02d_i2c.ko.zst lkkbd.ko.zst ll_temac.ko.zst llc.ko.zst llc2.ko.zst lm25066.ko.zst lm3533-als.ko.zst lm3533-core.ko.zst lm3533-ctrlbank.ko.zst lm3533_bl.ko.zst lm3560.ko.zst lm3630a_bl.ko.zst lm3639_bl.ko.zst lm363x-regulator.ko.zst lm3646.ko.zst lm63.ko.zst lm70.ko.zst lm73.ko.zst lm75.ko.zst lm77.ko.zst lm78.ko.zst lm80.ko.zst lm83.ko.zst lm8323.ko.zst lm8333.ko.zst lm85.ko.zst lm87.ko.zst lm90.ko.zst lm92.ko.zst lm93.ko.zst lm95234.ko.zst lm95241.ko.zst lm95245.ko.zst lmp91000.ko.zst lms283gf05.ko.zst lms501kf03.ko.zst lnbh25.ko.zst lnbh29.ko.zst lnbp21.ko.zst lnbp22.ko.zst lockd.ko.zst lp.ko.zst lp3943.ko.zst lp3971.ko.zst lp3972.ko.zst lp855x_bl.ko.zst lp8727_charger.ko.zst lp872x.ko.zst lp873x.ko.zst lp8755.ko.zst lp8788-buck.ko.zst lp8788-charger.ko.zst lp8788-ldo.ko.zst lp8788_adc.ko.zst lp8788_bl.ko.zst lpc_ich.ko.zst lpc_sch.ko.zst lpddr_cmds.ko.zst lpfc.ko.zst lru_cache.ko.zst lrw.ko.zst lt3651-charger.ko.zst lt7182s.ko.zst ltc1660.ko.zst ltc2309.ko.zst ltc2471.ko.zst ltc2485.ko.zst ltc2496.ko.zst ltc2497-core.ko.zst ltc2497.ko.zst ltc2632.ko.zst ltc2688.ko.zst ltc2941-battery-gauge.ko.zst ltc2945.ko.zst ltc2947-core.ko.zst ltc2947-i2c.ko.zst ltc2947-spi.ko.zst ltc2978.ko.zst ltc2983.ko.zst ltc2990.ko.zst ltc2991.ko.zst ltc2992.ko.zst ltc3589.ko.zst ltc3676.ko.zst ltc3815.ko.zst ltc4151.ko.zst ltc4162-l-charger.ko.zst ltc4215.ko.zst ltc4222.ko.zst ltc4245.ko.zst ltc4260.ko.zst ltc4261.ko.zst ltr390.ko.zst ltr501.ko.zst ltrf216a.ko.zst ltv350qv.ko.zst lv0104cs.ko.zst lv5207lp.ko.zst lvstest.ko.zst lxt.ko.zst lz4.ko.zst lz4_compress.ko.zst lz4hc.ko.zst lz4hc_compress.ko.zst m2m-deinterlace.ko.zst m52790.ko.zst m62332.ko.zst m88ds3103.ko.zst m88rs2000.ko.zst m88rs6000t.ko.zst mISDN_core.ko.zst mISDN_dsp.ko.zst mISDNinfineon.ko.zst mISDNipac.ko.zst mISDNisar.ko.zst m_can.ko.zst m_can_pci.ko.zst m_can_platform.ko.zst mac-celtic.ko.zst mac-centeuro.ko.zst mac-croatian.ko.zst mac-cyrillic.ko.zst mac-gaelic.ko.zst mac-greek.ko.zst mac-iceland.ko.zst mac-inuit.ko.zst mac-roman.ko.zst mac-romanian.ko.zst mac-turkish.ko.zst mac80211.ko.zst mac80211_hwsim.ko.zst mac802154.ko.zst mac802154_hwsim.ko.zst mac_hid.ko.zst macb.ko.zst macb_pci.ko.zst machxo2-spi.ko.zst machzwd.ko.zst macmodes.ko.zst macsec.ko.zst macvlan.ko.zst macvtap.ko.zst madera-i2c.ko.zst madera-spi.ko.zst madera.ko.zst mag3110.ko.zst magellan.ko.zst mailbox-altera.ko.zst mana.ko.zst mana_ib.ko.zst mantis.ko.zst mantis_core.ko.zst map_absent.ko.zst map_funcs.ko.zst map_ram.ko.zst map_rom.ko.zst marvell-88q2xxx.ko.zst marvell-88x2222.ko.zst marvell.ko.zst marvell10g.ko.zst matrix-keymap.ko.zst matrix_keypad.ko.zst matrox_w1.ko.zst matroxfb_DAC1064.ko.zst matroxfb_Ti3026.ko.zst matroxfb_accel.ko.zst matroxfb_base.ko.zst matroxfb_crtc2.ko.zst matroxfb_g450.ko.zst matroxfb_maven.ko.zst matroxfb_misc.ko.zst max1027.ko.zst max11100.ko.zst max1111.ko.zst max1118.ko.zst max11205.ko.zst max11410.ko.zst max11801_ts.ko.zst max1241.ko.zst max127.ko.zst max1363.ko.zst max14577-regulator.ko.zst max14577_charger.ko.zst max15301.ko.zst max1586.ko.zst max16064.ko.zst max16065.ko.zst max1619.ko.zst max16601.ko.zst max1668.ko.zst max17040_battery.ko.zst max17042_battery.ko.zst max1721x_battery.ko.zst max197.ko.zst max20086-regulator.ko.zst max20411-regulator.ko.zst max20730.ko.zst max20751.ko.zst max2165.ko.zst max2175.ko.zst max30100.ko.zst max30102.ko.zst max30208.ko.zst max3100.ko.zst max31722.ko.zst max31730.ko.zst max31760.ko.zst max31785.ko.zst max31790.ko.zst max31827.ko.zst max31856.ko.zst max31865.ko.zst max3420_udc.ko.zst max3421-hcd.ko.zst max34408.ko.zst max34440.ko.zst max44000.ko.zst max44009.ko.zst max517.ko.zst max5432.ko.zst max5481.ko.zst max5487.ko.zst max5522.ko.zst max5821.ko.zst max63xx_wdt.ko.zst max6620.ko.zst max6621.ko.zst max6639.ko.zst max6650.ko.zst max6697.ko.zst max6875.ko.zst max7359_keypad.ko.zst max77503-regulator.ko.zst max77541-adc.ko.zst max77541-regulator.ko.zst max77541.ko.zst max77693-haptic.ko.zst max77693-regulator.ko.zst max77693_charger.ko.zst max77826-regulator.ko.zst max77857-regulator.ko.zst max77976_charger.ko.zst max8649.ko.zst max8660.ko.zst max8688.ko.zst max8893.ko.zst max8903_charger.ko.zst max8907-regulator.ko.zst max8907.ko.zst max8925-regulator.ko.zst max8925_bl.ko.zst max8925_onkey.ko.zst max8925_power.ko.zst max8952.ko.zst max8997-regulator.ko.zst max8997_charger.ko.zst max8997_haptic.ko.zst max8998.ko.zst max8998_charger.ko.zst max9271.ko.zst max9611.ko.zst maxim_thermocouple.ko.zst mb1232.ko.zst mb862xxfb.ko.zst mb86a16.ko.zst mb86a20s.ko.zst mc.ko.zst mc13783-adc.ko.zst mc13783-pwrbutton.ko.zst mc13783-regulator.ko.zst mc13783_ts.ko.zst mc13892-regulator.ko.zst mc13xxx-core.ko.zst mc13xxx-i2c.ko.zst mc13xxx-regulator-core.ko.zst mc13xxx-spi.ko.zst mc3230.ko.zst mc34vr500.ko.zst mc44s803.ko.zst mcam-core.ko.zst mcb-lpc.ko.zst mcb-pci.ko.zst mcb.ko.zst mcba_usb.ko.zst mce-inject.ko.zst mceusb.ko.zst mchp23k256.ko.zst mchp48l640.ko.zst mchp_pci1xxxx_gp.ko.zst mchp_pci1xxxx_gpio.ko.zst mchp_pci1xxxx_otpe2p.ko.zst mcp251x.ko.zst mcp251xfd.ko.zst mcp3021.ko.zst mcp320x.ko.zst mcp3422.ko.zst mcp3564.ko.zst mcp3911.ko.zst mcp4018.ko.zst mcp41010.ko.zst mcp4131.ko.zst mcp4531.ko.zst mcp4725.ko.zst mcp4728.ko.zst mcp4821.ko.zst mcp4922.ko.zst mcp9600.ko.zst mcr20a.ko.zst mcs5000_ts.ko.zst mcs7830.ko.zst mcs_touchkey.ko.zst mct_u232.ko.zst mctp-i3c.ko.zst mctp-serial.ko.zst md-cluster.ko.zst md4.ko.zst mdc800.ko.zst mdev.ko.zst mdio-bcm-unimac.ko.zst mdio-bitbang.ko.zst mdio-cavium.ko.zst mdio-gpio.ko.zst mdio-i2c.ko.zst mdio-mscc-miim.ko.zst mdio-mvusb.ko.zst mdio-regmap.ko.zst mdio-thunder.ko.zst mdio.ko.zst me4000.ko.zst me_daq.ko.zst mediatek-ge.ko.zst megaraid.ko.zst megaraid_mbox.ko.zst megaraid_mm.ko.zst megaraid_sas.ko.zst mei-gsc.ko.zst mei-me.ko.zst mei-txe.ko.zst mei-vsc-hw.ko.zst mei-vsc.ko.zst mei.ko.zst mei_gsc_proxy.ko.zst mei_hdcp.ko.zst mei_phy.ko.zst mei_pxp.ko.zst mei_wdt.ko.zst melfas_mip4.ko.zst memory-notifier-error-inject.ko.zst memstick.ko.zst men_z135_uart.ko.zst men_z188_adc.ko.zst mena21_wdt.ko.zst menf21bmc.ko.zst menf21bmc_hwmon.ko.zst menf21bmc_wdt.ko.zst menz69_wdt.ko.zst meraki-mx100.ko.zst metro-usb.ko.zst metronomefb.ko.zst mf6x4.ko.zst mfd-aaeon.ko.zst mgag200.ko.zst mgb4.ko.zst mhi.ko.zst mhi_ep.ko.zst mhi_net.ko.zst mhi_pci_generic.ko.zst mhi_wwan_ctrl.ko.zst mhi_wwan_mbim.ko.zst mi0283qt.ko.zst michael_mic.ko.zst micrel.ko.zst microchip-spi.ko.zst microchip.ko.zst microchip_t1.ko.zst microchip_t1s.ko.zst microread.ko.zst microread_i2c.ko.zst microread_mei.ko.zst microtek.ko.zst mii.ko.zst minix.ko.zst mip6.ko.zst mipi-i3c-hci-pci.ko.zst mipi-i3c-hci.ko.zst mite.ko.zst mkiss.ko.zst ml86v7667.ko.zst mlx-platform.ko.zst mlx4_core.ko.zst mlx4_en.ko.zst mlx4_ib.ko.zst mlx5-vfio-pci.ko.zst mlx5_core.ko.zst mlx5_dpll.ko.zst mlx5_ib.ko.zst mlx5_vdpa.ko.zst mlx90614.ko.zst mlx90632.ko.zst mlx90635.ko.zst mlx_wdt.ko.zst mlxfw.ko.zst mlxreg-fan.ko.zst mlxreg-hotplug.ko.zst mlxreg-io.ko.zst mlxreg-lc.ko.zst mlxsw_core.ko.zst mlxsw_i2c.ko.zst mlxsw_minimal.ko.zst mlxsw_pci.ko.zst mlxsw_spectrum.ko.zst mm8013.ko.zst mma7455_core.ko.zst mma7455_i2c.ko.zst mma7455_spi.ko.zst mma7660.ko.zst mma8450.ko.zst mma8452.ko.zst mma9551.ko.zst mma9551_core.ko.zst mma9553.ko.zst mmc35240.ko.zst mmc_block.ko.zst mmc_spi.ko.zst mms114.ko.zst mn88443x.ko.zst mn88472.ko.zst mn88473.ko.zst mos7720.ko.zst mos7840.ko.zst most_cdev.ko.zst most_core.ko.zst most_net.ko.zst most_snd.ko.zst most_usb.ko.zst most_video.ko.zst motorcomm.ko.zst moxa.ko.zst mp2629.ko.zst mp2629_adc.ko.zst mp2629_charger.ko.zst mp2856.ko.zst mp2888.ko.zst mp2975.ko.zst mp3309c.ko.zst mp5023.ko.zst mp5990.ko.zst mp8859.ko.zst mpc624.ko.zst mpi3mr.ko.zst mpl115.ko.zst mpl115_i2c.ko.zst mpl115_spi.ko.zst mpl3115.ko.zst mpls_gso.ko.zst mpls_iptunnel.ko.zst mpls_router.ko.zst mpoa.ko.zst mpq7932.ko.zst mpr121_touchkey.ko.zst mprls0025pa.ko.zst mpt3sas.ko.zst mptbase.ko.zst mptcp_diag.ko.zst mptctl.ko.zst mptfc.ko.zst mptlan.ko.zst mptsas.ko.zst mptscsih.ko.zst mptspi.ko.zst mpu3050.ko.zst mr75203.ko.zst mrf24j40.ko.zst mrp.ko.zst ms5611_core.ko.zst ms5611_i2c.ko.zst ms5611_spi.ko.zst ms5637.ko.zst ms_block.ko.zst ms_sensors_i2c.ko.zst msa311.ko.zst mscc.ko.zst mscc_felix_dsa_lib.ko.zst mscc_ocelot_ext.ko.zst mscc_ocelot_switch_lib.ko.zst mscc_seville.ko.zst msdos.ko.zst mse102x.ko.zst msg2638.ko.zst msi-ec.ko.zst msi-laptop.ko.zst msi-wmi.ko.zst msi001.ko.zst msi2500.ko.zst msp3400.ko.zst mspro_block.ko.zst msr.ko.zst mt2060.ko.zst mt2063.ko.zst mt20xx.ko.zst mt2131.ko.zst mt2266.ko.zst mt312.ko.zst mt352.ko.zst mt6311-regulator.ko.zst mt6315-regulator.ko.zst mt6323-regulator.ko.zst mt6331-regulator.ko.zst mt6332-regulator.ko.zst mt6357-regulator.ko.zst mt6358-regulator.ko.zst mt6359-regulator.ko.zst mt6360-adc.ko.zst mt6360-core.ko.zst mt6360-regulator.ko.zst mt6360_charger.ko.zst mt6370-adc.ko.zst mt6370-backlight.ko.zst mt6370-charger.ko.zst mt6370-regulator.ko.zst mt6370.ko.zst mt6397-regulator.ko.zst mt6397.ko.zst mt7530-mdio.ko.zst mt7530-mmio.ko.zst mt7530.ko.zst mt76-connac-lib.ko.zst mt76-sdio.ko.zst mt76-usb.ko.zst mt76.ko.zst mt7601u.ko.zst mt7603e.ko.zst mt7615-common.ko.zst mt7615e.ko.zst mt7663-usb-sdio-common.ko.zst mt7663s.ko.zst mt7663u.ko.zst mt76x0-common.ko.zst mt76x02-lib.ko.zst mt76x02-usb.ko.zst mt76x0e.ko.zst mt76x0u.ko.zst mt76x2-common.ko.zst mt76x2e.ko.zst mt76x2u.ko.zst mt7915e.ko.zst mt7921-common.ko.zst mt7921e.ko.zst mt7921s.ko.zst mt7921u.ko.zst mt7925-common.ko.zst mt7925e.ko.zst mt7925u.ko.zst mt792x-lib.ko.zst mt792x-usb.ko.zst mt7996e.ko.zst mt9m001.ko.zst mt9m111.ko.zst mt9m114.ko.zst mt9p031.ko.zst mt9t112.ko.zst mt9v011.ko.zst mt9v032.ko.zst mt9v111.ko.zst mtd.ko.zst mtd_blkdevs.ko.zst mtd_dataflash.ko.zst mtdblock.ko.zst mtdblock_ro.ko.zst mtdoops.ko.zst mtdpstore.ko.zst mtdram.ko.zst mtdswap.ko.zst mtip32xx.ko.zst mtk-pmic-keys.ko.zst mtk-sd.ko.zst mtk_t7xx.ko.zst mtouch.ko.zst multiq3.ko.zst musb_hdrc.ko.zst mux-adg792a.ko.zst mux-adgs1408.ko.zst mux-core.ko.zst mux-gpio.ko.zst mv88e6060.ko.zst mv88e6xxx.ko.zst mv_u3d_core.ko.zst mv_udc.ko.zst mvmdio.ko.zst mvsas.ko.zst mvumi.ko.zst mwave.ko.zst mwifiex.ko.zst mwifiex_pcie.ko.zst mwifiex_sdio.ko.zst mwifiex_usb.ko.zst mwl8k.ko.zst mxb.ko.zst mxc4005.ko.zst mxc6255.ko.zst mxic_nand.ko.zst mxl-gpy.ko.zst mxl111sf-demod.ko.zst mxl111sf-tuner.ko.zst mxl301rf.ko.zst mxl5005s.ko.zst mxl5007t.ko.zst mxl5xx.ko.zst mxl692.ko.zst mxm-wmi.ko.zst mxser.ko.zst mxuport.ko.zst myrb.ko.zst myri10ge.ko.zst myrs.ko.zst n411.ko.zst n5pf.ko.zst n_gsm.ko.zst n_hdlc.ko.zst nand.ko.zst nandcore.ko.zst nandsim.ko.zst national.ko.zst natsemi.ko.zst nau7802.ko.zst navman.ko.zst nb7vpq904m.ko.zst nbd.ko.zst nci.ko.zst nci_spi.ko.zst nci_uart.ko.zst ncn26000.ko.zst nct6683.ko.zst nct6775-core.ko.zst nct6775-i2c.ko.zst nct6775.ko.zst nct7802.ko.zst nct7904.ko.zst nd_btt.ko.zst nd_pmem.ko.zst nd_virtio.ko.zst ne2k-pci.ko.zst neofb.ko.zst net1080.ko.zst net2272.ko.zst net2280.ko.zst netconsole.ko.zst netdevsim.ko.zst netfs.ko.zst netjet.ko.zst netlink_diag.ko.zst netrom.ko.zst nettel.ko.zst netup-unidvb.ko.zst netxen_nic.ko.zst newtonkbd.ko.zst nf_conncount.ko.zst nf_conntrack.ko.zst nf_conntrack_amanda.ko.zst nf_conntrack_bridge.ko.zst nf_conntrack_broadcast.ko.zst nf_conntrack_ftp.ko.zst nf_conntrack_h323.ko.zst nf_conntrack_irc.ko.zst nf_conntrack_netbios_ns.ko.zst nf_conntrack_netlink.ko.zst nf_conntrack_pptp.ko.zst nf_conntrack_sane.ko.zst nf_conntrack_sip.ko.zst nf_conntrack_snmp.ko.zst nf_conntrack_tftp.ko.zst nf_defrag_ipv4.ko.zst nf_defrag_ipv6.ko.zst nf_dup_ipv4.ko.zst nf_dup_ipv6.ko.zst nf_dup_netdev.ko.zst nf_flow_table.ko.zst nf_flow_table_inet.ko.zst nf_log_syslog.ko.zst nf_nat.ko.zst nf_nat_amanda.ko.zst nf_nat_ftp.ko.zst nf_nat_h323.ko.zst nf_nat_irc.ko.zst nf_nat_pptp.ko.zst nf_nat_sip.ko.zst nf_nat_snmp_basic.ko.zst nf_nat_tftp.ko.zst nf_reject_ipv4.ko.zst nf_reject_ipv6.ko.zst nf_socket_ipv4.ko.zst nf_socket_ipv6.ko.zst nf_synproxy_core.ko.zst nf_tables.ko.zst nf_tproxy_ipv4.ko.zst nf_tproxy_ipv6.ko.zst nfc.ko.zst nfc_digital.ko.zst nfcmrvl.ko.zst nfcmrvl_i2c.ko.zst nfcmrvl_spi.ko.zst nfcmrvl_uart.ko.zst nfcmrvl_usb.ko.zst nfcsim.ko.zst nfit.ko.zst nfnetlink.ko.zst nfnetlink_acct.ko.zst nfnetlink_cthelper.ko.zst nfnetlink_cttimeout.ko.zst nfnetlink_hook.ko.zst nfnetlink_log.ko.zst nfnetlink_osf.ko.zst nfnetlink_queue.ko.zst nfp.ko.zst nfs.ko.zst nfs_acl.ko.zst nfs_layout_flexfiles.ko.zst nfs_layout_nfsv41_files.ko.zst nfsd.ko.zst nfsv2.ko.zst nfsv3.ko.zst nfsv4.ko.zst nft_chain_nat.ko.zst nft_compat.ko.zst nft_connlimit.ko.zst nft_ct.ko.zst nft_dup_ipv4.ko.zst nft_dup_ipv6.ko.zst nft_dup_netdev.ko.zst nft_fib.ko.zst nft_fib_inet.ko.zst nft_fib_ipv4.ko.zst nft_fib_ipv6.ko.zst nft_fib_netdev.ko.zst nft_flow_offload.ko.zst nft_fwd_netdev.ko.zst nft_hash.ko.zst nft_limit.ko.zst nft_log.ko.zst nft_masq.ko.zst nft_meta_bridge.ko.zst nft_nat.ko.zst nft_numgen.ko.zst nft_osf.ko.zst nft_queue.ko.zst nft_quota.ko.zst nft_redir.ko.zst nft_reject.ko.zst nft_reject_bridge.ko.zst nft_reject_inet.ko.zst nft_reject_ipv4.ko.zst nft_reject_ipv6.ko.zst nft_reject_netdev.ko.zst nft_socket.ko.zst nft_synproxy.ko.zst nft_tproxy.ko.zst nft_tunnel.ko.zst nft_xfrm.ko.zst nftl.ko.zst ngbe.ko.zst ngene.ko.zst nhc_dest.ko.zst nhc_fragment.ko.zst nhc_hop.ko.zst nhc_ipv6.ko.zst nhc_mobility.ko.zst nhc_routing.ko.zst nhc_udp.ko.zst nhpoly1305-avx2.ko.zst nhpoly1305-sse2.ko.zst nhpoly1305.ko.zst ni903x_wdt.ko.zst ni_6527.ko.zst ni_65xx.ko.zst ni_660x.ko.zst ni_670x.ko.zst ni_at_a2150.ko.zst ni_at_ao.ko.zst ni_atmio.ko.zst ni_atmio16d.ko.zst ni_daq_700.ko.zst ni_daq_dio24.ko.zst ni_labpc.ko.zst ni_labpc_common.ko.zst ni_labpc_cs.ko.zst ni_labpc_isadma.ko.zst ni_labpc_pci.ko.zst ni_mio_cs.ko.zst ni_pcidio.ko.zst ni_pcimio.ko.zst ni_routes_test.ko.zst ni_routing.ko.zst ni_tio.ko.zst ni_tiocmd.ko.zst ni_usb6501.ko.zst nic7018_wdt.ko.zst nicpf.ko.zst nicstar.ko.zst nicvf.ko.zst nilfs2.ko.zst nitro_enclaves.ko.zst niu.ko.zst nixge.ko.zst nlmon.ko.zst nls_ascii.ko.zst nls_cp1250.ko.zst nls_cp1251.ko.zst nls_cp1255.ko.zst nls_cp737.ko.zst nls_cp775.ko.zst nls_cp850.ko.zst nls_cp852.ko.zst nls_cp855.ko.zst nls_cp857.ko.zst nls_cp860.ko.zst nls_cp861.ko.zst nls_cp862.ko.zst nls_cp863.ko.zst nls_cp864.ko.zst nls_cp865.ko.zst nls_cp866.ko.zst nls_cp869.ko.zst nls_cp874.ko.zst nls_cp932.ko.zst nls_cp936.ko.zst nls_cp949.ko.zst nls_cp950.ko.zst nls_euc-jp.ko.zst nls_iso8859-1.ko.zst nls_iso8859-13.ko.zst nls_iso8859-14.ko.zst nls_iso8859-15.ko.zst nls_iso8859-2.ko.zst nls_iso8859-3.ko.zst nls_iso8859-4.ko.zst nls_iso8859-5.ko.zst nls_iso8859-6.ko.zst nls_iso8859-7.ko.zst nls_iso8859-9.ko.zst nls_koi8-r.ko.zst nls_koi8-ru.ko.zst nls_koi8-u.ko.zst nls_ucs2_utils.ko.zst nls_utf8.ko.zst nmclan_cs.ko.zst noa1305.ko.zst nosy.ko.zst notifier-error-inject.ko.zst nouveau.ko.zst novatek-nvt-ts.ko.zst nozomi.ko.zst npcm750-pwm-fan.ko.zst ns83820.ko.zst nsh.ko.zst nsm.ko.zst ntb.ko.zst ntb_hw_epf.ko.zst ntb_hw_idt.ko.zst ntb_hw_intel.ko.zst ntb_hw_switchtec.ko.zst ntb_netdev.ko.zst ntb_perf.ko.zst ntb_pingpong.ko.zst ntb_tool.ko.zst ntb_transport.ko.zst ntc_thermistor.ko.zst ntfs.ko.zst ntfs3.ko.zst null_blk.ko.zst nuvoton-cir.ko.zst nv_tco.ko.zst nvidia-wmi-ec-backlight.ko.zst nvidiafb.ko.zst nvme-auth.ko.zst nvme-core.ko.zst nvme-fabrics.ko.zst nvme-fc.ko.zst nvme-keyring.ko.zst nvme-loop.ko.zst nvme-rdma.ko.zst nvme-tcp.ko.zst nvme.ko.zst nvmem-rave-sp-eeprom.ko.zst nvmem-rmem.ko.zst nvmem_qcom-spmi-sdam.ko.zst nvmet-fc.ko.zst nvmet-rdma.ko.zst nvmet-tcp.ko.zst nvmet.ko.zst nvram.ko.zst nvsw-sn2201.ko.zst nxp-c45-tja.ko.zst nxp-cbtx.ko.zst nxp-nci.ko.zst nxp-nci_i2c.ko.zst nxp-tja11xx.ko.zst nxt200x.ko.zst nxt6000.ko.zst nzxt-kraken2.ko.zst nzxt-smart2.ko.zst objagg.ko.zst occ-hwmon-common.ko.zst occ-p8-hwmon.ko.zst ocelot-soc.ko.zst ocfb.ko.zst ocfs2.ko.zst ocfs2_dlm.ko.zst ocfs2_dlmfs.ko.zst ocfs2_nodemanager.ko.zst ocfs2_stack_o2cb.ko.zst ocfs2_stack_user.ko.zst ocfs2_stackglue.ko.zst ocrdma.ko.zst octeon_ep.ko.zst of_mmc_spi.ko.zst of_xilinx_wdt.ko.zst og01a1b.ko.zst omfs.ko.zst omninet.ko.zst on20.ko.zst on26.ko.zst onenand.ko.zst opa_vnic.ko.zst opencores-kbd.ko.zst openvswitch.ko.zst opt3001.ko.zst opt4001.ko.zst opticon.ko.zst option.ko.zst or51132.ko.zst or51211.ko.zst orangefs.ko.zst oti6858.ko.zst otm3225a.ko.zst ov01a10.ko.zst ov02a10.ko.zst ov08d10.ko.zst ov08x40.ko.zst ov13858.ko.zst ov13b10.ko.zst ov2640.ko.zst ov2659.ko.zst ov2680.ko.zst ov2685.ko.zst ov2740.ko.zst ov4689.ko.zst ov5647.ko.zst ov5648.ko.zst ov5670.ko.zst ov5675.ko.zst ov5693.ko.zst ov5695.ko.zst ov64a40.ko.zst ov6650.ko.zst ov7251.ko.zst ov7640.ko.zst ov7670.ko.zst ov772x.ko.zst ov7740.ko.zst ov8856.ko.zst ov8858.ko.zst ov8865.ko.zst ov9640.ko.zst ov9650.ko.zst ov9734.ko.zst overlay.ko.zst oxp-sensors.ko.zst oxu210hp-hcd.ko.zst p4-clockmod.ko.zst p54common.ko.zst p54pci.ko.zst p54spi.ko.zst p54usb.ko.zst p8022.ko.zst pa12203001.ko.zst padlock-aes.ko.zst padlock-sha.ko.zst palmas-pwrbutton.ko.zst palmas-regulator.ko.zst palmas_gpadc.ko.zst panasonic-laptop.ko.zst pandora_bl.ko.zst panel-auo-a030jtn01.ko.zst panel-ilitek-ili9341.ko.zst panel-mipi-dbi.ko.zst panel-orisetech-ota5601a.ko.zst panel-raspberrypi-touchscreen.ko.zst panel-widechips-ws2401.ko.zst panel.ko.zst parkbd.ko.zst parman.ko.zst parport.ko.zst parport_cs.ko.zst parport_pc.ko.zst parport_serial.ko.zst pata_acpi.ko.zst pata_ali.ko.zst pata_amd.ko.zst pata_artop.ko.zst pata_atiixp.ko.zst pata_atp867x.ko.zst pata_cmd640.ko.zst pata_cmd64x.ko.zst pata_cypress.ko.zst pata_efar.ko.zst pata_hpt366.ko.zst pata_hpt37x.ko.zst pata_hpt3x2n.ko.zst pata_hpt3x3.ko.zst pata_it8213.ko.zst pata_it821x.ko.zst pata_jmicron.ko.zst pata_legacy.ko.zst pata_marvell.ko.zst pata_mpiix.ko.zst pata_netcell.ko.zst pata_ninja32.ko.zst pata_ns87410.ko.zst pata_ns87415.ko.zst pata_oldpiix.ko.zst pata_opti.ko.zst pata_optidma.ko.zst pata_parport.ko.zst pata_pcmcia.ko.zst pata_pdc2027x.ko.zst pata_pdc202xx_old.ko.zst pata_piccolo.ko.zst pata_radisys.ko.zst pata_rdc.ko.zst pata_rz1000.ko.zst pata_sch.ko.zst pata_serverworks.ko.zst pata_sil680.ko.zst pata_sl82c105.ko.zst pata_triflex.ko.zst pata_via.ko.zst pc300too.ko.zst pc87360.ko.zst pc87413_wdt.ko.zst pc87427.ko.zst pca9450-regulator.ko.zst pcap-regulator.ko.zst pcap_keys.ko.zst pcap_ts.ko.zst pcbc.ko.zst pcengines-apuv2.ko.zst pcf50633-adc.ko.zst pcf50633-backlight.ko.zst pcf50633-charger.ko.zst pcf50633-gpio.ko.zst pcf50633-input.ko.zst pcf50633-regulator.ko.zst pcf50633.ko.zst pcf8574_keypad.ko.zst pcf8591.ko.zst pch_udc.ko.zst pci-epf-mhi.ko.zst pci-epf-ntb.ko.zst pci-epf-vntb.ko.zst pci-hyperv-intf.ko.zst pci-hyperv.ko.zst pci-pf-stub.ko.zst pci-stub.ko.zst pci.ko.zst pci200syn.ko.zst pcips2.ko.zst pcl711.ko.zst pcl724.ko.zst pcl726.ko.zst pcl730.ko.zst pcl812.ko.zst pcl816.ko.zst pcl818.ko.zst pcm3724.ko.zst pcmad.ko.zst pcmcia.ko.zst pcmcia_core.ko.zst pcmcia_rsrc.ko.zst pcmciamtd.ko.zst pcmda12.ko.zst pcmmio.ko.zst pcmuio.ko.zst pcnet32.ko.zst pcnet_cs.ko.zst pcrypt.ko.zst pcs-lynx.ko.zst pcs-mtk-lynxi.ko.zst pcs_xpcs.ko.zst pcspkr.ko.zst pcwd_pci.ko.zst pcwd_usb.ko.zst pd6729.ko.zst pdc_adma.ko.zst pds-vfio-pci.ko.zst pds_core.ko.zst pds_vdpa.ko.zst peak_pci.ko.zst peak_pciefd.ko.zst peak_pcmcia.ko.zst peak_usb.ko.zst peci-cpu.ko.zst peci-cputemp.ko.zst peci-dimmtemp.ko.zst peci.ko.zst pegasus.ko.zst pegasus_notetaker.ko.zst penmount.ko.zst pfr_telemetry.ko.zst pfr_update.ko.zst phantom.ko.zst phonet.ko.zst phram.ko.zst phy-bcm-kona-usb2.ko.zst phy-can-transceiver.ko.zst phy-cpcap-usb.ko.zst phy-exynos-usb2.ko.zst phy-generic.ko.zst phy-gpio-vbus-usb.ko.zst phy-intel-lgm-emmc.ko.zst phy-isp1301.ko.zst phy-lgm-usb.ko.zst phy-pxa-28nm-hsic.ko.zst phy-pxa-28nm-usb2.ko.zst phy-qcom-usb-hs.ko.zst phy-qcom-usb-hsic.ko.zst phy-tahvo.ko.zst phy-tusb1210.ko.zst phylink.ko.zst physmap.ko.zst pi3usb30532.ko.zst pi433.ko.zst pim4328.ko.zst pinctrl-alderlake.ko.zst pinctrl-broxton.ko.zst pinctrl-cannonlake.ko.zst pinctrl-cedarfork.ko.zst pinctrl-cs42l43.ko.zst pinctrl-cy8c95x0.ko.zst pinctrl-da9062.ko.zst pinctrl-denverton.ko.zst pinctrl-elkhartlake.ko.zst pinctrl-emmitsburg.ko.zst pinctrl-geminilake.ko.zst pinctrl-icelake.ko.zst pinctrl-intel-platform.ko.zst pinctrl-jasperlake.ko.zst pinctrl-lakefield.ko.zst pinctrl-lewisburg.ko.zst pinctrl-lynxpoint.ko.zst pinctrl-madera.ko.zst pinctrl-mcp23s08.ko.zst pinctrl-mcp23s08_i2c.ko.zst pinctrl-mcp23s08_spi.ko.zst pinctrl-meteorlake.ko.zst pinctrl-meteorpoint.ko.zst pinctrl-sunrisepoint.ko.zst pinctrl-tigerlake.ko.zst pinephone-keyboard.ko.zst ping.ko.zst pistachio-internal-dac.ko.zst pixcir_i2c_ts.ko.zst pkcs7_test_key.ko.zst pkcs8_key_parser.ko.zst pktgen.ko.zst pl2303.ko.zst plat-ram.ko.zst plat_nand.ko.zst platform_lcd.ko.zst platform_profile.ko.zst plfxlc.ko.zst pli1209bc.ko.zst plip.ko.zst plusb.ko.zst pluto2.ko.zst plx_dma.ko.zst plx_pci.ko.zst pm-notifier-error-inject.ko.zst pm2fb.ko.zst pm3fb.ko.zst pm6764tr.ko.zst pm80xx.ko.zst pmbus.ko.zst pmbus_core.ko.zst pmc551.ko.zst pmcraid.ko.zst pmic_pdcharger_ulog.ko.zst pms7003.ko.zst pmt_class.ko.zst pmt_crashlog.ko.zst pmt_telemetry.ko.zst pn532_uart.ko.zst pn533.ko.zst pn533_i2c.ko.zst pn533_usb.ko.zst pn544.ko.zst pn544_i2c.ko.zst pn544_mei.ko.zst pn_pep.ko.zst pnd2_edac.ko.zst poly1305-x86_64.ko.zst poly1305_generic.ko.zst polynomial.ko.zst polyval-clmulni.ko.zst polyval-generic.ko.zst port100.ko.zst powermate.ko.zst powerz.ko.zst powr1220.ko.zst ppa.ko.zst ppdev.ko.zst ppp_async.ko.zst ppp_deflate.ko.zst ppp_mppe.ko.zst ppp_synctty.ko.zst pppoatm.ko.zst pppoe.ko.zst pppox.ko.zst pps-gpio.ko.zst pps-ldisc.ko.zst pps_parport.ko.zst pptp.ko.zst prestera.ko.zst prestera_pci.ko.zst pretimeout_panic.ko.zst prism2_usb.ko.zst processor_thermal_device.ko.zst processor_thermal_device_pci.ko.zst processor_thermal_device_pci_legacy.ko.zst processor_thermal_mbox.ko.zst processor_thermal_power_floor.ko.zst processor_thermal_rapl.ko.zst processor_thermal_rfim.ko.zst processor_thermal_wt_hint.ko.zst processor_thermal_wt_req.ko.zst ps2-gpio.ko.zst ps2mult.ko.zst psample.ko.zst pse_regulator.ko.zst psmouse.ko.zst psnap.ko.zst pstore_blk.ko.zst pstore_zone.ko.zst psxpad-spi.ko.zst ptdma.ko.zst ptn36502.ko.zst ptp_clockmatrix.ko.zst ptp_dfl_tod.ko.zst ptp_idt82p33.ko.zst ptp_ines.ko.zst ptp_kvm.ko.zst ptp_mock.ko.zst ptp_ocp.ko.zst ptp_vmw.ko.zst pulse8-cec.ko.zst pulsedlight-lidar-lite-v2.ko.zst punit_atom_debug.ko.zst pv88060-regulator.ko.zst pv88080-regulator.ko.zst pv88090-regulator.ko.zst pvcalls-front.ko.zst pvpanic-mmio.ko.zst pvpanic-pci.ko.zst pvpanic.ko.zst pvrusb2.ko.zst pwc.ko.zst pwm-beeper.ko.zst pwm-clk.ko.zst pwm-cros-ec.ko.zst pwm-dwc-core.ko.zst pwm-dwc.ko.zst pwm-iqs620a.ko.zst pwm-lp3943.ko.zst pwm-pca9685.ko.zst pwm-regulator.ko.zst pwm-twl-led.ko.zst pwm-twl.ko.zst pwm-vibra.ko.zst pwm_bl.ko.zst pxa27x_udc.ko.zst pxe1610.ko.zst pxrc.ko.zst q54sj108a2.ko.zst qaic.ko.zst qat_420xx.ko.zst qat_4xxx.ko.zst qat_c3xxx.ko.zst qat_c3xxxvf.ko.zst qat_c62x.ko.zst qat_c62xvf.ko.zst qat_dh895xcc.ko.zst qat_dh895xccvf.ko.zst qca8k.ko.zst qcaux.ko.zst qcom-emac.ko.zst qcom-labibb-regulator.ko.zst qcom-spmi-adc5.ko.zst qcom-spmi-iadc.ko.zst qcom-spmi-vadc.ko.zst qcom-vadc-common.ko.zst qcom-wled.ko.zst qcom_glink.ko.zst qcom_glink_rpm.ko.zst qcom_spmi-regulator.ko.zst qcom_usb_vbus-regulator.ko.zst qcserial.ko.zst qed.ko.zst qede.ko.zst qedf.ko.zst qedi.ko.zst qedr.ko.zst qemu_fw_cfg.ko.zst qinfo_probe.ko.zst qla1280.ko.zst qla2xxx.ko.zst qla3xxx.ko.zst qla4xxx.ko.zst qlcnic.ko.zst qlogic_cs.ko.zst qlogicfas408.ko.zst qm1d1b0004.ko.zst qm1d1c0042.ko.zst qmi_helpers.ko.zst qmi_wwan.ko.zst qnx4.ko.zst qnx6.ko.zst qrtr-mhi.ko.zst qrtr-smd.ko.zst qrtr-tun.ko.zst qrtr.ko.zst qsemi.ko.zst qt1010.ko.zst qt1050.ko.zst qt1070.ko.zst qt2160.ko.zst qtnfmac.ko.zst qtnfmac_pcie.ko.zst quatech2.ko.zst quatech_daqp_cs.ko.zst quota_tree.ko.zst quota_v1.ko.zst quota_v2.ko.zst qwiic-joystick.ko.zst qxl.ko.zst r592.ko.zst r6040.ko.zst r8152.ko.zst r8153_ecm.ko.zst r8169.ko.zst r8192e_pci.ko.zst r820t.ko.zst r852.ko.zst r8712u.ko.zst r8723bs.ko.zst r8a66597-hcd.ko.zst r8a66597-udc.ko.zst raa215300.ko.zst radeon.ko.zst radeonfb.ko.zst radio-keene.ko.zst radio-ma901.ko.zst radio-maxiradio.ko.zst radio-mr800.ko.zst radio-platform-si4713.ko.zst radio-raremono.ko.zst radio-shark.ko.zst radio-si470x-common.ko.zst radio-si470x-i2c.ko.zst radio-si470x-usb.ko.zst radio-si476x.ko.zst radio-tea5764.ko.zst radio-usb-si4713.ko.zst radio-wl1273.ko.zst raid0.ko.zst raid1.ko.zst raid10.ko.zst raid456.ko.zst raid6_pq.ko.zst raid_class.ko.zst rainshadow-cec.ko.zst ramoops.ko.zst rapl.ko.zst rave-sp-backlight.ko.zst rave-sp-pwrbutton.ko.zst rave-sp-wdt.ko.zst rave-sp.ko.zst raw_diag.ko.zst raw_gadget.ko.zst raydium_i2c_ts.ko.zst rbd.ko.zst rc-adstech-dvb-t-pci.ko.zst rc-alink-dtu-m.ko.zst rc-anysee.ko.zst rc-apac-viewcomp.ko.zst rc-astrometa-t2hybrid.ko.zst rc-asus-pc39.ko.zst rc-asus-ps3-100.ko.zst rc-ati-tv-wonder-hd-600.ko.zst rc-ati-x10.ko.zst rc-avermedia-a16d.ko.zst rc-avermedia-cardbus.ko.zst rc-avermedia-dvbt.ko.zst rc-avermedia-m135a.ko.zst rc-avermedia-m733a-rm-k6.ko.zst rc-avermedia-rm-ks.ko.zst rc-avermedia.ko.zst rc-avertv-303.ko.zst rc-azurewave-ad-tu700.ko.zst rc-beelink-gs1.ko.zst rc-beelink-mxiii.ko.zst rc-behold-columbus.ko.zst rc-behold.ko.zst rc-budget-ci-old.ko.zst rc-cinergy-1400.ko.zst rc-cinergy.ko.zst rc-core.ko.zst rc-ct-90405.ko.zst rc-d680-dmb.ko.zst rc-delock-61959.ko.zst rc-dib0700-nec.ko.zst rc-dib0700-rc5.ko.zst rc-digitalnow-tinytwin.ko.zst rc-digittrade.ko.zst rc-dm1105-nec.ko.zst rc-dntv-live-dvb-t.ko.zst rc-dntv-live-dvbt-pro.ko.zst rc-dreambox.ko.zst rc-dtt200u.ko.zst rc-dvbsky.ko.zst rc-dvico-mce.ko.zst rc-dvico-portable.ko.zst rc-em-terratec.ko.zst rc-encore-enltv-fm53.ko.zst rc-encore-enltv.ko.zst rc-encore-enltv2.ko.zst rc-evga-indtube.ko.zst rc-eztv.ko.zst rc-flydvb.ko.zst rc-flyvideo.ko.zst rc-fusionhdtv-mce.ko.zst rc-gadmei-rm008z.ko.zst rc-geekbox.ko.zst rc-genius-tvgo-a11mce.ko.zst rc-gotview7135.ko.zst rc-hauppauge.ko.zst rc-hisi-poplar.ko.zst rc-hisi-tv-demo.ko.zst rc-imon-mce.ko.zst rc-imon-pad.ko.zst rc-imon-rsc.ko.zst rc-iodata-bctv7e.ko.zst rc-it913x-v1.ko.zst rc-it913x-v2.ko.zst rc-kaiomy.ko.zst rc-khadas.ko.zst rc-khamsin.ko.zst rc-kworld-315u.ko.zst rc-kworld-pc150u.ko.zst rc-kworld-plus-tv-analog.ko.zst rc-leadtek-y04g0051.ko.zst rc-lme2510.ko.zst rc-loopback.ko.zst rc-manli.ko.zst rc-mecool-kii-pro.ko.zst rc-mecool-kiii-pro.ko.zst rc-medion-x10-digitainer.ko.zst rc-medion-x10-or2x.ko.zst rc-medion-x10.ko.zst rc-minix-neo.ko.zst rc-msi-digivox-ii.ko.zst rc-msi-digivox-iii.ko.zst rc-msi-tvanywhere-plus.ko.zst rc-msi-tvanywhere.ko.zst rc-nebula.ko.zst rc-nec-terratec-cinergy-xs.ko.zst rc-norwood.ko.zst rc-npgtech.ko.zst rc-odroid.ko.zst rc-pctv-sedna.ko.zst rc-pine64.ko.zst rc-pinnacle-color.ko.zst rc-pinnacle-grey.ko.zst rc-pinnacle-pctv-hd.ko.zst rc-pixelview-002t.ko.zst rc-pixelview-mk12.ko.zst rc-pixelview-new.ko.zst rc-pixelview.ko.zst rc-powercolor-real-angel.ko.zst rc-proteus-2309.ko.zst rc-purpletv.ko.zst rc-pv951.ko.zst rc-rc6-mce.ko.zst rc-real-audio-220-32-keys.ko.zst rc-reddo.ko.zst rc-snapstream-firefly.ko.zst rc-streamzap.ko.zst rc-su3000.ko.zst rc-tanix-tx3mini.ko.zst rc-tanix-tx5max.ko.zst rc-tbs-nec.ko.zst rc-technisat-ts35.ko.zst rc-technisat-usb2.ko.zst rc-terratec-cinergy-c-pci.ko.zst rc-terratec-cinergy-s2-hd.ko.zst rc-terratec-cinergy-xs.ko.zst rc-terratec-slim-2.ko.zst rc-terratec-slim.ko.zst rc-tevii-nec.ko.zst rc-tivo.ko.zst rc-total-media-in-hand-02.ko.zst rc-total-media-in-hand.ko.zst rc-trekstor.ko.zst rc-tt-1500.ko.zst rc-twinhan-dtv-cab-ci.ko.zst rc-twinhan1027.ko.zst rc-vega-s9x.ko.zst rc-videomate-m1f.ko.zst rc-videomate-s350.ko.zst rc-videomate-tv-pvr.ko.zst rc-videostrong-kii-pro.ko.zst rc-wetek-hub.ko.zst rc-wetek-play2.ko.zst rc-winfast-usbii-deluxe.ko.zst rc-winfast.ko.zst rc-x96max.ko.zst rc-xbox-360.ko.zst rc-xbox-dvd.ko.zst rc-zx-irdec.ko.zst rc5t583-regulator.ko.zst rdacm20.ko.zst rdacm21.ko.zst rdc321x-southbridge.ko.zst rdma_cm.ko.zst rdma_rxe.ko.zst rdma_ucm.ko.zst rdmavt.ko.zst rds.ko.zst rds_rdma.ko.zst rds_tcp.ko.zst realtek.ko.zst redboot.ko.zst redrat3.ko.zst reed_solomon.ko.zst regmap-i3c.ko.zst regmap-sccb.ko.zst regmap-sdw-mbq.ko.zst regmap-sdw.ko.zst regmap-slimbus.ko.zst regmap-spi-avmm.ko.zst regmap-spmi.ko.zst regmap-w1.ko.zst regulator-haptic.ko.zst reiserfs.ko.zst repaper.ko.zst reset-ti-syscon.ko.zst reset-tps380x.ko.zst resistive-adc-touch.ko.zst retu-mfd.ko.zst retu-pwrbutton.ko.zst retu_wdt.ko.zst rfc1051.ko.zst rfc1201.ko.zst rfcomm.ko.zst rfd77402.ko.zst rfd_ftl.ko.zst rfkill-gpio.ko.zst rio-scan.ko.zst rio_cm.ko.zst rio_mport_cdev.ko.zst rionet.ko.zst rivafb.ko.zst rj54n1cb0c.ko.zst rm3100-core.ko.zst rm3100-i2c.ko.zst rm3100-spi.ko.zst rmd160.ko.zst rmi_core.ko.zst rmi_i2c.ko.zst rmi_smbus.ko.zst rmi_spi.ko.zst rmnet.ko.zst rnbd-client.ko.zst rnbd-server.ko.zst rndis_host.ko.zst rockchip.ko.zst rocker.ko.zst rohm-bm1390.ko.zst rohm-bu27008.ko.zst rohm-bu27034.ko.zst rohm_bu21023.ko.zst romfs.ko.zst rose.ko.zst rotary_encoder.ko.zst rp2.ko.zst rpcrdma.ko.zst rpcsec_gss_krb5.ko.zst rpmsg_char.ko.zst rpmsg_core.ko.zst rpmsg_ctrl.ko.zst rpmsg_ns.ko.zst rpmsg_tty.ko.zst rpmsg_wwan_ctrl.ko.zst rpr0521.ko.zst rsi_91x.ko.zst rsi_sdio.ko.zst rsi_usb.ko.zst rt1719.ko.zst rt2400pci.ko.zst rt2500pci.ko.zst rt2500usb.ko.zst rt2800lib.ko.zst rt2800mmio.ko.zst rt2800pci.ko.zst rt2800usb.ko.zst rt2x00lib.ko.zst rt2x00mmio.ko.zst rt2x00pci.ko.zst rt2x00usb.ko.zst rt4801-regulator.ko.zst rt4803.ko.zst rt4831-backlight.ko.zst rt4831-regulator.ko.zst rt4831.ko.zst rt5033-regulator.ko.zst rt5033.ko.zst rt5033_battery.ko.zst rt5033_charger.ko.zst rt5120-pwrkey.ko.zst rt5120-regulator.ko.zst rt5120.ko.zst rt5190a-regulator.ko.zst rt5739.ko.zst rt5759-regulator.ko.zst rt6160-regulator.ko.zst rt6190-regulator.ko.zst rt61pci.ko.zst rt6245-regulator.ko.zst rt73usb.ko.zst rt9455_charger.ko.zst rt9467-charger.ko.zst rt9471.ko.zst rtc-88pm80x.ko.zst rtc-88pm860x.ko.zst rtc-ab-b5ze-s3.ko.zst rtc-ab-eoz9.ko.zst rtc-abx80x.ko.zst rtc-bq32k.ko.zst rtc-cros-ec.ko.zst rtc-da9052.ko.zst rtc-da9055.ko.zst rtc-da9063.ko.zst rtc-ds1286.ko.zst rtc-ds1302.ko.zst rtc-ds1305.ko.zst rtc-ds1307.ko.zst rtc-ds1343.ko.zst rtc-ds1347.ko.zst rtc-ds1374.ko.zst rtc-ds1390.ko.zst rtc-ds1511.ko.zst rtc-ds1553.ko.zst rtc-ds1672.ko.zst rtc-ds1685.ko.zst rtc-ds1742.ko.zst rtc-ds2404.ko.zst rtc-ds3232.ko.zst rtc-em3027.ko.zst rtc-fm3130.ko.zst rtc-ftrtc010.ko.zst rtc-goldfish.ko.zst rtc-hid-sensor-time.ko.zst rtc-isl12022.ko.zst rtc-isl1208.ko.zst rtc-lp8788.ko.zst rtc-m41t80.ko.zst rtc-m41t93.ko.zst rtc-m41t94.ko.zst rtc-m48t35.ko.zst rtc-m48t59.ko.zst rtc-m48t86.ko.zst rtc-max31335.ko.zst rtc-max6900.ko.zst rtc-max6902.ko.zst rtc-max6916.ko.zst rtc-max8907.ko.zst rtc-max8925.ko.zst rtc-max8997.ko.zst rtc-max8998.ko.zst rtc-mc13xxx.ko.zst rtc-mcp795.ko.zst rtc-msm6242.ko.zst rtc-mt6397.ko.zst rtc-palmas.ko.zst rtc-pcap.ko.zst rtc-pcf2123.ko.zst rtc-pcf2127.ko.zst rtc-pcf50633.ko.zst rtc-pcf85063.ko.zst rtc-pcf8523.ko.zst rtc-pcf85363.ko.zst rtc-pcf8563.ko.zst rtc-pcf8583.ko.zst rtc-r9701.ko.zst rtc-rc5t583.ko.zst rtc-rp5c01.ko.zst rtc-rs5c348.ko.zst rtc-rs5c372.ko.zst rtc-rv3028.ko.zst rtc-rv3029c2.ko.zst rtc-rv3032.ko.zst rtc-rv8803.ko.zst rtc-rx4581.ko.zst rtc-rx6110.ko.zst rtc-rx8010.ko.zst rtc-rx8025.ko.zst rtc-rx8581.ko.zst rtc-s35390a.ko.zst rtc-sd3078.ko.zst rtc-stk17ta8.ko.zst rtc-tps6586x.ko.zst rtc-tps65910.ko.zst rtc-tps6594.ko.zst rtc-wilco-ec.ko.zst rtc-wm831x.ko.zst rtc-wm8350.ko.zst rtc-x1205.ko.zst rtd520.ko.zst rti800.ko.zst rti802.ko.zst rtl2830.ko.zst rtl2832.ko.zst rtl2832_sdr.ko.zst rtl8150.ko.zst rtl8187.ko.zst rtl8188ee.ko.zst rtl818x_pci.ko.zst rtl8192c-common.ko.zst rtl8192ce.ko.zst rtl8192cu.ko.zst rtl8192de.ko.zst rtl8192ee.ko.zst rtl8192se.ko.zst rtl8365mb.ko.zst rtl8366.ko.zst rtl8723-common.ko.zst rtl8723ae.ko.zst rtl8723be.ko.zst rtl8821ae.ko.zst rtl8xxxu.ko.zst rtl_pci.ko.zst rtl_usb.ko.zst rtllib.ko.zst rtllib_crypt_ccmp.ko.zst rtllib_crypt_tkip.ko.zst rtllib_crypt_wep.ko.zst rtlwifi.ko.zst rtmv20-regulator.ko.zst rtq2134-regulator.ko.zst rtq2208-regulator.ko.zst rtq6056.ko.zst rtq6752-regulator.ko.zst rtrs-client.ko.zst rtrs-core.ko.zst rtrs-server.ko.zst rts5208.ko.zst rtsx_pci.ko.zst rtsx_pci_ms.ko.zst rtsx_pci_sdmmc.ko.zst rtsx_usb.ko.zst rtsx_usb_ms.ko.zst rtsx_usb_sdmmc.ko.zst rtw88_8723d.ko.zst rtw88_8723de.ko.zst rtw88_8723ds.ko.zst rtw88_8723du.ko.zst rtw88_8821c.ko.zst rtw88_8821ce.ko.zst rtw88_8821cs.ko.zst rtw88_8821cu.ko.zst rtw88_8822b.ko.zst rtw88_8822be.ko.zst rtw88_8822bs.ko.zst rtw88_8822bu.ko.zst rtw88_8822c.ko.zst rtw88_8822ce.ko.zst rtw88_8822cs.ko.zst rtw88_8822cu.ko.zst rtw88_core.ko.zst rtw88_pci.ko.zst rtw88_sdio.ko.zst rtw88_usb.ko.zst rtw89_8851b.ko.zst rtw89_8851be.ko.zst rtw89_8852a.ko.zst rtw89_8852ae.ko.zst rtw89_8852b.ko.zst rtw89_8852be.ko.zst rtw89_8852c.ko.zst rtw89_8852ce.ko.zst rtw89_core.ko.zst rtw89_pci.ko.zst rx51_battery.ko.zst rxperf.ko.zst rxrpc.ko.zst s1d13xxxfb.ko.zst s2250.ko.zst s2255drv.ko.zst s2io.ko.zst s3fb.ko.zst s3fwrn5.ko.zst s3fwrn5_i2c.ko.zst s3fwrn82_uart.ko.zst s526.ko.zst s5c73m3.ko.zst s5h1409.ko.zst s5h1411.ko.zst s5h1420.ko.zst s5h1432.ko.zst s5k5baf.ko.zst s5k6a3.ko.zst s626.ko.zst s6sy761.ko.zst s921.ko.zst saa6588.ko.zst saa6752hs.ko.zst saa7110.ko.zst saa7115.ko.zst saa7127.ko.zst saa7134-alsa.ko.zst saa7134-dvb.ko.zst saa7134-empress.ko.zst saa7134-go7007.ko.zst saa7134.ko.zst saa7146.ko.zst saa7146_vv.ko.zst saa7164.ko.zst saa717x.ko.zst saa7185.ko.zst saa7706h.ko.zst safe_serial.ko.zst sample-trace-array.ko.zst samsung-keypad.ko.zst samsung-laptop.ko.zst samsung-q10.ko.zst samsung-sxgbe.ko.zst sata_dwc_460ex.ko.zst sata_inic162x.ko.zst sata_mv.ko.zst sata_nv.ko.zst sata_promise.ko.zst sata_qstor.ko.zst sata_sil.ko.zst sata_sil24.ko.zst sata_sis.ko.zst sata_svw.ko.zst sata_sx4.ko.zst sata_uli.ko.zst sata_via.ko.zst sata_vsc.ko.zst savagefb.ko.zst sb1000.ko.zst sb_edac.ko.zst sbc60xxwdt.ko.zst sbc_epx_c3.ko.zst sbc_fitpc2_wdt.ko.zst sbc_gxx.ko.zst sbp_target.ko.zst sbrmi.ko.zst sbs-battery.ko.zst sbs-charger.ko.zst sbs-manager.ko.zst sbs.ko.zst sbshc.ko.zst sbtsi_temp.ko.zst sc1200wdt.ko.zst sc16is7xx.ko.zst sc92031.ko.zst sca3000.ko.zst sca3300.ko.zst scb2_flash.ko.zst scd30_core.ko.zst scd30_i2c.ko.zst scd30_serial.ko.zst scd4x.ko.zst sch311x_wdt.ko.zst sch5627.ko.zst sch5636.ko.zst sch56xx-common.ko.zst sch_cake.ko.zst sch_cbs.ko.zst sch_choke.ko.zst sch_codel.ko.zst sch_drr.ko.zst sch_etf.ko.zst sch_ets.ko.zst sch_fq.ko.zst sch_fq_codel.ko.zst sch_fq_pie.ko.zst sch_gred.ko.zst sch_hfsc.ko.zst sch_hhf.ko.zst sch_htb.ko.zst sch_ingress.ko.zst sch_mqprio.ko.zst sch_mqprio_lib.ko.zst sch_multiq.ko.zst sch_netem.ko.zst sch_pie.ko.zst sch_plug.ko.zst sch_prio.ko.zst sch_qfq.ko.zst sch_red.ko.zst sch_sfb.ko.zst sch_sfq.ko.zst sch_skbprio.ko.zst sch_taprio.ko.zst sch_tbf.ko.zst sch_teql.ko.zst scsi_debug.ko.zst scsi_dh_alua.ko.zst scsi_dh_emc.ko.zst scsi_dh_hp_sw.ko.zst scsi_dh_rdac.ko.zst scsi_transport_fc.ko.zst scsi_transport_iscsi.ko.zst scsi_transport_sas.ko.zst scsi_transport_spi.ko.zst scsi_transport_srp.ko.zst sctp.ko.zst sctp_diag.ko.zst sd_adc_modulator.ko.zst sdhci-acpi.ko.zst sdhci-pci.ko.zst sdhci-pltfm.ko.zst sdhci-xenon-driver.ko.zst sdhci.ko.zst sdhci_f_sdh30.ko.zst sdio_uart.ko.zst sdricoh_cs.ko.zst seco-cec.ko.zst sel3350-platform.ko.zst sensehat-joystick.ko.zst sensorhub.ko.zst serial-multi-instantiate.ko.zst serial_cs.ko.zst serial_ir.ko.zst serio_raw.ko.zst sermouse.ko.zst serpent-avx-x86_64.ko.zst serpent-avx2.ko.zst serpent-sse2-x86_64.ko.zst serpent_generic.ko.zst serport.ko.zst ses.ko.zst sev-guest.ko.zst sf-pdma.ko.zst sfc-falcon.ko.zst sfc-siena.ko.zst sfc.ko.zst sfp.ko.zst sgi_w1.ko.zst sgp30.ko.zst sgp40.ko.zst sha1-ssse3.ko.zst sha256-ssse3.ko.zst shark2.ko.zst sht15.ko.zst sht21.ko.zst sht3x.ko.zst sht4x.ko.zst shtc1.ko.zst si1133.ko.zst si1145.ko.zst si2157.ko.zst si2165.ko.zst si2168.ko.zst si21xx.ko.zst si4713.ko.zst si476x-core.ko.zst si7005.ko.zst si7020.ko.zst sidewinder.ko.zst sierra.ko.zst sierra_net.ko.zst sil164.ko.zst silead.ko.zst silicom-platform.ko.zst simatic-ipc-batt-apollolake.ko.zst simatic-ipc-batt-elkhartlake.ko.zst simatic-ipc-batt-f7188x.ko.zst simatic-ipc-batt.ko.zst simatic-ipc-leds-gpio-apollolake.ko.zst simatic-ipc-leds-gpio-core.ko.zst simatic-ipc-leds-gpio-elkhartlake.ko.zst simatic-ipc-leds-gpio-f7188x.ko.zst simatic-ipc-leds.ko.zst simatic-ipc-wdt.ko.zst simatic-ipc.ko.zst simple-mfd-i2c.ko.zst siox-bus-gpio.ko.zst siox-core.ko.zst sis-agp.ko.zst sis190.ko.zst sis5595.ko.zst sis900.ko.zst sis_i2c.ko.zst sisfb.ko.zst sisusbvga.ko.zst sit.ko.zst siw.ko.zst sja1000.ko.zst sja1000_isa.ko.zst sja1000_platform.ko.zst sja1105.ko.zst skfp.ko.zst skge.ko.zst skx_edac.ko.zst skx_edac_common.ko.zst sky2.ko.zst sky81452-backlight.ko.zst sky81452-regulator.ko.zst sky81452.ko.zst sl811-hcd.ko.zst sl811_cs.ko.zst slcan.ko.zst slg51000-regulator.ko.zst slicoss.ko.zst slim-qcom-ctrl.ko.zst slimbus.ko.zst slip.ko.zst slram.ko.zst sm2_generic.ko.zst sm3-avx-x86_64.ko.zst sm3.ko.zst sm3_generic.ko.zst sm4-aesni-avx-x86_64.ko.zst sm4-aesni-avx2-x86_64.ko.zst sm4.ko.zst sm4_generic.ko.zst sm501.ko.zst sm501fb.ko.zst sm712fb.ko.zst sm750fb.ko.zst sm_common.ko.zst sm_ftl.ko.zst smartpqi.ko.zst smb347-charger.ko.zst smc.ko.zst smc91c92_cs.ko.zst smc_diag.ko.zst smipcie.ko.zst smpro-core.ko.zst smpro-errmon.ko.zst smpro-hwmon.ko.zst smpro-misc.ko.zst smsc.ko.zst smsc37b787_wdt.ko.zst smsc47b397.ko.zst smsc47m1.ko.zst smsc47m192.ko.zst smsc75xx.ko.zst smsc911x.ko.zst smsc9420.ko.zst smsc95xx.ko.zst smscufx.ko.zst smsdvb.ko.zst smsmdtv.ko.zst smssdio.ko.zst smsusb.ko.zst snd-ac97-codec.ko.zst snd-acp-config.ko.zst snd-acp-i2s.ko.zst snd-acp-legacy-common.ko.zst snd-acp-legacy-mach.ko.zst snd-acp-mach.ko.zst snd-acp-pci.ko.zst snd-acp-pcm.ko.zst snd-acp-pdm.ko.zst snd-acp-rembrandt.ko.zst snd-acp-renoir.ko.zst snd-acp-sof-mach.ko.zst snd-acp3x-i2s.ko.zst snd-acp3x-pcm-dma.ko.zst snd-acp3x-pdm-dma.ko.zst snd-acp3x-rn.ko.zst snd-acp5x-i2s.ko.zst snd-acp5x-pcm-dma.ko.zst snd-acp63.ko.zst snd-acp6x-pdm-dma.ko.zst snd-acp70.ko.zst snd-ad1889.ko.zst snd-ak4113.ko.zst snd-ak4114.ko.zst snd-ak4117.ko.zst snd-ak4xxx-adda.ko.zst snd-ali5451.ko.zst snd-aloop.ko.zst snd-als300.ko.zst snd-als4000.ko.zst snd-asihpi.ko.zst snd-atiixp-modem.ko.zst snd-atiixp.ko.zst snd-au8810.ko.zst snd-au8820.ko.zst snd-au8830.ko.zst snd-aw2.ko.zst snd-azt3328.ko.zst snd-bcd2000.ko.zst snd-bebob.ko.zst snd-bt87x.ko.zst snd-ca0106.ko.zst snd-cmipci.ko.zst snd-compress.ko.zst snd-cs4281.ko.zst snd-cs46xx.ko.zst snd-cs8427.ko.zst snd-ctl-led.ko.zst snd-ctxfi.ko.zst snd-darla20.ko.zst snd-darla24.ko.zst snd-dice.ko.zst snd-dummy.ko.zst snd-echo3g.ko.zst snd-emu10k1-synth.ko.zst snd-emu10k1.ko.zst snd-emu10k1x.ko.zst snd-emux-synth.ko.zst snd-ens1370.ko.zst snd-ens1371.ko.zst snd-es1938.ko.zst snd-es1968.ko.zst snd-fireface.ko.zst snd-firewire-digi00x.ko.zst snd-firewire-lib.ko.zst snd-firewire-motu.ko.zst snd-firewire-tascam.ko.zst snd-fireworks.ko.zst snd-fm801.ko.zst snd-gina20.ko.zst snd-gina24.ko.zst snd-hda-cirrus-scodec.ko.zst snd-hda-codec-analog.ko.zst snd-hda-codec-ca0110.ko.zst snd-hda-codec-ca0132.ko.zst snd-hda-codec-cirrus.ko.zst snd-hda-codec-cmedia.ko.zst snd-hda-codec-conexant.ko.zst snd-hda-codec-cs8409.ko.zst snd-hda-codec-generic.ko.zst snd-hda-codec-hdmi.ko.zst snd-hda-codec-idt.ko.zst snd-hda-codec-realtek.ko.zst snd-hda-codec-si3054.ko.zst snd-hda-codec-via.ko.zst snd-hda-codec.ko.zst snd-hda-core.ko.zst snd-hda-cs-dsp-ctls.ko.zst snd-hda-ext-core.ko.zst snd-hda-intel.ko.zst snd-hda-scodec-cs35l41-i2c.ko.zst snd-hda-scodec-cs35l41-spi.ko.zst snd-hda-scodec-cs35l41.ko.zst snd-hda-scodec-cs35l56-i2c.ko.zst snd-hda-scodec-cs35l56-spi.ko.zst snd-hda-scodec-cs35l56.ko.zst snd-hda-scodec-tas2781-i2c.ko.zst snd-hdmi-lpe-audio.ko.zst snd-hdsp.ko.zst snd-hdspm.ko.zst snd-hrtimer.ko.zst snd-hwdep.ko.zst snd-i2c.ko.zst snd-ice1712.ko.zst snd-ice1724.ko.zst snd-ice17xx-ak4xxx.ko.zst snd-indigo.ko.zst snd-indigodj.ko.zst snd-indigodjx.ko.zst snd-indigoio.ko.zst snd-indigoiox.ko.zst snd-intel-dspcfg.ko.zst snd-intel-sdw-acpi.ko.zst snd-intel-sst-acpi.ko.zst snd-intel-sst-core.ko.zst snd-intel-sst-pci.ko.zst snd-intel8x0.ko.zst snd-intel8x0m.ko.zst snd-isight.ko.zst snd-korg1212.ko.zst snd-layla20.ko.zst snd-layla24.ko.zst snd-lola.ko.zst snd-lx6464es.ko.zst snd-maestro3.ko.zst snd-mia.ko.zst snd-mixart.ko.zst snd-mixer-oss.ko.zst snd-mona.ko.zst snd-mpu401-uart.ko.zst snd-mpu401.ko.zst snd-mtpav.ko.zst snd-mts64.ko.zst snd-nm256.ko.zst snd-opl3-lib.ko.zst snd-opl3-synth.ko.zst snd-oxfw.ko.zst snd-oxygen-lib.ko.zst snd-oxygen.ko.zst snd-pci-acp3x.ko.zst snd-pci-acp5x.ko.zst snd-pci-acp6x.ko.zst snd-pci-ps.ko.zst snd-pcm-dmaengine.ko.zst snd-pcm.ko.zst snd-pcmtest.ko.zst snd-pcsp.ko.zst snd-pcxhr.ko.zst snd-pdaudiocf.ko.zst snd-portman2x4.ko.zst snd-ps-pdm-dma.ko.zst snd-ps-sdw-dma.ko.zst snd-pt2258.ko.zst snd-rawmidi.ko.zst snd-riptide.ko.zst snd-rme32.ko.zst snd-rme96.ko.zst snd-rme9652.ko.zst snd-rn-pci-acp3x.ko.zst snd-rpl-pci-acp6x.ko.zst snd-sb-common.ko.zst snd-seq-device.ko.zst snd-seq-dummy.ko.zst snd-seq-midi-emul.ko.zst snd-seq-midi-event.ko.zst snd-seq-midi.ko.zst snd-seq-ump-client.ko.zst snd-seq-virmidi.ko.zst snd-seq.ko.zst snd-serial-u16550.ko.zst snd-skl_nau88l25_max98357a.ko.zst snd-soc-63xx.ko.zst snd-soc-ac97.ko.zst snd-soc-acp-da7219mx98357-mach.ko.zst snd-soc-acp-es8336-mach.ko.zst snd-soc-acp-rt5645-mach.ko.zst snd-soc-acp-rt5682-mach.ko.zst snd-soc-acp5x-mach.ko.zst snd-soc-acp6x-mach.ko.zst snd-soc-acpi-intel-match.ko.zst snd-soc-acpi.ko.zst snd-soc-adau-utils.ko.zst snd-soc-adau1372-i2c.ko.zst snd-soc-adau1372-spi.ko.zst snd-soc-adau1372.ko.zst snd-soc-adau1701.ko.zst snd-soc-adau1761-i2c.ko.zst snd-soc-adau1761-spi.ko.zst snd-soc-adau1761.ko.zst snd-soc-adau17x1.ko.zst snd-soc-adau7002.ko.zst snd-soc-adau7118-hw.ko.zst snd-soc-adau7118-i2c.ko.zst snd-soc-adau7118.ko.zst snd-soc-adi-axi-i2s.ko.zst snd-soc-adi-axi-spdif.ko.zst snd-soc-ak4104.ko.zst snd-soc-ak4118.ko.zst snd-soc-ak4375.ko.zst snd-soc-ak4458.ko.zst snd-soc-ak4554.ko.zst snd-soc-ak4613.ko.zst snd-soc-ak4642.ko.zst snd-soc-ak5386.ko.zst snd-soc-ak5558.ko.zst snd-soc-alc5623.ko.zst snd-soc-arizona.ko.zst snd-soc-audio-iio-aux.ko.zst snd-soc-avs-da7219.ko.zst snd-soc-avs-dmic.ko.zst snd-soc-avs-es8336.ko.zst snd-soc-avs-hdaudio.ko.zst snd-soc-avs-i2s-test.ko.zst snd-soc-avs-max98357a.ko.zst snd-soc-avs-max98373.ko.zst snd-soc-avs-max98927.ko.zst snd-soc-avs-nau8825.ko.zst snd-soc-avs-probe.ko.zst snd-soc-avs-rt274.ko.zst snd-soc-avs-rt286.ko.zst snd-soc-avs-rt298.ko.zst snd-soc-avs-rt5514.ko.zst snd-soc-avs-rt5663.ko.zst snd-soc-avs-rt5682.ko.zst snd-soc-avs-ssm4567.ko.zst snd-soc-avs.ko.zst snd-soc-aw8738.ko.zst snd-soc-aw87390.ko.zst snd-soc-aw88261.ko.zst snd-soc-aw88395-lib.ko.zst snd-soc-aw88395.ko.zst snd-soc-aw88399.ko.zst snd-soc-bd28623.ko.zst snd-soc-bdw-rt286.ko.zst snd-soc-bt-sco.ko.zst snd-soc-catpt.ko.zst snd-soc-chv3-codec.ko.zst snd-soc-cml_rt1011_rt5682.ko.zst snd-soc-core.ko.zst snd-soc-cros-ec-codec.ko.zst snd-soc-cs35l32.ko.zst snd-soc-cs35l33.ko.zst snd-soc-cs35l34.ko.zst snd-soc-cs35l35.ko.zst snd-soc-cs35l36.ko.zst snd-soc-cs35l41-i2c.ko.zst snd-soc-cs35l41-lib.ko.zst snd-soc-cs35l41-spi.ko.zst snd-soc-cs35l41.ko.zst snd-soc-cs35l45-i2c.ko.zst snd-soc-cs35l45-spi.ko.zst snd-soc-cs35l45.ko.zst snd-soc-cs35l56-i2c.ko.zst snd-soc-cs35l56-sdw.ko.zst snd-soc-cs35l56-shared.ko.zst snd-soc-cs35l56-spi.ko.zst snd-soc-cs35l56.ko.zst snd-soc-cs4234.ko.zst snd-soc-cs4265.ko.zst snd-soc-cs4270.ko.zst snd-soc-cs4271-i2c.ko.zst snd-soc-cs4271-spi.ko.zst snd-soc-cs4271.ko.zst snd-soc-cs42l42-i2c.ko.zst snd-soc-cs42l42-sdw.ko.zst snd-soc-cs42l42.ko.zst snd-soc-cs42l43-sdw.ko.zst snd-soc-cs42l43.ko.zst snd-soc-cs42l51-i2c.ko.zst snd-soc-cs42l51.ko.zst snd-soc-cs42l52.ko.zst snd-soc-cs42l56.ko.zst snd-soc-cs42l73.ko.zst snd-soc-cs42l83-i2c.ko.zst snd-soc-cs42xx8-i2c.ko.zst snd-soc-cs42xx8.ko.zst snd-soc-cs43130.ko.zst snd-soc-cs4341.ko.zst snd-soc-cs4349.ko.zst snd-soc-cs53l30.ko.zst snd-soc-cx2072x.ko.zst snd-soc-da7213.ko.zst snd-soc-da7219.ko.zst snd-soc-dmic.ko.zst snd-soc-ehl-rt5660.ko.zst snd-soc-es7134.ko.zst snd-soc-es7241.ko.zst snd-soc-es8316.ko.zst snd-soc-es8326.ko.zst snd-soc-es8328-i2c.ko.zst snd-soc-es8328-spi.ko.zst snd-soc-es8328.ko.zst snd-soc-es83xx-dsm-common.ko.zst snd-soc-fsl-asrc.ko.zst snd-soc-fsl-audmix.ko.zst snd-soc-fsl-easrc.ko.zst snd-soc-fsl-esai.ko.zst snd-soc-fsl-micfil.ko.zst snd-soc-fsl-mqs.ko.zst snd-soc-fsl-sai.ko.zst snd-soc-fsl-spdif.ko.zst snd-soc-fsl-ssi.ko.zst snd-soc-fsl-utils.ko.zst snd-soc-fsl-xcvr.ko.zst snd-soc-gtm601.ko.zst snd-soc-hda-codec.ko.zst snd-soc-hdac-hda.ko.zst snd-soc-hdac-hdmi.ko.zst snd-soc-hdmi-codec.ko.zst snd-soc-hsw-rt5640.ko.zst snd-soc-ics43432.ko.zst snd-soc-idt821034.ko.zst snd-soc-imx-audmux.ko.zst snd-soc-inno-rk3036.ko.zst snd-soc-intel-hda-dsp-common.ko.zst snd-soc-intel-sof-board-helpers.ko.zst snd-soc-intel-sof-cirrus-common.ko.zst snd-soc-intel-sof-maxim-common.ko.zst snd-soc-intel-sof-nuvoton-common.ko.zst snd-soc-intel-sof-realtek-common.ko.zst snd-soc-intel-sof-ssp-common.ko.zst snd-soc-kbl_da7219_max98357a.ko.zst snd-soc-kbl_da7219_max98927.ko.zst snd-soc-kbl_rt5660.ko.zst snd-soc-kbl_rt5663_max98927.ko.zst snd-soc-kbl_rt5663_rt5514_max98927.ko.zst snd-soc-lpass-macro-common.ko.zst snd-soc-lpass-rx-macro.ko.zst snd-soc-lpass-tx-macro.ko.zst snd-soc-lpass-va-macro.ko.zst snd-soc-lpass-wsa-macro.ko.zst snd-soc-max9759.ko.zst snd-soc-max98088.ko.zst snd-soc-max98090.ko.zst snd-soc-max98357a.ko.zst snd-soc-max98363.ko.zst snd-soc-max98373-i2c.ko.zst snd-soc-max98373-sdw.ko.zst snd-soc-max98373.ko.zst snd-soc-max98388.ko.zst snd-soc-max98390.ko.zst snd-soc-max98396.ko.zst snd-soc-max98504.ko.zst snd-soc-max98520.ko.zst snd-soc-max9860.ko.zst snd-soc-max9867.ko.zst snd-soc-max98927.ko.zst snd-soc-msm8916-analog.ko.zst snd-soc-msm8916-digital.ko.zst snd-soc-mt6351.ko.zst snd-soc-mt6358.ko.zst snd-soc-mt6660.ko.zst snd-soc-nau8315.ko.zst snd-soc-nau8540.ko.zst snd-soc-nau8810.ko.zst snd-soc-nau8821.ko.zst snd-soc-nau8822.ko.zst snd-soc-nau8824.ko.zst snd-soc-nau8825.ko.zst snd-soc-pcm1681.ko.zst snd-soc-pcm1789-codec.ko.zst snd-soc-pcm1789-i2c.ko.zst snd-soc-pcm179x-codec.ko.zst snd-soc-pcm179x-i2c.ko.zst snd-soc-pcm179x-spi.ko.zst snd-soc-pcm186x-i2c.ko.zst snd-soc-pcm186x-spi.ko.zst snd-soc-pcm186x.ko.zst snd-soc-pcm3060-i2c.ko.zst snd-soc-pcm3060-spi.ko.zst snd-soc-pcm3060.ko.zst snd-soc-pcm3168a-i2c.ko.zst snd-soc-pcm3168a-spi.ko.zst snd-soc-pcm3168a.ko.zst snd-soc-pcm5102a.ko.zst snd-soc-pcm512x-i2c.ko.zst snd-soc-pcm512x-spi.ko.zst snd-soc-pcm512x.ko.zst snd-soc-peb2466.ko.zst snd-soc-ps-mach.ko.zst snd-soc-rk3328.ko.zst snd-soc-rl6231.ko.zst snd-soc-rl6347a.ko.zst snd-soc-rt1011.ko.zst snd-soc-rt1015.ko.zst snd-soc-rt1015p.ko.zst snd-soc-rt1017-sdca.ko.zst snd-soc-rt1019.ko.zst snd-soc-rt1308-sdw.ko.zst snd-soc-rt1308.ko.zst snd-soc-rt1316-sdw.ko.zst snd-soc-rt1318-sdw.ko.zst snd-soc-rt274.ko.zst snd-soc-rt286.ko.zst snd-soc-rt298.ko.zst snd-soc-rt5514-spi.ko.zst snd-soc-rt5514.ko.zst snd-soc-rt5616.ko.zst snd-soc-rt5631.ko.zst snd-soc-rt5640.ko.zst snd-soc-rt5645.ko.zst snd-soc-rt5651.ko.zst snd-soc-rt5659.ko.zst snd-soc-rt5660.ko.zst snd-soc-rt5663.ko.zst snd-soc-rt5670.ko.zst snd-soc-rt5677-spi.ko.zst snd-soc-rt5677.ko.zst snd-soc-rt5682-i2c.ko.zst snd-soc-rt5682-sdw.ko.zst snd-soc-rt5682.ko.zst snd-soc-rt5682s.ko.zst snd-soc-rt700.ko.zst snd-soc-rt711-sdca.ko.zst snd-soc-rt711.ko.zst snd-soc-rt712-sdca-dmic.ko.zst snd-soc-rt712-sdca.ko.zst snd-soc-rt715-sdca.ko.zst snd-soc-rt715.ko.zst snd-soc-rt722-sdca.ko.zst snd-soc-rt9120.ko.zst snd-soc-rtq9128.ko.zst snd-soc-sdw-mockup.ko.zst snd-soc-sgtl5000.ko.zst snd-soc-si476x.ko.zst snd-soc-sigmadsp-i2c.ko.zst snd-soc-sigmadsp-regmap.ko.zst snd-soc-sigmadsp.ko.zst snd-soc-simple-amplifier.ko.zst snd-soc-simple-card-utils.ko.zst snd-soc-simple-card.ko.zst snd-soc-simple-mux.ko.zst snd-soc-skl-ssp-clk.ko.zst snd-soc-skl.ko.zst snd-soc-skl_hda_dsp.ko.zst snd-soc-skl_nau88l25_ssm4567.ko.zst snd-soc-skl_rt286.ko.zst snd-soc-sma1303.ko.zst snd-soc-sof-sdw.ko.zst snd-soc-sof-ssp-amp.ko.zst snd-soc-sof_cs42l42.ko.zst snd-soc-sof_da7219.ko.zst snd-soc-sof_es8336.ko.zst snd-soc-sof_nau8825.ko.zst snd-soc-sof_rt5682.ko.zst snd-soc-spdif-rx.ko.zst snd-soc-spdif-tx.ko.zst snd-soc-src4xxx-i2c.ko.zst snd-soc-src4xxx.ko.zst snd-soc-ssm2305.ko.zst snd-soc-ssm2518.ko.zst snd-soc-ssm2602-i2c.ko.zst snd-soc-ssm2602-spi.ko.zst snd-soc-ssm2602.ko.zst snd-soc-ssm4567.ko.zst snd-soc-sst-atom-hifi2-platform.ko.zst snd-soc-sst-bdw-rt5650-mach.ko.zst snd-soc-sst-bdw-rt5677-mach.ko.zst snd-soc-sst-bxt-da7219_max98357a.ko.zst snd-soc-sst-bxt-rt298.ko.zst snd-soc-sst-byt-cht-cx2072x.ko.zst snd-soc-sst-byt-cht-da7213.ko.zst snd-soc-sst-byt-cht-es8316.ko.zst snd-soc-sst-bytcr-rt5640.ko.zst snd-soc-sst-bytcr-rt5651.ko.zst snd-soc-sst-bytcr-wm5102.ko.zst snd-soc-sst-cht-bsw-max98090_ti.ko.zst snd-soc-sst-cht-bsw-nau8824.ko.zst snd-soc-sst-cht-bsw-rt5645.ko.zst snd-soc-sst-cht-bsw-rt5672.ko.zst snd-soc-sst-dsp.ko.zst snd-soc-sst-glk-rt5682_max98357a.ko.zst snd-soc-sst-ipc.ko.zst snd-soc-sst-sof-pcm512x.ko.zst snd-soc-sst-sof-wm8804.ko.zst snd-soc-sta32x.ko.zst snd-soc-sta350.ko.zst snd-soc-sti-sas.ko.zst snd-soc-tas2552.ko.zst snd-soc-tas2562.ko.zst snd-soc-tas2764.ko.zst snd-soc-tas2770.ko.zst snd-soc-tas2780.ko.zst snd-soc-tas2781-comlib.ko.zst snd-soc-tas2781-fmwlib.ko.zst snd-soc-tas2781-i2c.ko.zst snd-soc-tas5086.ko.zst snd-soc-tas571x.ko.zst snd-soc-tas5720.ko.zst snd-soc-tas5805m.ko.zst snd-soc-tas6424.ko.zst snd-soc-tda7419.ko.zst snd-soc-tfa9879.ko.zst snd-soc-tfa989x.ko.zst snd-soc-tlv320adc3xxx.ko.zst snd-soc-tlv320adcx140.ko.zst snd-soc-tlv320aic23-i2c.ko.zst snd-soc-tlv320aic23-spi.ko.zst snd-soc-tlv320aic23.ko.zst snd-soc-tlv320aic31xx.ko.zst snd-soc-tlv320aic32x4-i2c.ko.zst snd-soc-tlv320aic32x4-spi.ko.zst snd-soc-tlv320aic32x4.ko.zst snd-soc-tlv320aic3x-i2c.ko.zst snd-soc-tlv320aic3x-spi.ko.zst snd-soc-tlv320aic3x.ko.zst snd-soc-tpa6130a2.ko.zst snd-soc-ts3a227e.ko.zst snd-soc-tscs42xx.ko.zst snd-soc-tscs454.ko.zst snd-soc-uda1334.ko.zst snd-soc-wcd-classh.ko.zst snd-soc-wcd-mbhc.ko.zst snd-soc-wcd9335.ko.zst snd-soc-wcd934x.ko.zst snd-soc-wcd938x-sdw.ko.zst snd-soc-wcd938x.ko.zst snd-soc-wm-adsp.ko.zst snd-soc-wm5102.ko.zst snd-soc-wm8510.ko.zst snd-soc-wm8523.ko.zst snd-soc-wm8524.ko.zst snd-soc-wm8580.ko.zst snd-soc-wm8711.ko.zst snd-soc-wm8728.ko.zst snd-soc-wm8731-i2c.ko.zst snd-soc-wm8731-spi.ko.zst snd-soc-wm8731.ko.zst snd-soc-wm8737.ko.zst snd-soc-wm8741.ko.zst snd-soc-wm8750.ko.zst snd-soc-wm8753.ko.zst snd-soc-wm8770.ko.zst snd-soc-wm8776.ko.zst snd-soc-wm8782.ko.zst snd-soc-wm8804-i2c.ko.zst snd-soc-wm8804-spi.ko.zst snd-soc-wm8804.ko.zst snd-soc-wm8903.ko.zst snd-soc-wm8904.ko.zst snd-soc-wm8940.ko.zst snd-soc-wm8960.ko.zst snd-soc-wm8961.ko.zst snd-soc-wm8962.ko.zst snd-soc-wm8974.ko.zst snd-soc-wm8978.ko.zst snd-soc-wm8985.ko.zst snd-soc-wsa881x.ko.zst snd-soc-wsa883x.ko.zst snd-soc-wsa884x.ko.zst snd-soc-xlnx-formatter-pcm.ko.zst snd-soc-xlnx-i2s.ko.zst snd-soc-xlnx-spdif.ko.zst snd-soc-xtfpga-i2s.ko.zst snd-soc-zl38060.ko.zst snd-sof-acpi-intel-bdw.ko.zst snd-sof-acpi-intel-byt.ko.zst snd-sof-acpi.ko.zst snd-sof-amd-acp.ko.zst snd-sof-amd-acp63.ko.zst snd-sof-amd-rembrandt.ko.zst snd-sof-amd-renoir.ko.zst snd-sof-amd-vangogh.ko.zst snd-sof-intel-atom.ko.zst snd-sof-intel-hda-common.ko.zst snd-sof-intel-hda-mlink.ko.zst snd-sof-intel-hda.ko.zst snd-sof-pci-intel-apl.ko.zst snd-sof-pci-intel-cnl.ko.zst snd-sof-pci-intel-icl.ko.zst snd-sof-pci-intel-lnl.ko.zst snd-sof-pci-intel-mtl.ko.zst snd-sof-pci-intel-skl.ko.zst snd-sof-pci-intel-tgl.ko.zst snd-sof-pci-intel-tng.ko.zst snd-sof-pci.ko.zst snd-sof-probes.ko.zst snd-sof-utils.ko.zst snd-sof-xtensa-dsp.ko.zst snd-sof.ko.zst snd-sonicvibes.ko.zst snd-timer.ko.zst snd-trident.ko.zst snd-ua101.ko.zst snd-ump.ko.zst snd-usb-6fire.ko.zst snd-usb-audio.ko.zst snd-usb-caiaq.ko.zst snd-usb-hiface.ko.zst snd-usb-line6.ko.zst snd-usb-pod.ko.zst snd-usb-podhd.ko.zst snd-usb-toneport.ko.zst snd-usb-us122l.ko.zst snd-usb-usx2y.ko.zst snd-usb-variax.ko.zst snd-usbmidi-lib.ko.zst snd-util-mem.ko.zst snd-via82xx-modem.ko.zst snd-via82xx.ko.zst snd-virmidi.ko.zst snd-virtuoso.ko.zst snd-vx-lib.ko.zst snd-vx222.ko.zst snd-vxpocket.ko.zst snd-ymfpci.ko.zst snd.ko.zst snd_xen_front.ko.zst snet_vdpa.ko.zst snic.ko.zst snps_udc_core.ko.zst soc_button_array.ko.zst softdog.ko.zst softing.ko.zst softing_cs.ko.zst solo6x10.ko.zst solos-pci.ko.zst sony-btf-mpx.ko.zst sony-laptop.ko.zst soundcore.ko.zst soundwire-amd.ko.zst soundwire-bus.ko.zst soundwire-cadence.ko.zst soundwire-generic-allocation.ko.zst soundwire-intel.ko.zst soundwire-qcom.ko.zst sp2.ko.zst sp5100_tco.ko.zst sp8870.ko.zst sp887x.ko.zst spaceball.ko.zst spaceorb.ko.zst sparse-keymap.ko.zst spcp8x5.ko.zst speakup.ko.zst speakup_acntsa.ko.zst speakup_apollo.ko.zst speakup_audptr.ko.zst speakup_bns.ko.zst speakup_decext.ko.zst speakup_dectlk.ko.zst speakup_dummy.ko.zst speakup_ltlk.ko.zst speakup_soft.ko.zst speakup_spkout.ko.zst speakup_txprt.ko.zst speedfax.ko.zst speedstep-lib.ko.zst speedtch.ko.zst spi-altera-core.ko.zst spi-altera-dfl.ko.zst spi-altera-platform.ko.zst spi-amd.ko.zst spi-axi-spi-engine.ko.zst spi-bitbang.ko.zst spi-butterfly.ko.zst spi-cadence.ko.zst spi-cs42l43.ko.zst spi-dln2.ko.zst spi-dw-mmio.ko.zst spi-dw-pci.ko.zst spi-dw.ko.zst spi-gpio.ko.zst spi-intel-pci.ko.zst spi-intel-platform.ko.zst spi-intel.ko.zst spi-lantiq-ssc.ko.zst spi-ljca.ko.zst spi-lm70llp.ko.zst spi-loopback-test.ko.zst spi-microchip-core-qspi.ko.zst spi-microchip-core.ko.zst spi-mux.ko.zst spi-mxic.ko.zst spi-nor.ko.zst spi-oc-tiny.ko.zst spi-pci1xxxx.ko.zst spi-pxa2xx-pci.ko.zst spi-pxa2xx-platform.ko.zst spi-sc18is602.ko.zst spi-sifive.ko.zst spi-slave-system-control.ko.zst spi-slave-time.ko.zst spi-tle62x0.ko.zst spi-xcomm.ko.zst spi-xilinx.ko.zst spi-zynqmp-gqspi.ko.zst spi_ks8995.ko.zst spidev.ko.zst spinand.ko.zst spl.ko.zst spmi-devres.ko.zst spmi.ko.zst sprd_serial.ko.zst sps30.ko.zst sps30_i2c.ko.zst sps30_serial.ko.zst sr9700.ko.zst sr9800.ko.zst srf04.ko.zst srf08.ko.zst ssb-hcd.ko.zst ssb.ko.zst ssd1307fb.ko.zst ssd130x-i2c.ko.zst ssd130x-spi.ko.zst ssd130x.ko.zst ssfdc.ko.zst ssp_accel_sensor.ko.zst ssp_gyro_sensor.ko.zst ssp_iio.ko.zst sst25l.ko.zst sstfb.ko.zst ssu100.ko.zst st-mipid02.ko.zst st-nci.ko.zst st-nci_i2c.ko.zst st-nci_spi.ko.zst st.ko.zst st1232.ko.zst st21nfca_hci.ko.zst st21nfca_i2c.ko.zst st7586.ko.zst st7735r.ko.zst st95hf.ko.zst st_accel.ko.zst st_accel_i2c.ko.zst st_accel_spi.ko.zst st_drv.ko.zst st_gyro.ko.zst st_gyro_i2c.ko.zst st_gyro_spi.ko.zst st_lsm6dsx.ko.zst st_lsm6dsx_i2c.ko.zst st_lsm6dsx_i3c.ko.zst st_lsm6dsx_spi.ko.zst st_lsm9ds0.ko.zst st_lsm9ds0_i2c.ko.zst st_lsm9ds0_spi.ko.zst st_magn.ko.zst st_magn_i2c.ko.zst st_magn_spi.ko.zst st_pressure.ko.zst st_pressure_i2c.ko.zst st_pressure_spi.ko.zst st_sensors.ko.zst st_sensors_i2c.ko.zst st_sensors_spi.ko.zst st_uvis25_core.ko.zst st_uvis25_i2c.ko.zst st_uvis25_spi.ko.zst starfire.ko.zst stb0899.ko.zst stb6000.ko.zst stb6100.ko.zst ste10Xp.ko.zst stex.ko.zst stinger.ko.zst stk1160.ko.zst stk3310.ko.zst stk8312.ko.zst stk8ba50.ko.zst stm_console.ko.zst stm_core.ko.zst stm_ftrace.ko.zst stm_heartbeat.ko.zst stm_p_basic.ko.zst stm_p_sys-t.ko.zst stmfts.ko.zst stmmac-pci.ko.zst stmmac-platform.ko.zst stmmac.ko.zst stowaway.ko.zst stp.ko.zst stpddc60.ko.zst streamzap.ko.zst streebog_generic.ko.zst stts751.ko.zst stusb160x.ko.zst stv0288.ko.zst stv0297.ko.zst stv0299.ko.zst stv0367.ko.zst stv0900.ko.zst stv090x.ko.zst stv0910.ko.zst stv6110.ko.zst stv6110x.ko.zst stv6111.ko.zst stx104.ko.zst sundance.ko.zst sungem.ko.zst sungem_phy.ko.zst sunhme.ko.zst suni.ko.zst sunkbd.ko.zst sunrise_co2.ko.zst sunrpc.ko.zst sur40.ko.zst surface3-wmi.ko.zst surface3_power.ko.zst surface3_spi.ko.zst surface_acpi_notify.ko.zst surface_aggregator.ko.zst surface_aggregator_cdev.ko.zst surface_aggregator_hub.ko.zst surface_aggregator_registry.ko.zst surface_aggregator_tabletsw.ko.zst surface_battery.ko.zst surface_charger.ko.zst surface_dtx.ko.zst surface_gpe.ko.zst surface_hid.ko.zst surface_hid_core.ko.zst surface_hotplug.ko.zst surface_kbd.ko.zst surface_platform_profile.ko.zst surfacepro3_button.ko.zst svc-i3c-master.ko.zst svgalib.ko.zst switchtec.ko.zst sx8654.ko.zst sx9310.ko.zst sx9324.ko.zst sx9360.ko.zst sx9500.ko.zst sx_common.ko.zst sy7636a-hwmon.ko.zst sy7636a-regulator.ko.zst sym53c500_cs.ko.zst sym53c8xx.ko.zst symbolserial.ko.zst synaptics_i2c.ko.zst synaptics_usb.ko.zst system76_acpi.ko.zst sysv.ko.zst t5403.ko.zst tag_ar9331.ko.zst tag_brcm.ko.zst tag_dsa.ko.zst tag_gswip.ko.zst tag_hellcreek.ko.zst tag_ksz.ko.zst tag_lan9303.ko.zst tag_mtk.ko.zst tag_none.ko.zst tag_ocelot.ko.zst tag_ocelot_8021q.ko.zst tag_qca.ko.zst tag_rtl4_a.ko.zst tag_rtl8_4.ko.zst tag_rzn1_a5psw.ko.zst tag_sja1105.ko.zst tag_trailer.ko.zst tag_xrs700x.ko.zst tap.ko.zst target_core_file.ko.zst target_core_iblock.ko.zst target_core_mod.ko.zst target_core_pscsi.ko.zst target_core_user.ko.zst tc-dwc-g210-pci.ko.zst tc-dwc-g210.ko.zst tc358743.ko.zst tc358746.ko.zst tc654.ko.zst tc74.ko.zst tc90522.ko.zst tca6416-keypad.ko.zst tca8418_keypad.ko.zst tcan4x5x.ko.zst tcm_fc.ko.zst tcm_loop.ko.zst tcm_qla2xxx.ko.zst tcm_remote.ko.zst tcm_usb_gadget.ko.zst tcp_bbr.ko.zst tcp_bic.ko.zst tcp_cdg.ko.zst tcp_dctcp.ko.zst tcp_diag.ko.zst tcp_highspeed.ko.zst tcp_htcp.ko.zst tcp_hybla.ko.zst tcp_illinois.ko.zst tcp_lp.ko.zst tcp_nv.ko.zst tcp_scalable.ko.zst tcp_vegas.ko.zst tcp_veno.ko.zst tcp_westwood.ko.zst tcp_yeah.ko.zst tcpci.ko.zst tcpci_maxim.ko.zst tcpci_mt6360.ko.zst tcpci_mt6370.ko.zst tcpci_rt1711h.ko.zst tcpm.ko.zst tcrypt.ko.zst tcs3414.ko.zst tcs3472.ko.zst tda10021.ko.zst tda10023.ko.zst tda10048.ko.zst tda1004x.ko.zst tda10071.ko.zst tda10086.ko.zst tda18212.ko.zst tda18218.ko.zst tda18250.ko.zst tda18271.ko.zst tda18271c2dd.ko.zst tda1997x.ko.zst tda38640.ko.zst tda665x.ko.zst tda7432.ko.zst tda8083.ko.zst tda8261.ko.zst tda826x.ko.zst tda827x.ko.zst tda8290.ko.zst tda9840.ko.zst tda9887.ko.zst tda9950.ko.zst tda998x.ko.zst tdfxfb.ko.zst tdo24m.ko.zst tdx-guest.ko.zst tea575x.ko.zst tea5761.ko.zst tea5767.ko.zst tea6415c.ko.zst tea6420.ko.zst team.ko.zst team_mode_activebackup.ko.zst team_mode_broadcast.ko.zst team_mode_loadbalance.ko.zst team_mode_random.ko.zst team_mode_roundrobin.ko.zst tee.ko.zst tef6862.ko.zst tehuti.ko.zst teranetics.ko.zst test_blackhole_dev.ko.zst test_bpf.ko.zst test_power.ko.zst tg3.ko.zst thermal-generic-adc.ko.zst think-lmi.ko.zst thinkpad_acpi.ko.zst thmc50.ko.zst thp7312.ko.zst ths7303.ko.zst ths8200.ko.zst thunder_bgx.ko.zst thunder_xcv.ko.zst thunderbolt.ko.zst thunderbolt_net.ko.zst ti-adc081c.ko.zst ti-adc0832.ko.zst ti-adc084s021.ko.zst ti-adc108s102.ko.zst ti-adc12138.ko.zst ti-adc128s052.ko.zst ti-adc161s626.ko.zst ti-ads1015.ko.zst ti-ads1100.ko.zst ti-ads124s08.ko.zst ti-ads131e08.ko.zst ti-ads7924.ko.zst ti-ads7950.ko.zst ti-ads8344.ko.zst ti-ads8688.ko.zst ti-dac082s085.ko.zst ti-dac5571.ko.zst ti-dac7311.ko.zst ti-dac7612.ko.zst ti-lmp92064.ko.zst ti-lmu.ko.zst ti-tlc4541.ko.zst ti-tsc2046.ko.zst ti_usb_3410_5052.ko.zst tifm_7xx1.ko.zst tifm_core.ko.zst tifm_ms.ko.zst tifm_sd.ko.zst timeriomem-rng.ko.zst tipc.ko.zst tlan.ko.zst tlclk.ko.zst tls.ko.zst tlv320aic23b.ko.zst tm2-touchkey.ko.zst tmag5273.ko.zst tmdc.ko.zst tmp006.ko.zst tmp007.ko.zst tmp102.ko.zst tmp103.ko.zst tmp108.ko.zst tmp117.ko.zst tmp401.ko.zst tmp421.ko.zst tmp464.ko.zst tmp513.ko.zst topstar-laptop.ko.zst toshiba_acpi.ko.zst toshiba_bluetooth.ko.zst toshiba_haps.ko.zst toshsd.ko.zst touchit213.ko.zst touchright.ko.zst touchwin.ko.zst tpci200.ko.zst tpl0102.ko.zst tpm_atmel.ko.zst tpm_i2c_atmel.ko.zst tpm_i2c_infineon.ko.zst tpm_i2c_nuvoton.ko.zst tpm_infineon.ko.zst tpm_nsc.ko.zst tpm_st33zp24.ko.zst tpm_st33zp24_i2c.ko.zst tpm_st33zp24_spi.ko.zst tpm_tis_i2c.ko.zst tpm_tis_i2c_cr50.ko.zst tpm_tis_spi.ko.zst tpm_vtpm_proxy.ko.zst tps23861.ko.zst tps40422.ko.zst tps51632-regulator.ko.zst tps53679.ko.zst tps546d24.ko.zst tps6105x-regulator.ko.zst tps6105x.ko.zst tps62360-regulator.ko.zst tps65010.ko.zst tps65023-regulator.ko.zst tps6507x-regulator.ko.zst tps6507x-ts.ko.zst tps6507x.ko.zst tps65086-regulator.ko.zst tps65086.ko.zst tps65090-charger.ko.zst tps65090-regulator.ko.zst tps65132-regulator.ko.zst tps6524x-regulator.ko.zst tps6586x-regulator.ko.zst tps65910-regulator.ko.zst tps65912-regulator.ko.zst tps6594-core.ko.zst tps6594-esm.ko.zst tps6594-i2c.ko.zst tps6594-pfsm.ko.zst tps6594-spi.ko.zst tps6598x.ko.zst tps68470-regulator.ko.zst tqmx86.ko.zst tqmx86_wdt.ko.zst trace-printk.ko.zst trancevibrator.ko.zst trf7970a.ko.zst tridentfb.ko.zst ts2020.ko.zst ts_bm.ko.zst ts_fsm.ko.zst ts_kmp.ko.zst tsc2004.ko.zst tsc2005.ko.zst tsc2007.ko.zst tsc200x-core.ko.zst tsc40.ko.zst tsi721_mport.ko.zst tsl2550.ko.zst tsl2563.ko.zst tsl2583.ko.zst tsl2591.ko.zst tsl2772.ko.zst tsl4531.ko.zst tsm.ko.zst tsnep.ko.zst tsys01.ko.zst tsys02d.ko.zst ttm.ko.zst ttpci-eeprom.ko.zst ttusb_dec.ko.zst ttusbdecfe.ko.zst ttusbir.ko.zst ttynull.ko.zst tua6100.ko.zst tua9001.ko.zst tulip.ko.zst tuner-simple.ko.zst tuner-types.ko.zst tuner.ko.zst tunnel4.ko.zst tunnel6.ko.zst turbografx.ko.zst tvaudio.ko.zst tveeprom.ko.zst tvp514x.ko.zst tvp5150.ko.zst tvp7002.ko.zst tw2804.ko.zst tw5864.ko.zst tw68.ko.zst tw686x.ko.zst tw9900.ko.zst tw9903.ko.zst tw9906.ko.zst tw9910.ko.zst twidjoy.ko.zst twl-regulator.ko.zst twl4030-madc.ko.zst twl4030-pwrbutton.ko.zst twl4030-vibra.ko.zst twl4030_charger.ko.zst twl4030_keypad.ko.zst twl4030_madc_battery.ko.zst twl4030_wdt.ko.zst twl6030-gpadc.ko.zst twl6030-regulator.ko.zst twl6040-vibra.ko.zst twofish-avx-x86_64.ko.zst twofish-x86_64-3way.ko.zst twofish-x86_64.ko.zst twofish_common.ko.zst twofish_generic.ko.zst txgbe.ko.zst typec.ko.zst typec_displayport.ko.zst typec_nvidia.ko.zst typec_ucsi.ko.zst typec_wcove.ko.zst typhoon.ko.zst uPD60620.ko.zst u_audio.ko.zst u_ether.ko.zst u_serial.ko.zst uacce.ko.zst uartlite.ko.zst uas.ko.zst ubi.ko.zst ubifs.ko.zst ublk_drv.ko.zst ubuntu-host.ko.zst ucan.ko.zst ucd9000.ko.zst ucd9200.ko.zst ucsi_acpi.ko.zst ucsi_ccg.ko.zst ucsi_stm32g0.ko.zst uda1342.ko.zst udc-core.ko.zst udf.ko.zst udl.ko.zst udlfb.ko.zst udp_diag.ko.zst udp_tunnel.ko.zst ueagle-atm.ko.zst ufs.ko.zst ufshcd-core.ko.zst ufshcd-dwc.ko.zst ufshcd-pci.ko.zst ufshcd-pltfrm.ko.zst ug3105_battery.ko.zst uhid.ko.zst uio.ko.zst uio_aec.ko.zst uio_cif.ko.zst uio_dfl.ko.zst uio_dmem_genirq.ko.zst uio_hv_generic.ko.zst uio_mf624.ko.zst uio_netx.ko.zst uio_pci_generic.ko.zst uio_pdrv_genirq.ko.zst uio_pruss.ko.zst uio_sercos3.ko.zst uleds.ko.zst uli526x.ko.zst ulpi.ko.zst ums-alauda.ko.zst ums-cypress.ko.zst ums-datafab.ko.zst ums-eneub6250.ko.zst ums-freecom.ko.zst ums-isd200.ko.zst ums-jumpshot.ko.zst ums-karma.ko.zst ums-onetouch.ko.zst ums-realtek.ko.zst ums-sddr09.ko.zst ums-sddr55.ko.zst ums-usbat.ko.zst unix_diag.ko.zst upd64031a.ko.zst upd64083.ko.zst upd78f0730.ko.zst us5182d.ko.zst usb-conn-gpio.ko.zst usb-ljca.ko.zst usb-serial-simple.ko.zst usb-storage.ko.zst usb251xb.ko.zst usb3503.ko.zst usb4604.ko.zst usb8xxx.ko.zst usb_8dev.ko.zst usb_debug.ko.zst usb_f_acm.ko.zst usb_f_ecm.ko.zst usb_f_ecm_subset.ko.zst usb_f_eem.ko.zst usb_f_fs.ko.zst usb_f_hid.ko.zst usb_f_mass_storage.ko.zst usb_f_midi.ko.zst usb_f_midi2.ko.zst usb_f_ncm.ko.zst usb_f_obex.ko.zst usb_f_phonet.ko.zst usb_f_printer.ko.zst usb_f_rndis.ko.zst usb_f_serial.ko.zst usb_f_ss_lb.ko.zst usb_f_tcm.ko.zst usb_f_uac1.ko.zst usb_f_uac1_legacy.ko.zst usb_f_uac2.ko.zst usb_f_uvc.ko.zst usb_wwan.ko.zst usbatm.ko.zst usbdux.ko.zst usbduxfast.ko.zst usbduxsigma.ko.zst usbhid.ko.zst usbip-core.ko.zst usbip-host.ko.zst usbip-vudc.ko.zst usbkbd.ko.zst usblcd.ko.zst usblp.ko.zst usbmon.ko.zst usbmouse.ko.zst usbnet.ko.zst usbserial.ko.zst usbsevseg.ko.zst usbtest.ko.zst usbtmc.ko.zst usbtouchscreen.ko.zst usbtv.ko.zst usdhi6rol0.ko.zst userio.ko.zst userspace-consumer.ko.zst ushc.ko.zst usnic_verbs.ko.zst uss720.ko.zst uv_mmtimer.ko.zst uv_sysfs.ko.zst uvc.ko.zst uvcvideo.ko.zst uvesafb.ko.zst v4l2-async.ko.zst v4l2-cci.ko.zst v4l2-dv-timings.ko.zst v4l2-flash-led-class.ko.zst v4l2-fwnode.ko.zst v4l2-mem2mem.ko.zst v4l2-tpg.ko.zst v4l2loopback.ko.zst vboxguest.ko.zst vboxsf.ko.zst vboxvideo.ko.zst vcan.ko.zst vcnl3020.ko.zst vcnl4000.ko.zst vcnl4035.ko.zst vdpa.ko.zst vdpa_sim.ko.zst vdpa_sim_blk.ko.zst vdpa_sim_net.ko.zst vduse.ko.zst veml6030.ko.zst veml6070.ko.zst veml6075.ko.zst ves1820.ko.zst ves1x93.ko.zst veth.ko.zst vf610_adc.ko.zst vf610_dac.ko.zst vfio-pci-core.ko.zst vfio-pci.ko.zst vfio.ko.zst vfio_iommu_type1.ko.zst vga16fb.ko.zst vgastate.ko.zst vgem.ko.zst vgg2432a4.ko.zst vhci-hcd.ko.zst vhost.ko.zst vhost_iotlb.ko.zst vhost_net.ko.zst vhost_scsi.ko.zst vhost_vdpa.ko.zst vhost_vsock.ko.zst via-camera.ko.zst via-cputemp.ko.zst via-rhine.ko.zst via-rng.ko.zst via-sdmmc.ko.zst via-velocity.ko.zst via686a.ko.zst via_wdt.ko.zst viafb.ko.zst vicodec.ko.zst video-i2c.ko.zst video.ko.zst videobuf2-common.ko.zst videobuf2-dma-contig.ko.zst videobuf2-dma-sg.ko.zst videobuf2-dvb.ko.zst videobuf2-memops.ko.zst videobuf2-v4l2.ko.zst videobuf2-vmalloc.ko.zst videodev.ko.zst vim2m.ko.zst vimc.ko.zst viperboard.ko.zst viperboard_adc.ko.zst virt_wifi.ko.zst virtio-gpu.ko.zst virtio-rng.ko.zst virtio-vfio-pci.ko.zst virtio_bt.ko.zst virtio_crypto.ko.zst virtio_dma_buf.ko.zst virtio_input.ko.zst virtio_mem.ko.zst virtio_pmem.ko.zst virtio_rpmsg_bus.ko.zst virtio_snd.ko.zst virtio_vdpa.ko.zst virtiofs.ko.zst virtual.ko.zst virtual_ncidev.ko.zst visl.ko.zst visor.ko.zst vitesse-vsc73xx-core.ko.zst vitesse-vsc73xx-platform.ko.zst vitesse-vsc73xx-spi.ko.zst vitesse.ko.zst vivid.ko.zst vkms.ko.zst vl53l0x-i2c.ko.zst vl6180.ko.zst vmac.ko.zst vmd.ko.zst vme_fake.ko.zst vme_tsi148.ko.zst vme_user.ko.zst vmgenid.ko.zst vmk80xx.ko.zst vmw_balloon.ko.zst vmw_pvrdma.ko.zst vmw_pvscsi.ko.zst vmw_vmci.ko.zst vmw_vsock_virtio_transport.ko.zst vmw_vsock_virtio_transport_common.ko.zst vmw_vsock_vmci_transport.ko.zst vmwgfx.ko.zst vmxnet3.ko.zst vp27smpx.ko.zst vp_vdpa.ko.zst vport-geneve.ko.zst vport-gre.ko.zst vport-vxlan.ko.zst vpx3220.ko.zst vrf.ko.zst vringh.ko.zst vsock.ko.zst vsock_diag.ko.zst vsock_loopback.ko.zst vsockmon.ko.zst vsxxxaa.ko.zst vt1211.ko.zst vt6655_stage.ko.zst vt6656_stage.ko.zst vt8231.ko.zst vt8623fb.ko.zst vub300.ko.zst vx855.ko.zst vxcan.ko.zst vxlan.ko.zst vz89x.ko.zst w1-gpio.ko.zst w1_ds2405.ko.zst w1_ds2406.ko.zst w1_ds2408.ko.zst w1_ds2413.ko.zst w1_ds2423.ko.zst w1_ds2430.ko.zst w1_ds2431.ko.zst w1_ds2433.ko.zst w1_ds2438.ko.zst w1_ds250x.ko.zst w1_ds2780.ko.zst w1_ds2781.ko.zst w1_ds2805.ko.zst w1_ds28e04.ko.zst w1_ds28e17.ko.zst w1_smem.ko.zst w1_therm.ko.zst w5100-spi.ko.zst w5100.ko.zst w5300.ko.zst w6692.ko.zst w83627ehf.ko.zst w83627hf.ko.zst w83627hf_wdt.ko.zst w83773g.ko.zst w83781d.ko.zst w83791d.ko.zst w83792d.ko.zst w83793.ko.zst w83795.ko.zst w83877f_wdt.ko.zst w83977f_wdt.ko.zst w83l785ts.ko.zst w83l786ng.ko.zst wacom.ko.zst wacom_i2c.ko.zst wacom_serial4.ko.zst wacom_w8001.ko.zst wafer5823wdt.ko.zst walkera0701.ko.zst wanxl.ko.zst warrior.ko.zst wbsd.ko.zst wcd934x.ko.zst wcd939x-usbss.ko.zst wcn36xx.ko.zst wd719x.ko.zst wdat_wdt.ko.zst wdt87xx_i2c.ko.zst wdt_pci.ko.zst wfx.ko.zst whiteheat.ko.zst wil6210.ko.zst wilc1000-sdio.ko.zst wilc1000-spi.ko.zst wilc1000.ko.zst wilco-charger.ko.zst wilco_ec.ko.zst wilco_ec_debugfs.ko.zst wilco_ec_events.ko.zst wilco_ec_telem.ko.zst winbond-840.ko.zst winbond-cir.ko.zst winmate-fm07-keys.ko.zst wire.ko.zst wireguard.ko.zst wireless-hotkey.ko.zst wishbone-serial.ko.zst wl1251.ko.zst wl1251_sdio.ko.zst wl1251_spi.ko.zst wl1273-core.ko.zst wl12xx.ko.zst wl18xx.ko.zst wlcore.ko.zst wlcore_sdio.ko.zst wm831x-dcdc.ko.zst wm831x-hwmon.ko.zst wm831x-isink.ko.zst wm831x-ldo.ko.zst wm831x-on.ko.zst wm831x-ts.ko.zst wm831x_backup.ko.zst wm831x_bl.ko.zst wm831x_power.ko.zst wm831x_wdt.ko.zst wm8350-hwmon.ko.zst wm8350-regulator.ko.zst wm8350_power.ko.zst wm8350_wdt.ko.zst wm8400-regulator.ko.zst wm8739.ko.zst wm8775.ko.zst wm8994-regulator.ko.zst wm8994.ko.zst wm97xx-ts.ko.zst wmi-bmof.ko.zst wmi.ko.zst wp512.ko.zst wpcm450-soc.ko.zst wusb3801.ko.zst wwan.ko.zst wwan_hwsim.ko.zst x25.ko.zst x38_edac.ko.zst x86-android-tablets.ko.zst x86_pkg_temp_thermal.ko.zst x9250.ko.zst x_tables.ko.zst xbox_remote.ko.zst xc2028.ko.zst xc4000.ko.zst xc5000.ko.zst xcbc.ko.zst xctr.ko.zst xdma.ko.zst xdpe12284.ko.zst xdpe152c4.ko.zst xe.ko.zst xen-blkback.ko.zst xen-evtchn.ko.zst xen-fbfront.ko.zst xen-front-pgdir-shbuf.ko.zst xen-gntalloc.ko.zst xen-gntdev.ko.zst xen-hcd.ko.zst xen-kbdfront.ko.zst xen-netback.ko.zst xen-pciback.ko.zst xen-pcifront.ko.zst xen-privcmd.ko.zst xen-scsiback.ko.zst xen-scsifront.ko.zst xen-tpmfront.ko.zst xen_wdt.ko.zst xenfs.ko.zst xfrm4_tunnel.ko.zst xfrm6_tunnel.ko.zst xfrm_algo.ko.zst xfrm_compat.ko.zst xfrm_interface.ko.zst xfrm_ipcomp.ko.zst xfrm_user.ko.zst xfs.ko.zst xgene-hwmon.ko.zst xhci-pci-renesas.ko.zst xhci-pci.ko.zst xhci-plat-hcd.ko.zst xiaomi-wmi.ko.zst xilinx-pr-decoupler.ko.zst xilinx-spi.ko.zst xilinx-xadc.ko.zst xilinx_dma.ko.zst xilinx_emac.ko.zst xilinx_emaclite.ko.zst xilinx_gmii2rgmii.ko.zst xilinx_sdfec.ko.zst xillybus_class.ko.zst xillybus_core.ko.zst xillybus_pcie.ko.zst xillyusb.ko.zst xiphera-trng.ko.zst xirc2ps_cs.ko.zst xircom_cb.ko.zst xlnx_vcu.ko.zst xor.ko.zst xp.ko.zst xpad.ko.zst xpc.ko.zst xpnet.ko.zst xr_serial.ko.zst xrs700x.ko.zst xrs700x_i2c.ko.zst xrs700x_mdio.ko.zst xsens_mt.ko.zst xsk_diag.ko.zst xt_AUDIT.ko.zst xt_CHECKSUM.ko.zst xt_CLASSIFY.ko.zst xt_CONNSECMARK.ko.zst xt_CT.ko.zst xt_DSCP.ko.zst xt_HL.ko.zst xt_HMARK.ko.zst xt_IDLETIMER.ko.zst xt_LED.ko.zst xt_LOG.ko.zst xt_MASQUERADE.ko.zst xt_NETMAP.ko.zst xt_NFLOG.ko.zst xt_NFQUEUE.ko.zst xt_RATEEST.ko.zst xt_REDIRECT.ko.zst xt_SECMARK.ko.zst xt_TCPMSS.ko.zst xt_TCPOPTSTRIP.ko.zst xt_TEE.ko.zst xt_TPROXY.ko.zst xt_TRACE.ko.zst xt_addrtype.ko.zst xt_bpf.ko.zst xt_cgroup.ko.zst xt_cluster.ko.zst xt_comment.ko.zst xt_connbytes.ko.zst xt_connlabel.ko.zst xt_connlimit.ko.zst xt_connmark.ko.zst xt_conntrack.ko.zst xt_cpu.ko.zst xt_dccp.ko.zst xt_devgroup.ko.zst xt_dscp.ko.zst xt_ecn.ko.zst xt_esp.ko.zst xt_hashlimit.ko.zst xt_helper.ko.zst xt_hl.ko.zst xt_ipcomp.ko.zst xt_iprange.ko.zst xt_ipvs.ko.zst xt_l2tp.ko.zst xt_length.ko.zst xt_limit.ko.zst xt_mac.ko.zst xt_mark.ko.zst xt_multiport.ko.zst xt_nat.ko.zst xt_nfacct.ko.zst xt_osf.ko.zst xt_owner.ko.zst xt_physdev.ko.zst xt_pkttype.ko.zst xt_policy.ko.zst xt_quota.ko.zst xt_rateest.ko.zst xt_realm.ko.zst xt_recent.ko.zst xt_sctp.ko.zst xt_set.ko.zst xt_socket.ko.zst xt_state.ko.zst xt_statistic.ko.zst xt_string.ko.zst xt_tcpmss.ko.zst xt_tcpudp.ko.zst xt_time.ko.zst xt_u32.ko.zst xtkbd.ko.zst xusbatm.ko.zst xxhash_generic.ko.zst xz_dec_test.ko.zst yam.ko.zst yamaha-yas530.ko.zst yealink.ko.zst yellowfin.ko.zst yenta_socket.ko.zst yurex.ko.zst z3fold.ko.zst zaurus.ko.zst zd1211rw.ko.zst zd1301.ko.zst zd1301_demod.ko.zst zet6223.ko.zst zforce_ts.ko.zst zfs.ko.zst zhenhua.ko.zst ziirave_wdt.ko.zst zinitix.ko.zst zl10036.ko.zst zl10039.ko.zst zl10353.ko.zst zl6100.ko.zst zonefs.ko.zst zopt2201.ko.zst zpa2326.ko.zst zpa2326_i2c.ko.zst zpa2326_spi.ko.zst zram.ko.zst zstd.ko.zst jnuyens-modulejail-06d8d74/tests/fixtures/v1.1.4-regression/proc-modules000066400000000000000000000113101520651617500262520ustar00rootroot00000000000000nf_conntrack_netlink 57344 0 - Live 0x0000000000000000 veth 45056 0 - Live 0x0000000000000000 xt_MASQUERADE 16384 1 - Live 0x0000000000000000 bridge 425984 0 - Live 0x0000000000000000 stp 12288 1 bridge, Live 0x0000000000000000 llc 16384 2 bridge,stp, Live 0x0000000000000000 xfrm_user 61440 1 - Live 0x0000000000000000 xfrm_algo 16384 1 xfrm_user, Live 0x0000000000000000 xt_set 20480 0 - Live 0x0000000000000000 ip_set 61440 1 xt_set, Live 0x0000000000000000 nft_chain_nat 12288 5 - Live 0x0000000000000000 nf_nat 61440 2 xt_MASQUERADE,nft_chain_nat, Live 0x0000000000000000 vxlan 155648 0 - Live 0x0000000000000000 ip6_udp_tunnel 16384 1 vxlan, Live 0x0000000000000000 udp_tunnel 32768 1 vxlan, Live 0x0000000000000000 overlay 212992 0 - Live 0x0000000000000000 cpuid 12288 0 - Live 0x0000000000000000 tls 155648 0 - Live 0x0000000000000000 xt_recent 24576 0 - Live 0x0000000000000000 snd_seq_dummy 12288 0 - Live 0x0000000000000000 snd_hrtimer 12288 1 - Live 0x0000000000000000 qrtr 53248 2 - Live 0x0000000000000000 ip6t_REJECT 12288 1 - Live 0x0000000000000000 nf_reject_ipv6 24576 1 ip6t_REJECT, Live 0x0000000000000000 xt_hl 12288 22 - Live 0x0000000000000000 ip6t_rt 16384 3 - Live 0x0000000000000000 ipt_REJECT 12288 1 - Live 0x0000000000000000 nf_reject_ipv4 12288 1 ipt_REJECT, Live 0x0000000000000000 xt_LOG 16384 10 - Live 0x0000000000000000 nf_log_syslog 20480 10 - Live 0x0000000000000000 nft_limit 16384 13 - Live 0x0000000000000000 xt_limit 12288 0 - Live 0x0000000000000000 xt_addrtype 12288 8 - Live 0x0000000000000000 xt_tcpudp 16384 60 - Live 0x0000000000000000 xt_conntrack 12288 17 - Live 0x0000000000000000 nf_conntrack 196608 4 nf_conntrack_netlink,xt_MASQUERADE,nf_nat,xt_conntrack, Live 0x0000000000000000 nf_defrag_ipv6 24576 1 nf_conntrack, Live 0x0000000000000000 nf_defrag_ipv4 12288 1 nf_conntrack, Live 0x0000000000000000 nft_compat 20480 123 - Live 0x0000000000000000 nf_tables 376832 694 nft_chain_nat,nft_limit,nft_compat, Live 0x0000000000000000 binfmt_misc 24576 1 - Live 0x0000000000000000 libcrc32c 12288 3 nf_nat,nf_conntrack,nf_tables, Live 0x0000000000000000 snd_hda_intel 61440 0 - Live 0x0000000000000000 snd_intel_dspcfg 36864 1 snd_hda_intel, Live 0x0000000000000000 snd_intel_sdw_acpi 16384 1 snd_intel_dspcfg, Live 0x0000000000000000 snd_hda_codec 204800 1 snd_hda_intel, Live 0x0000000000000000 snd_hda_core 139264 2 snd_hda_intel,snd_hda_codec, Live 0x0000000000000000 snd_hwdep 20480 1 snd_hda_codec, Live 0x0000000000000000 nls_iso8859_1 12288 1 - Live 0x0000000000000000 snd_intel8x0 53248 1 - Live 0x0000000000000000 snd_ac97_codec 196608 1 snd_intel8x0, Live 0x0000000000000000 snd_seq_midi 24576 0 - Live 0x0000000000000000 snd_seq_midi_event 16384 1 snd_seq_midi, Live 0x0000000000000000 snd_rawmidi 57344 1 snd_seq_midi, Live 0x0000000000000000 ac97_bus 12288 1 snd_ac97_codec, Live 0x0000000000000000 snd_seq 118784 9 snd_seq_dummy,snd_seq_midi,snd_seq_midi_event, Live 0x0000000000000000 snd_pcm 192512 5 snd_hda_intel,snd_hda_codec,snd_hda_core,snd_intel8x0,snd_ac97_codec, Live 0x0000000000000000 i2c_i801 36864 0 - Live 0x0000000000000000 snd_seq_device 16384 3 snd_seq_midi,snd_rawmidi,snd_seq, Live 0x0000000000000000 i2c_smbus 16384 1 i2c_i801, Live 0x0000000000000000 snd_timer 49152 3 snd_hrtimer,snd_seq,snd_pcm, Live 0x0000000000000000 lpc_ich 32768 0 - Live 0x0000000000000000 qxl 86016 1 - Live 0x0000000000000000 drm_ttm_helper 12288 1 qxl, Live 0x0000000000000000 snd 143360 14 snd_hda_intel,snd_hda_codec,snd_hwdep,snd_intel8x0,snd_ac97_codec,snd_rawmidi,snd_seq,snd_pcm,snd_seq_device,snd_timer, Live 0x0000000000000000 ttm 110592 2 qxl,drm_ttm_helper, Live 0x0000000000000000 soundcore 16384 1 snd, Live 0x0000000000000000 vmgenid 12288 0 - Live 0x0000000000000000 input_leds 12288 0 - Live 0x0000000000000000 joydev 32768 0 - Live 0x0000000000000000 mac_hid 12288 0 - Live 0x0000000000000000 serio_raw 20480 0 - Live 0x0000000000000000 sch_fq_codel 24576 2 - Live 0x0000000000000000 msr 12288 0 - Live 0x0000000000000000 parport_pc 53248 0 - Live 0x0000000000000000 ppdev 24576 0 - Live 0x0000000000000000 lp 28672 0 - Live 0x0000000000000000 parport 73728 3 parport_pc,ppdev,lp, Live 0x0000000000000000 efi_pstore 12288 0 - Live 0x0000000000000000 nfnetlink 20480 6 nf_conntrack_netlink,ip_set,nft_compat,nf_tables, Live 0x0000000000000000 dmi_sysfs 24576 0 - Live 0x0000000000000000 qemu_fw_cfg 24576 0 - Live 0x0000000000000000 ip_tables 32768 0 - Live 0x0000000000000000 x_tables 65536 14 xt_MASQUERADE,xt_set,xt_recent,ip6t_REJECT,xt_hl,ip6t_rt,ipt_REJECT,xt_LOG,xt_limit,xt_addrtype,xt_tcpudp,xt_conntrack,nft_compat,ip_tables, Live 0x0000000000000000 autofs4 57344 2 - Live 0x0000000000000000 psmouse 217088 0 - Live 0x0000000000000000 ahci 49152 0 - Live 0x0000000000000000 libahci 53248 1 ahci, Live 0x0000000000000000 jnuyens-modulejail-06d8d74/tests/lib/000077500000000000000000000000001520651617500176125ustar00rootroot00000000000000jnuyens-modulejail-06d8d74/tests/lib/assert.sh000077500000000000000000000020741520651617500214550ustar00rootroot00000000000000#!/bin/sh # POSIX shell assertion helpers. Sourced by tests/lib/run-in-fixture.sh. # No bashisms; runs under busybox ash inside the Alpine fixture. # assert_exit EXPECTED CMD [ARGS...] # Run CMD ARGS, capture exit code, assert it equals EXPECTED. assert_exit() { expected=$1; shift "$@" >/dev/null 2>&1 rc=$? if [ "$rc" -ne "$expected" ]; then printf 'assert_exit FAIL: expected %d got %d for: %s\n' "$expected" "$rc" "$*" >&2 return 1 fi } # assert_grep PATTERN FILE [DESCRIPTION] assert_grep() { pat=$1; file=$2; desc=${3:-grep} if ! grep -qE "$pat" "$file"; then printf 'assert_grep FAIL [%s]: pattern not found: %s in %s\n' "$desc" "$pat" "$file" >&2 return 1 fi } # assert_cmp A B assert_cmp() { if ! cmp -s "$1" "$2"; then printf 'assert_cmp FAIL: %s != %s\n' "$1" "$2" >&2 return 1 fi } # assert_eq EXPECTED ACTUAL [DESCRIPTION] assert_eq() { if [ "$1" != "$2" ]; then printf 'assert_eq FAIL [%s]: expected %s got %s\n' "${3:-eq}" "$1" "$2" >&2 return 1 fi } jnuyens-modulejail-06d8d74/tests/lib/case-env.sh000066400000000000000000000067531520651617500216620ustar00rootroot00000000000000#!/bin/sh # Shared boilerplate for host-local test cases under tests/cases/. # Sourced (NOT executed) by each case; sets REPO_ROOT / MODULEJAIL_BIN / # CASE_TMP, installs the centralized EXIT trap, and exports the universal # hermetic-test env vars (MODULEJAIL_NO_UPDATE_CHECK, # MODULEJAIL_DEFAULT_WHITELIST_FILE). Also provides the case_pass / # case_fail helpers. # # Inputs (set by the case BEFORE sourcing this file): # CASE_NAME - short label printed in pass/fail lines. # # Outputs (set or exported for the modulejail invocation): # REPO_ROOT - repo root (cd'd from this script) # MODULEJAIL_BIN - absolute path to the modulejail script # CASE_TMP - tempdir root (auto-cleaned on EXIT) # MODULEJAIL_NO_UPDATE_CHECK=1 - suppress the post-run update check # so cases are network-hermetic. # MODULEJAIL_DEFAULT_WHITELIST_FILE - absent-by-default whitelist path # under CASE_TMP, isolating cases from # any /etc/modulejail/whitelist.conf # that may exist on a developer's # machine or CI runner. # # Synthetic kernel-module tree builder (the small representative # universe + fake /proc/modules) MIGRATED to tests/lib/case-tree.sh per # D-Phase6-14. Cases that want it must source case-tree.sh AFTER this # file. v1.1.4-regression.sh builds its own 6474-entry universe inline # and does NOT source case-tree.sh. # # Source order (mandatory if case-tree.sh is wanted): # . "$REPO_ROOT/tests/lib/case-env.sh" # sets CASE_TMP first # . "$REPO_ROOT/tests/lib/case-tree.sh" # consumes CASE_TMP # # This file is intentionally minimal: it does NOT define assertion # helpers (those live in tests/lib/assert.sh) and it does NOT chdir. # Locate the repo root so cases can be invoked from any cwd. # tests/cases/.sh -> dirname -> tests/cases -> ../.. -> repo root. case "${0:-}" in /*) CASE_SCRIPT=$0 ;; *) CASE_SCRIPT=$(pwd)/$0 ;; esac CASE_DIR=$(cd "$(dirname "$CASE_SCRIPT")" && pwd) REPO_ROOT=$(cd "$CASE_DIR/../.." && pwd) export REPO_ROOT MODULEJAIL_BIN=$REPO_ROOT/modulejail export MODULEJAIL_BIN CASE_TMP=$(mktemp -d "${TMPDIR:-/tmp}/modulejail-case.XXXXXX") export CASE_TMP # Centralized EXIT trap (D-Phase6-15). The 29 existing host-local cases # that install their own identical trap keep them as-is - POSIX trap is # idempotent for identical handlers, so the duplicate is a no-op at # runtime. v1.1.4-regression.sh (refactored in Plan 06-01) relies on # this trap exclusively and does NOT install its own. trap 'rm -rf "$CASE_TMP"' EXIT INT HUP TERM MODULEJAIL_NO_UPDATE_CHECK=1 # Point the default-whitelist-file detector at a path inside $CASE_TMP that # does not exist. This isolates cases from any /etc/modulejail/whitelist.conf # that may exist on a developer's machine or a CI runner. Cases that want # to exercise the default-detection path override this themselves. MODULEJAIL_DEFAULT_WHITELIST_FILE=$CASE_TMP/default-whitelist-absent.conf export MODULEJAIL_NO_UPDATE_CHECK MODULEJAIL_DEFAULT_WHITELIST_FILE # Convenience helpers -------------------------------------------------------- # case_pass: print success line and exit 0. case_pass() { printf '[%s] PASS\n' "${CASE_NAME:-unknown-case}" exit 0 } # case_fail MSG: print failure line on stderr and exit 1. case_fail() { printf '[%s] FAIL: %s\n' "${CASE_NAME:-unknown-case}" "$1" >&2 exit 1 } jnuyens-modulejail-06d8d74/tests/lib/case-tree.sh000066400000000000000000000055601520651617500220240ustar00rootroot00000000000000#!/bin/sh # Synthetic representative-universe builder for host-local test cases. # Sourced (NOT executed) by each case that wants the small synthetic # kernel-module tree (13 representative + 50 dummy padding modules) and # the matching fake /proc/modules pinning 7 loaded entries. # # Dependency contract: this file consumes CASE_TMP, which is set by # tests/lib/case-env.sh. Source ORDER is mandatory: # # . "$REPO_ROOT/tests/lib/case-env.sh" # sets CASE_TMP first # . "$REPO_ROOT/tests/lib/case-tree.sh" # consumes CASE_TMP # # This file is NOT sourced by tests/cases/v1.1.4-regression.sh - that # case builds its own 6474-entry universe inline from the canned # tests/fixtures/v1.1.4-regression/modules-list and uses CASE_TMP's # layout under a different convention (lo/ + uc/ sharding for APFS # case-insensitivity). # # Outputs (exported for the modulejail invocation): # MODULEJAIL_MODULES_ROOT - synthetic /lib/modules root # MODULEJAIL_KVER - pinned synthetic kernel version # MODULEJAIL_PROC_MODULES - path to fake /proc/modules # # This file does NOT call `set -eu` (it is .-sourced into the caller's # shell which already has it) and does NOT install an EXIT trap # (case-env.sh's centralized trap covers CASE_TMP cleanup). CASE_KVER=6.99.0-case CASE_MODULES_ROOT=$CASE_TMP/lib/modules CASE_TREE=$CASE_MODULES_ROOT/$CASE_KVER/kernel mkdir -p "$CASE_TREE/fs" "$CASE_TREE/net" "$CASE_TREE/drivers" "$CASE_TREE/crypto" # Representative universe: a handful across the four .ko* suffix variants # plus padding to keep the >99% sanity guard from tripping on the small # keep-set (loaded ~7 entries + baseline ~55 + whitelist additions). touch \ "$CASE_TREE/fs/ext4.ko.zst" \ "$CASE_TREE/fs/btrfs.ko.zst" \ "$CASE_TREE/fs/xfs.ko.xz" \ "$CASE_TREE/fs/vfat.ko.gz" \ "$CASE_TREE/net/sctp.ko.zst" \ "$CASE_TREE/net/netfilter.ko.zst" \ "$CASE_TREE/net/nft_compat.ko" \ "$CASE_TREE/drivers/e1000e.ko" \ "$CASE_TREE/drivers/virtio_net.ko.gz" \ "$CASE_TREE/drivers/vfio_pci.ko.zst" \ "$CASE_TREE/drivers/usb_storage.ko.zst" \ "$CASE_TREE/crypto/aes_generic.ko.zst" \ "$CASE_TREE/crypto/sha256_generic.ko" i=1 while [ "$i" -le 50 ]; do touch "$CASE_TREE/drivers/dummy_$i.ko.zst" i=$((i + 1)) done CASE_PROC=$CASE_TMP/proc-modules { printf '%s 16384 1 - Live 0x0000000000000000\n' ext4 printf '%s 16384 1 - Live 0x0000000000000000\n' btrfs printf '%s 16384 1 - Live 0x0000000000000000\n' xfs printf '%s 16384 1 - Live 0x0000000000000000\n' e1000e printf '%s 16384 1 - Live 0x0000000000000000\n' virtio_net printf '%s 16384 1 - Live 0x0000000000000000\n' usb_storage printf '%s 16384 1 - Live 0x0000000000000000\n' aes_generic } > "$CASE_PROC" MODULEJAIL_MODULES_ROOT=$CASE_MODULES_ROOT MODULEJAIL_KVER=$CASE_KVER MODULEJAIL_PROC_MODULES=$CASE_PROC export MODULEJAIL_MODULES_ROOT MODULEJAIL_KVER MODULEJAIL_PROC_MODULES jnuyens-modulejail-06d8d74/tests/lib/gen-fixture.sh000077500000000000000000000036531520651617500224150ustar00rootroot00000000000000#!/bin/sh # Generate /lib/modules/6.99.0-fixture/ with touch-empty .ko* files and # a fake /proc/modules at /tmp/proc-modules. list_universe reads only # filenames (sub(/.*\//, ""), strip suffix, normalize -); empty files # satisfy it. The fake /proc/modules names a SUBSET of the synthetic # modules so the set arithmetic produces a non-empty, non-degenerate # blacklist that passes the >99% sanity guard. set -eu KVER=6.99.0-fixture TREE=/lib/modules/$KVER/kernel PROC=/tmp/proc-modules mkdir -p "$TREE/fs" "$TREE/net" "$TREE/drivers" "$TREE/crypto" # A small representative set across the four suffix variants. touch \ "$TREE/fs/ext4.ko.zst" \ "$TREE/fs/btrfs.ko.zst" \ "$TREE/fs/xfs.ko.xz" \ "$TREE/fs/vfat.ko.gz" \ "$TREE/net/sctp.ko.zst" \ "$TREE/net/netfilter.ko.zst" \ "$TREE/drivers/e1000e.ko" \ "$TREE/drivers/virtio_net.ko.gz" \ "$TREE/drivers/usb_storage.ko.zst" \ "$TREE/crypto/aes_generic.ko.zst" \ "$TREE/crypto/sha256_generic.ko" # Pad to ~60 modules so the >99% sanity guard does not trip when keep-set # (loaded union baseline union whitelist) is small. The baseline alone has 16 # entries; with ~10 "loaded" + 60 universe + ~16 baseline overlap, the # blacklist will be well under 99%. i=1 while [ "$i" -le 50 ]; do touch "$TREE/drivers/dummy_$i.ko.zst" i=$((i + 1)) done # Fake /proc/modules — names that appear in the synthetic tree (so they # end up in the keep-set), plus the existing baseline entries are # automatically included by the script. { printf '%s 16384 1 - Live 0x0000000000000000\n' ext4 printf '%s 16384 1 - Live 0x0000000000000000\n' btrfs printf '%s 16384 1 - Live 0x0000000000000000\n' xfs printf '%s 16384 1 - Live 0x0000000000000000\n' e1000e printf '%s 16384 1 - Live 0x0000000000000000\n' virtio_net printf '%s 16384 1 - Live 0x0000000000000000\n' usb_storage printf '%s 16384 1 - Live 0x0000000000000000\n' aes_generic } > "$PROC" jnuyens-modulejail-06d8d74/tests/lib/run-in-fixture.sh000077500000000000000000000141441520651617500230510ustar00rootroot00000000000000#!/bin/sh # Per-fixture-container assertion runner. Runs inside Arch/Alpine/openSUSE. # Distro name passed as $1 for output labelling. set -eu DISTRO=${1:-unknown} # shellcheck source=tests/lib/assert.sh . /tests/lib/assert.sh # Generate the synthetic kernel tree + fake /proc/modules. sh /tests/lib/gen-fixture.sh export MODULEJAIL_PROC_MODULES=/tmp/proc-modules export MODULEJAIL_KVER=6.99.0-fixture # Suppress the post-run update check by default so steady-state fixture # runs are hermetic (no network calls). Specific update-check assertions # below toggle this variable explicitly. export MODULEJAIL_NO_UPDATE_CHECK=1 # Point the default-whitelist-file detector at a path that does not exist # inside the container, so fixture runs are isolated from any # /etc/modulejail/whitelist.conf that might be baked into a base image. export MODULEJAIL_DEFAULT_WHITELIST_FILE=/tmp/default-whitelist-absent.conf # Version-agnostic SemVer regex. The v1.0.0 fixture hardcoded the literal # string "1.0.0", which broke every fixture run after the first version # bump. This pattern matches any X.Y.Z, future-proofing across bumps. SEMVER_RE='[0-9]+\.[0-9]+\.[0-9]+' printf '== [%s] (1) shellcheck --shell=sh modulejail ==\n' "$DISTRO" shellcheck --shell=sh /usr/local/bin/modulejail printf '== [%s] (2) --version exits 0 with valid SemVer ==\n' "$DISTRO" out=$(/usr/local/bin/modulejail --version) echo "$out" | head -1 | grep -qE "^modulejail $SEMVER_RE$" printf '== [%s] (3) --help exits 0 ==\n' "$DISTRO" /usr/local/bin/modulejail --help > /dev/null printf '== [%s] (4) bad flag -> EX_USAGE=64 ==\n' "$DISTRO" set +e /usr/local/bin/modulejail --nonexistent-flag 2>/dev/null rc=$? set -e assert_eq 64 "$rc" EX_USAGE printf '== [%s] (5) missing MODULEJAIL_PROC_MODULES -> EX_NOINPUT=66 ==\n' "$DISTRO" set +e MODULEJAIL_PROC_MODULES=/nonexistent/path /usr/local/bin/modulejail -o /tmp/x.conf 2>/dev/null rc=$? set -e assert_eq 66 "$rc" EX_NOINPUT printf '== [%s] (6) successful run -> exits 0, prints success line ==\n' "$DISTRO" out=$(/usr/local/bin/modulejail -o /tmp/fixture-run1.conf) echo "$out" | grep -qE '^modulejail: blacklisted [0-9]+ of [0-9]+ modules \(profile=conservative\) -> /tmp/fixture-run1\.conf$' printf '== [%s] (7) idempotency: two runs byte-identical ==\n' "$DISTRO" # Run twice into the SAME output path so the `# invocation:` header line (which # embeds the -o argument verbatim) does not falsely diff. Preserve run-1 output # via copy before run-2 overwrites the target. cp /tmp/fixture-run1.conf /tmp/fixture-run1-saved.conf /usr/local/bin/modulejail -o /tmp/fixture-run1.conf > /dev/null assert_cmp /tmp/fixture-run1-saved.conf /tmp/fixture-run1.conf printf '== [%s] (8) output is syntactically valid modprobe.d ==\n' "$DISTRO" # Body lines must be either comments, install lines, or blank. Two install-line # forms are valid as of Plan 03-02: # v1.1.4 form: install /bin/true # logger form: install /bin/sh -c '/usr/bin/logger -t modulejail "blocked: " 2>/dev/null; exit 0' # grep exits 1 when count=0 (no non-matching lines found = all valid); suppress # that exit so set -e does not fire when the file is correct. bad=$(grep -Evc '^#|^install [a-zA-Z0-9_]+ /bin/true$|^install [a-zA-Z0-9_]+ /bin/sh -c .*logger -t modulejail.*; exit 0.*$|^$' /tmp/fixture-run1.conf || true) assert_eq 0 "$bad" syntactic-validity printf '== [%s] (9) no per-distro branches in modulejail ==\n' "$DISTRO" # Assert grep finds zero per-distro branch patterns (exits 1 = no match = pass). # shellcheck disable=SC2015 # intentional: trailing `|| true` suppresses grep's no-match exit; the printf-then-exit-1 path is the only failure surface grep -qE '/etc/os-release|/etc/lsb-release|/etc/redhat-release|/etc/debian_version|ID_LIKE|ID=ubuntu|ID=debian|ID=rhel|ID=fedora|ID=arch|ID=alpine|ID=opensuse' /usr/local/bin/modulejail && { printf 'FAIL [%s]: per-distro branch found in modulejail\n' "$DISTRO" >&2; exit 1; } || true printf '== [%s] (10) Header shape (version-agnostic) ==\n' "$DISTRO" head -6 /tmp/fixture-run1.conf | sed -n '1p' | grep -qE "^# modulejail $SEMVER_RE$" head -6 /tmp/fixture-run1.conf | sed -n '5p' | grep -qE '^# fingerprint: sha256:[0-9a-f]{64}$' printf '== [%s] (11) --help documents MODULEJAIL_NO_UPDATE_CHECK ==\n' "$DISTRO" /usr/local/bin/modulejail --help | grep -q 'MODULEJAIL_NO_UPDATE_CHECK' printf '== [%s] (12) update check: NO_UPDATE_CHECK=1 -> no stderr notice ==\n' "$DISTRO" # Capture stderr separately; success line is on stdout, notices on stderr. err=$(MODULEJAIL_NO_UPDATE_CHECK=1 /usr/local/bin/modulejail -o /tmp/fixture-noup.conf 2>&1 >/dev/null) case "$err" in *"notice:"*) printf 'FAIL [%s]: NO_UPDATE_CHECK=1 still produced notice on stderr\n' "$DISTRO" >&2; exit 1 ;; esac printf '== [%s] (13) update check: unreachable URL -> silent (graceful failure) ==\n' "$DISTRO" # Unset the suppressor and point at an unroutable URL. The 10-second # timeout caps the wait; the function must still return 0 with no notice. err=$(unset MODULEJAIL_NO_UPDATE_CHECK; \ MODULEJAIL_UPDATE_URL=https://bogus.invalid.example.com/x \ /usr/local/bin/modulejail -o /tmp/fixture-unreach.conf 2>&1 >/dev/null) case "$err" in *"notice:"*) printf 'FAIL [%s]: unreachable URL produced notice on stderr\n' "$DISTRO" >&2; exit 1 ;; esac printf '== [%s] (14) regression guard: wget call uses busybox-compatible flags ==\n' "$DISTRO" # Static source check. busybox wget (Alpine) rejects --max-redirect, # --output-document, and --quiet long forms. v1.1.2 used these and the # update check was a silent no-op on every Alpine host. v1.1.3 switched # to the short-flag subset (-q -T -O). If a future edit reintroduces a # long form, this assertion catches it without needing network. wget_line=$(grep -E '^[[:space:]]*body=\$\(wget' /usr/local/bin/modulejail || true) [ -n "$wget_line" ] || { printf 'FAIL [%s]: could not find wget invocation in script\n' "$DISTRO" >&2; exit 1; } case "$wget_line" in *--max-redirect*|*--output-document*|*--quiet*) printf 'FAIL [%s]: wget invocation uses busybox-incompatible long flags:\n %s\n' "$DISTRO" "$wget_line" >&2 exit 1 ;; esac printf '[%s] FIXTURE PASS (14/14 assertions)\n' "$DISTRO" jnuyens-modulejail-06d8d74/tests/rocky9000077500000000000000000000025751520651617500202230ustar00rootroot00000000000000#!/bin/sh # Build + run the per-distro fixture containers. Probe for docker first, # fall back to podman. On a host with neither, print a clear skip message # and exit with skip code (77) so the maintainer notices but Plan 02-04's # SSH-host tests can still run. set -eu REPO_ROOT=$(cd "$(dirname "$0")/.." && pwd) cd "$REPO_ROOT" if command -v docker >/dev/null 2>&1; then RUNTIME=docker elif command -v podman >/dev/null 2>&1; then RUNTIME=podman else printf 'modulejail tests: no container runtime found (docker/podman); skipping fixtures.\n' >&2 printf 'modulejail tests: install colima/OrbStack on macOS, or run on a Linux host with docker/podman.\n' >&2 exit 77 fi printf 'modulejail tests: using %s\n' "$RUNTIME" FAIL=0 for distro in arch alpine opensuse; do img=modulejail-fixture-$distro printf '\n== Building %s fixture ==\n' "$distro" "$RUNTIME" build -f "tests/fixtures/$distro/Dockerfile" -t "$img" . || { FAIL=$((FAIL+1)); continue; } printf '== Running %s fixture ==\n' "$distro" if "$RUNTIME" run --rm "$img" sh /tests/lib/run-in-fixture.sh "$distro"; then printf '[%s] PASS\n' "$distro" else printf '[%s] FAIL\n' "$distro" FAIL=$((FAIL+1)) fi done if [ "$FAIL" -gt 0 ]; then printf '\nmodulejail tests: %d fixture(s) FAILED.\n' "$FAIL" >&2 exit 1 fi printf '\nmodulejail tests: all fixtures PASSED.\n' jnuyens-modulejail-06d8d74/tests/run-fixtures.sh000077500000000000000000000272751520651617500220730ustar00rootroot00000000000000#!/bin/sh # tests/run-fixtures.sh — modulejail test harness (host-local + containers). # # Invocation contract: # # tests/run-fixtures.sh # Default mode. Discovers and runs every host-local case under # tests/cases/*.sh. Additionally, if docker or podman is present, # builds and runs the per-distro fixture containers (arch, alpine, # opensuse). On a host without a container runtime, the host-local # cases still run; a stderr banner names the missing runtime. # # tests/run-fixtures.sh --filter PATTERN # Restrict the host-local-case run to tests/cases/PATTERN*.sh # (glob match). Does NOT run the container matrix. Suitable for # fast iteration on the dev box. # # tests/run-fixtures.sh --only-container DISTRO # Restricts execution to a single fixture-tier container; DISTRO # must be one of: arch, alpine, opensuse. Builds # tests/fixtures/$DISTRO/Dockerfile and runs the resulting image. # Does NOT run the host-local case layer or the other two # containers. Intended for CI matrix per-axis invocation so each # CI job exercises exactly one axis with the same harness the # local dev path uses. The `=` form (--only-container=DISTRO) is # equivalent to the space form. # # tests/run-fixtures.sh --only-host-local # Runs ONLY the host-local case layer (every tests/cases/*.sh # discovered). Does NOT attempt to build or run any container. # Symmetric with --only-container for the host-local CI axis. # # The three flags --filter, --only-container, --only-host-local are # mutually exclusive; passing more than one of them together exits 64. # # Exit codes: # 0 every selected case PASSED. # 1 at least one selected case FAILED (in either layer). # 64 bad command-line argument: --filter without PATTERN, # --only-container without DISTRO, --only-container DISTRO outside # the allowlist {arch, alpine, opensuse}, more than one of # --filter / --only-container / --only-host-local passed together, # --only-container invoked on a host with neither docker nor podman # in PATH, or any unknown flag. # 77 no host-local cases discoverable at all (an impossible state in # this repo, but reserved as the autoconf/TAP skip convention if a # future operator runs against an empty tests/cases/). # # Pre-fix behaviour: the no-container-runtime path exited 77 without # running anything, so the 13+ new host-local cases under tests/cases/ # (whitelist-file-*, logger-*, v1.1.4-regression, ssh-unreachable- # regression, emit-install-line-sanitize) were silently skipped on every # developer-laptop invocation. This file now always runs the host-local # layer; the container matrix is additive when its runtime is present. set -eu REPO_ROOT=$(cd "$(dirname "$0")/.." && pwd) cd "$REPO_ROOT" # --- Optional --filter PATTERN mode -------------------------------------- # Runs host-local case scripts under tests/cases/ that match the pattern. # Each case is self-contained (builds its own synthetic kernel tree under # a tempdir, exports the test-only plumbing env vars) and exercises a # single behavior. This mode works on the macOS dev box because the cases # use MODULEJAIL_MODULES_ROOT to point modulejail at a writable synthetic # tree instead of /lib/modules. FILTER="" ONLY_CONTAINER="" ONLY_HOST_LOCAL=0 while [ $# -gt 0 ]; do case "$1" in --filter) [ $# -ge 2 ] || { printf 'tests/run-fixtures.sh: --filter requires PATTERN\n' >&2; exit 64; } FILTER=$2 shift 2 ;; --filter=*) FILTER=${1#--filter=} shift ;; --only-container) [ $# -ge 2 ] || { printf 'tests/run-fixtures.sh: --only-container requires DISTRO\n' >&2; exit 64; } ONLY_CONTAINER=$2 shift 2 ;; --only-container=*) ONLY_CONTAINER=${1#--only-container=} shift ;; --only-host-local) ONLY_HOST_LOCAL=1 shift ;; --) shift break ;; -*) printf 'tests/run-fixtures.sh: unknown option: %s\n' "$1" >&2 exit 64 ;; *) printf 'tests/run-fixtures.sh: unexpected argument: %s\n' "$1" >&2 exit 64 ;; esac done # --- Mutex + allowed-DISTRO validation ----------------------------------- # The three axis-selector flags (--filter, --only-container, # --only-host-local) are mutually exclusive. Passing more than one is a # bad-arg error (exit 64) - same convention as --filter without PATTERN. FLAG_COUNT=0 [ -n "$FILTER" ] && FLAG_COUNT=$((FLAG_COUNT + 1)) [ -n "$ONLY_CONTAINER" ] && FLAG_COUNT=$((FLAG_COUNT + 1)) [ "$ONLY_HOST_LOCAL" = 1 ] && FLAG_COUNT=$((FLAG_COUNT + 1)) if [ "$FLAG_COUNT" -gt 1 ]; then printf 'tests/run-fixtures.sh: --filter, --only-container, --only-host-local are mutually exclusive\n' >&2 exit 64 fi # Allowlist DISTRO so an attacker-controlled value cannot reach the # docker invocation (T-06-07). Anything outside {arch, alpine, opensuse} # exits 64 BEFORE the dispatch fork. if [ -n "$ONLY_CONTAINER" ]; then case "$ONLY_CONTAINER" in arch|alpine|opensuse) ;; *) printf 'tests/run-fixtures.sh: --only-container DISTRO must be one of: arch alpine opensuse\n' >&2 exit 64 ;; esac fi if [ -n "$FILTER" ]; then # Glob discovery; suppress nullglob-style failure to a clear error. set +e # Globbing is intentional: the trailing *.sh expands to match case files. # shellcheck disable=SC2086,SC2231 matches=$(ls tests/cases/${FILTER}*.sh 2>/dev/null) set -e if [ -z "$matches" ]; then printf 'tests/run-fixtures.sh: no cases matched: tests/cases/%s*.sh\n' "$FILTER" >&2 exit 1 fi printf 'modulejail tests: host-local case run (filter=%s)\n' "$FILTER" FAIL=0 TOTAL=0 for case_file in $matches; do TOTAL=$((TOTAL + 1)) printf '\n-- %s --\n' "$case_file" if sh "$case_file"; then : # case prints its own [name] PASS line else FAIL=$((FAIL + 1)) fi done if [ "$FAIL" -gt 0 ]; then printf '\nmodulejail tests: %d/%d case(s) FAILED.\n' "$FAIL" "$TOTAL" >&2 exit 1 fi printf '\nmodulejail tests: %d/%d case(s) PASSED.\n' "$TOTAL" "$TOTAL" exit 0 fi # --- Optional --only-container DISTRO mode ------------------------------- # CI matrix per-axis dispatch. Builds and runs exactly ONE fixture-tier # container (arch / alpine / opensuse). Does NOT run the host-local # layer or the other two containers. DISTRO has already been validated # against the allowlist {arch, alpine, opensuse} above. if [ -n "$ONLY_CONTAINER" ]; then if command -v docker >/dev/null 2>&1; then RUNTIME=docker elif command -v podman >/dev/null 2>&1; then RUNTIME=podman else printf 'tests/run-fixtures.sh: --only-container requires docker or podman; neither found in PATH\n' >&2 exit 64 fi printf 'modulejail tests: container fixture run (only-container=%s)\n' "$ONLY_CONTAINER" img=modulejail-fixture-$ONLY_CONTAINER printf '\n== Building %s fixture ==\n' "$ONLY_CONTAINER" if ! "$RUNTIME" build -f "tests/fixtures/$ONLY_CONTAINER/Dockerfile" -t "$img" .; then printf '[only-container=%s] FAIL (build)\n' "$ONLY_CONTAINER" >&2 exit 1 fi printf '== Running %s fixture ==\n' "$ONLY_CONTAINER" if "$RUNTIME" run --rm "$img" sh /tests/lib/run-in-fixture.sh "$ONLY_CONTAINER"; then printf '[only-container=%s] PASS\n' "$ONLY_CONTAINER" exit 0 fi printf '[only-container=%s] FAIL\n' "$ONLY_CONTAINER" >&2 exit 1 fi # --- Optional --only-host-local mode ------------------------------------- # CI matrix host-local-axis dispatch. Runs every tests/cases/*.sh and # nothing else. Mirrors the host-local portion of the default-mode flow # below; the duplication is acceptable per D-Phase6-06 ("same harness, # axis-selected") - the contract is that the same case-discovery loop # runs, not that there is a single shared implementation. if [ "$ONLY_HOST_LOCAL" = 1 ]; then HOST_CASES=$(ls tests/cases/*.sh 2>/dev/null || true) if [ -z "$HOST_CASES" ]; then printf 'tests/run-fixtures.sh: --only-host-local: no host-local cases under tests/cases/\n' >&2 exit 77 fi printf 'modulejail tests: host-local case run (only-host-local)\n' FAIL=0 TOTAL=0 for case_file in $HOST_CASES; do TOTAL=$((TOTAL + 1)) printf '\n-- %s --\n' "$case_file" if sh "$case_file"; then : # case prints its own [name] PASS line else FAIL=$((FAIL + 1)) fi done if [ "$FAIL" -gt 0 ]; then printf '\nmodulejail tests: %d/%d case(s) FAILED.\n' "$FAIL" "$TOTAL" >&2 exit 1 fi printf '\nmodulejail tests: %d/%d case(s) PASSED.\n' "$TOTAL" "$TOTAL" exit 0 fi # --- Default mode: host-local cases + (optional) container matrix -------- # Detect container runtime up-front. Absence is no longer fatal; the # host-local cases still run. A stderr banner names the missing runtime # so operators reading their terminal output notice. if command -v docker >/dev/null 2>&1; then RUNTIME=docker elif command -v podman >/dev/null 2>&1; then RUNTIME=podman else RUNTIME="" printf 'modulejail tests: no container runtime found (docker/podman); running host-local cases only.\n' >&2 printf 'modulejail tests: install colima/OrbStack on macOS, or run on a Linux host with docker/podman, to enable the container matrix.\n' >&2 fi # Unified counters for the combined host-local + container layers. FAIL=0 TOTAL=0 # --- Host-local layer (always runs) -------------------------------------- # Discover every tests/cases/*.sh. Each case is self-contained (builds # its own synthetic kernel tree under a tempdir, exports test-only env # vars) and exercises one behaviour. Runs on any host. HOST_CASES=$(ls tests/cases/*.sh 2>/dev/null || true) if [ -z "$HOST_CASES" ]; then if [ -z "$RUNTIME" ]; then # No container runtime AND no host-local cases means nothing # was actually exercised. Surface as the autoconf/TAP skip code. printf 'modulejail tests: no host-local cases under tests/cases/ and no container runtime; skipping.\n' >&2 exit 77 fi else printf 'modulejail tests: running host-local cases under tests/cases/\n' for case_file in $HOST_CASES; do TOTAL=$((TOTAL + 1)) printf '\n-- %s --\n' "$case_file" if sh "$case_file"; then : # case prints its own [name] PASS line else FAIL=$((FAIL + 1)) fi done fi # --- Container layer (only when a runtime is present) -------------------- if [ -n "$RUNTIME" ]; then printf '\nmodulejail tests: using %s for container matrix\n' "$RUNTIME" for distro in arch alpine opensuse; do TOTAL=$((TOTAL + 1)) img=modulejail-fixture-$distro printf '\n== Building %s fixture ==\n' "$distro" if ! "$RUNTIME" build -f "tests/fixtures/$distro/Dockerfile" -t "$img" .; then FAIL=$((FAIL+1)) continue fi printf '== Running %s fixture ==\n' "$distro" if "$RUNTIME" run --rm "$img" sh /tests/lib/run-in-fixture.sh "$distro"; then printf '[%s] PASS\n' "$distro" else printf '[%s] FAIL\n' "$distro" FAIL=$((FAIL+1)) fi done fi # --- Aggregate summary --------------------------------------------------- if [ "$FAIL" -gt 0 ]; then printf '\nmodulejail tests: %d/%d case(s) FAILED.\n' "$FAIL" "$TOTAL" >&2 exit 1 fi printf '\nmodulejail tests: %d/%d case(s) PASSED.\n' "$TOTAL" "$TOTAL" jnuyens-modulejail-06d8d74/tests/run-ssh-hosts.sh000077500000000000000000000211651520651617500221450ustar00rootroot00000000000000#!/bin/sh # tests/run-ssh-hosts.sh — real-SSH-host acceptance for modulejail. # # Runs the modulejail smoke suite against three live Linux hosts via SSH: # ubuntu-wifi (Ubuntu 24.04, Debian/Ubuntu family), # debian13 (Debian 13 trixie, Debian/Ubuntu family second data point), # rocky9 (Rocky Linux 9.7, RHEL family). # # Each host gets: # 1. /etc/os-release capture (evidence pin; rocky9 confirmation) # 2. modulejail copied over to /tmp/mj-test # 3. --version exit-0 check # 4. Bad-flag → EX_USAGE=64 check # 5. Directory-as-output → EX_CANTCREAT=73 check # 6. Successful run with -o /tmp/mj-host-run1.conf (non-root, write-to-/tmp; # original methodology preserved — no risk to host /etc/modprobe.d/) # 7. Idempotency: second run → cmp byte-identical # 8. Success-line shape regex check on the run-6 stdout # 9. Generated file header shape: line 1 = "# modulejail " # (VERSION auto-derived from the modulejail script under test, so # the assertion survives future SemVer bumps without edits), # line 5 = "# fingerprint: sha256:<64 hex>" # 10. Portability grep assertion (no per-distro branches in the script that # was just copied over) # # Special handling for rocky9: SELinux on RHEL family # may deny non-root reads in parts of /lib/modules//, which legitimately # trips EX_OSERR=71 ("find reported errors"). If we observe rc=71 on rocky9, # the harness records it as a documented expected behavior (not a regression) # and proceeds with the remaining hosts. The SUMMARY notes this for the # README's Cross-distro support section. # # Exit codes: # 0 — all hosts passed (or rocky9 surfaced documented EX_OSERR=71) # 1 — at least one host failed an assertion in an unexpected way # 2 — unable to reach one or more hosts (SSH connection failure) set -eu REPO_ROOT=$(cd "$(dirname "$0")/.." && pwd) SCRIPT=$REPO_ROOT/modulejail if [ ! -f "$SCRIPT" ]; then printf 'run-ssh-hosts: error: cannot find modulejail at %s\n' "$SCRIPT" >&2 exit 1 fi # Derive the expected version from the script under test so the line-1 # header assertion below stays correct across SemVer bumps. Previously # this was hardcoded to "# modulejail 1.0.0" and required a manual edit # on every release. Plan 03-03 bumps VERSION to 1.2.0; rather than chasing # the literal string here, read it from the source. EXPECTED_VERSION=$(awk -F"'" '/^VERSION=/ {print $2; exit}' "$SCRIPT") if [ -z "$EXPECTED_VERSION" ]; then printf 'run-ssh-hosts: error: cannot determine VERSION from %s\n' "$SCRIPT" >&2 exit 1 fi # HOSTS is overridable via the environment so the unreachable-host regression test # (tests/cases/ssh-unreachable-regression.sh) can drive the harness against # a guaranteed-unreachable name without editing this file. End-user # operators leave it unset; the default is the three real-kernel hosts. HOSTS="${HOSTS:-ubuntu-wifi debian13 rocky9}" OVERALL_FAIL=0 SUMMARY= run_host() { host=$1 label=$2 printf '\n========== [%s] %s ==========\n' "$host" "$label" # 0. Connectivity. if ! ssh -o ConnectTimeout=10 -o BatchMode=yes "$host" 'true' 2>/dev/null; then printf '[%s] SSH connection failed (check ~/.ssh/config)\n' "$host" >&2 SUMMARY="${SUMMARY}[$host] UNREACHABLE\n" return 2 fi # 1. /etc/os-release evidence pin. printf '\n-- [%s] /etc/os-release --\n' "$host" ssh "$host" 'cat /etc/os-release' | tee "/tmp/mj-${host}-osrelease.out" # 2. Copy modulejail. scp -q "$SCRIPT" "$host":/tmp/mj-test # 3. --version. printf '\n-- [%s] (3) --version exits 0 --\n' "$host" ssh "$host" 'sh /tmp/mj-test --version' rc=$? [ "$rc" -eq 0 ] || { printf '[%s] FAIL: --version rc=%d\n' "$host" "$rc" >&2; return 1; } # 4. Bad flag → EX_USAGE=64. printf '\n-- [%s] (4) bad flag → 64 --\n' "$host" ssh "$host" 'sh /tmp/mj-test --bogus-flag 2>/dev/null; echo $?' > "/tmp/mj-${host}-rc4.out" rc=$(cat "/tmp/mj-${host}-rc4.out") [ "$rc" -eq 64 ] || { printf '[%s] FAIL: bad flag expected 64 got %s\n' "$host" "$rc" >&2; return 1; } # 5. Directory-as-output → EX_CANTCREAT=73. printf '\n-- [%s] (5) -o /tmp → 73 --\n' "$host" ssh "$host" 'sh /tmp/mj-test -o /tmp 2>/dev/null; echo $?' > "/tmp/mj-${host}-rc5.out" rc=$(cat "/tmp/mj-${host}-rc5.out") [ "$rc" -eq 73 ] || { printf '[%s] FAIL: -o /tmp expected 73 got %s\n' "$host" "$rc" >&2; return 1; } # 6. Successful run #1 (non-root → write-to-/tmp). printf '\n-- [%s] (6) successful run #1 → /tmp/mj-host-run1.conf --\n' "$host" set +e ssh "$host" 'sh /tmp/mj-test -o /tmp/mj-host-run1.conf' > "/tmp/mj-${host}-stdout1.out" 2>&1 rc=$? set -e # rocky9-specific: SELinux on /lib/modules can legitimately surface # EX_OSERR=71 under non-root. Document and skip the remaining # real-kernel-walk-dependent assertions. if [ "$rc" -eq 71 ] && [ "$host" = "rocky9" ]; then printf '[%s] OBSERVED: EX_OSERR=71 (SELinux likely deny on non-root /lib/modules read)\n' "$host" printf ' (This is documented expected behavior for rocky9 non-root\n' printf ' smoke runs. README should note this.)\n' SUMMARY="${SUMMARY}[$host] PASS (with documented EX_OSERR=71 on non-root SELinux deny)\n" return 0 fi [ "$rc" -eq 0 ] || { printf '[%s] FAIL: successful run rc=%d (expected 0). stdout/stderr:\n' "$host" "$rc" >&2; cat "/tmp/mj-${host}-stdout1.out" >&2; return 1; } # 7. Idempotency: second run, cmp byte-identical. printf '\n-- [%s] (7) successful run #2 + cmp --\n' "$host" ssh "$host" 'sh /tmp/mj-test -o /tmp/mj-host-run2.conf && cmp /tmp/mj-host-run1.conf /tmp/mj-host-run2.conf && echo IDEMPOTENT' rc=$? [ "$rc" -eq 0 ] || { printf '[%s] FAIL: idempotency cmp rc=%d\n' "$host" "$rc" >&2; return 1; } # 8. Success-line shape regex. printf '\n-- [%s] (8) success line shape --\n' "$host" if ! grep -qE '^modulejail: blacklisted [0-9]+ of [0-9]+ modules \(profile=conservative\) -> /tmp/mj-host-run1\.conf$' "/tmp/mj-${host}-stdout1.out"; then printf '[%s] FAIL: success line shape (stdout was:)\n' "$host" >&2 cat "/tmp/mj-${host}-stdout1.out" >&2 return 1 fi # 9. Header shape on the remote-generated file. printf '\n-- [%s] (9) header shape (lines 1, 5) --\n' "$host" ssh "$host" 'head -6 /tmp/mj-host-run1.conf' > "/tmp/mj-${host}-head.out" line1=$(sed -n '1p' "/tmp/mj-${host}-head.out") line5=$(sed -n '5p' "/tmp/mj-${host}-head.out") if [ "$line1" != "# modulejail $EXPECTED_VERSION" ]; then printf '[%s] FAIL: header line 1 was: %s (expected: # modulejail %s)\n' "$host" "$line1" "$EXPECTED_VERSION" >&2; return 1 fi if ! printf '%s\n' "$line5" | grep -qE '^# fingerprint: sha256:[0-9a-f]{64}$'; then printf '[%s] FAIL: header line 5 was: %s\n' "$host" "$line5" >&2; return 1 fi # Capture fingerprint for cross-host correlation (recorded in SUMMARY). fp=$(printf '%s\n' "$line5" | awk '{print $3}') printf '[%s] fingerprint: %s\n' "$host" "$fp" # 10. Portability grep assertion on the script that was copied over. printf '\n-- [%s] (10) no per-distro branches --\n' "$host" set +e ssh "$host" "grep -nE '/etc/os-release|/etc/lsb-release|/etc/redhat-release|/etc/debian_version|ID_LIKE|ID=ubuntu|ID=debian|ID=rhel|ID=fedora|ID=arch|ID=alpine|ID=opensuse' /tmp/mj-test" grc=$? set -e # grep returns 1 when there are NO matches — exactly what we want. [ "$grc" -eq 1 ] || { printf '[%s] FAIL: per-distro grep found matches (grep rc=%d)\n' "$host" "$grc" >&2; return 1; } SUMMARY="${SUMMARY}[$host] PASS (fingerprint: $fp)\n" printf '[%s] HOST PASS\n' "$host" } UNREACHED=0 # Bracket the run_host call with set +e / set -e # and capture rc=$? directly from a bare call. The previous # `if ! run_host ...; then rc=$?` shape captured the inverted-condition # `!` exit (always 0 inside the `then` branch under POSIX /bin/sh, dash, # and bash), so an unreachable host (run_host returns 2) was mis-classified # as OVERALL_FAIL instead of UNREACHED and the harness exited 1 instead of # the documented 2. for host in $HOSTS; do set +e run_host "$host" "real-kernel acceptance" rc=$? set -e case "$rc" in 0) ;; 2) UNREACHED=$((UNREACHED+1)) ;; *) OVERALL_FAIL=$((OVERALL_FAIL+1)) ;; esac done printf '\n========== SUMMARY ==========\n' printf '%b' "$SUMMARY" if [ "$UNREACHED" -gt 0 ]; then printf '\nrun-ssh-hosts: %d host(s) UNREACHABLE.\n' "$UNREACHED" >&2 exit 2 fi if [ "$OVERALL_FAIL" -gt 0 ]; then printf '\nrun-ssh-hosts: %d host(s) FAILED.\n' "$OVERALL_FAIL" >&2 exit 1 fi printf '\nrun-ssh-hosts: all hosts PASSED.\n'