Date: Mon, 27 May 2024 09:33:51 +0200 (CEST)
From: Andreas Joseph Krogh <andreas@visena.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: pgsql-general@lists.postgresql.org
Message-ID: <VisenaEmail.6d.85d4cf952480c677.18fb8f6e74b@origo-test01.app.internal.visena.net>
In-Reply-To: <671405.1716570133@sss.pgh.pa.us>
References: <VisenaEmail.66.54f51e587b38c9cc.18fab4b4eb6@origo-test01.app.internal.visena.net> <671405.1716570133@sss.pgh.pa.us>
Subject: Re: prevent users from SELECT-ing from pg_roles/pg_database
MIME-Version: 1.0
Content-Type: multipart/mixed; 
	boundary="----=_Part_368828_1892252810.1716795231712"
Archived-At: <https://www.postgresql.org/message-id/VisenaEmail.6d.85d4cf952480c677.18fb8f6e74b%40origo-test01.app.internal.visena.net>
Precedence: bulk

------=_Part_368828_1892252810.1716795231712
Content-Type: multipart/related; 
	boundary="----=_Part_368829_512658776.1716795231712"

------=_Part_368829_512658776.1716795231712
Content-Type: multipart/alternative; 
	boundary="----=_Part_368830_1544392916.1716795231727"

------=_Part_368830_1544392916.1716795231727
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable


P=C3=A5 fredag 24. mai 2024 kl. 19:02:13, skrev Tom Lane <tgl@sss.pgh.pa.us=
=20
<mailto:tgl@sss.pgh.pa.us>>:
Andreas Joseph Krogh <andreas@visena.com> writes:
> Hi, is there a way to prevent a user/role from SELECT-ing from certain=20
> system-tables?
> I'd like the contents of pg_{user,roles,database} to not be visible to al=
l=20
> users.

As noted, you can in principle revoke the public SELECT grant from
those views/catalogs. However, the system is not designed to hide
such information, which means you'll have (at least) two kinds of
issues to worry about:

1. Queries or tools breaking that you didn't expect to break.
It's hardly uncommon for instance for queries on pg_class to
join to pg_roles to get the owner names for tables.

2. Information leaks. For example, mapping role OID to role name
is trivial with either regrole or pg_get_userbyid(), so it
wouldn't take long to scan the plausible range of role OIDs and
get all their names, even without SQL access to the underlying
catalog.

regards, tom lane


I tried:
REVOKE SELECT ON pg_catalog.pg_database FROM public;
But that doesn't prevent a normal user from querying pg_database it seems=
=E2=80=A6


--
Andreas Joseph Krogh
CTO / Partner - Visena AS
Mobile: +47 909 56 963
andreas@visena.com <mailto:andreas@visena.com>
www.visena.com <https://www.visena.com>
 <https://www.visena.com>

------=_Part_368830_1544392916.1716795231727
Content-Type: text/html;charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<style class=3D"visena-ck-5-styles">
.ck-content {
    --ck-color-image-caption-background: #f7f7f7;
    --ck-color-image-caption-text: #333333;
    --ck-color-mention-background: #990030E6;
    --ck-color-mention-text: #990030;
    --ck-color-table-caption-background: #f7f7f7;
    --ck-color-table-caption-text: #333333;
    --ck-highlight-marker-blue: #72ccfd;
    --ck-highlight-marker-green: #62f962;
    --ck-highlight-marker-pink: #fc7899;
    --ck-highlight-marker-yellow: #fdfd77;
    --ck-highlight-pen-green: #128a00;
    --ck-highlight-pen-red: #e71313;
    --ck-image-style-spacing: 1.5em;
    --ck-spacing-large: 2px;
    --ck-inline-image-style-spacing: calc(var(--ck-image-style-spacing) / 2=
);
    --ck-todo-list-checkmark-size: 16px;
    /*
    This works when email is READ in Visena-reader, because there the conte=
nt of the email is in "shadow-DOM",
     which has it's own :root, but needs to be declared in ".ck-content p, =
.ck-content div" as well for the actual
     CKEditor to display it correctly, else it get's its default from .lift=
Template

    */
    font-family: Arial, Helvetica, sans-serif;
    font-size: 14px;
}

/* ckeditor5-image/theme/imageresize.css */
.ck-content .image.image_resized {
    max-width: 100%;
    display: block;
    box-sizing: border-box;
}
/* ckeditor5-image/theme/imageresize.css */
.ck-content .image.image_resized img {
    width: 100%;
    height: auto !important;
}
/* ckeditor5-image/theme/imageresize.css */
.ck-content .image.image_resized > figcaption {
    display: block;
}
/* ckeditor5-image/theme/imagecaption.css */
.ck-content .image > figcaption {
    display: table-caption;
    caption-side: bottom;
    word-break: break-word;
    color: var(--ck-color-image-caption-text);
    background-color: var(--ck-color-image-caption-background);
    padding: .6em;
    font-size: .75em;
    outline-offset: -1px;
}

/* ckeditor5-font/theme/fontsize.css */
/* THIS IS A VISENA SPECIFIC CONFIG */
.ck-content p, .ck-content div {
    font-family: Arial, Helvetica, sans-serif;
    font-size: 14px;
}

.ck-content p.visenaNormal {
    margin: 0;
}

/* ckeditor5-font/theme/fontsize.css */
.ck-content .text-tiny {
    font-size: .7em;
}
/* ckeditor5-font/theme/fontsize.css */
.ck-content .text-small {
    font-size: .85em;
}
/* ckeditor5-font/theme/fontsize.css */
.ck-content .text-big {
    font-size: 1.4em;
}
/* ckeditor5-font/theme/fontsize.css */
.ck-content .text-huge {
    font-size: 1.8em;
}
/* ckeditor5-image/theme/imagestyle.css */
.ck-content .image-style-block-align-left,
.ck-content .image-style-block-align-right {
    max-width: calc(100% - var(--ck-image-style-spacing));
}
/* ckeditor5-image/theme/imagestyle.css */
.ck-content .image-style-align-left,
.ck-content .image-style-align-right {
    clear: none;
}
/* ckeditor5-image/theme/imagestyle.css */
.ck-content .image-style-side {
    float: right;
    margin-left: var(--ck-image-style-spacing);
    max-width: 50%;
}
/* ckeditor5-image/theme/imagestyle.css */
.ck-content .image-style-align-left {
    float: left;
    margin-right: var(--ck-image-style-spacing);
}
/* ckeditor5-image/theme/imagestyle.css */
.ck-content .image-style-align-center {
    margin-left: auto;
    margin-right: auto;
}
/* ckeditor5-image/theme/imagestyle.css */
.ck-content .image-style-align-right {
    float: right;
    margin-left: var(--ck-image-style-spacing);
}
/* ckeditor5-image/theme/imagestyle.css */
.ck-content .image-style-block-align-right {
    margin-right: 0;
    margin-left: auto;
}
/* ckeditor5-image/theme/imagestyle.css */
.ck-content .image-style-block-align-left {
    margin-left: 0;
    margin-right: auto;
}
/* ckeditor5-image/theme/imagestyle.css */
.ck-content p + .image-style-align-left,
.ck-content p + .image-style-align-right,
.ck-content p + .image-style-side {
    margin-top: 0;
}
/* ckeditor5-image/theme/imagestyle.css */
.ck-content .image-inline.image-style-align-left,
.ck-content .image-inline.image-style-align-right {
    margin-top: var(--ck-inline-image-style-spacing);
    margin-bottom: var(--ck-inline-image-style-spacing);
}
/* ckeditor5-image/theme/imagestyle.css */
.ck-content .image-inline.image-style-align-left {
    margin-right: var(--ck-inline-image-style-spacing);
}
/* ckeditor5-image/theme/imagestyle.css */
.ck-content .image-inline.image-style-align-right {
    margin-left: var(--ck-inline-image-style-spacing);
}
/* ckeditor5-image/theme/image.css */
.ck-content .image {
    clear: both;
    text-align: center;
    min-width: 50px;
    display: inline-flex;
    max-width: 100%;
    align-items: flex-start;
}
/* ckeditor5-image/theme/image.css */
.ck-content .image img {
    display: block;
    margin: 0 auto;
    max-width: 100%;
    min-width: 100%;
}
.ck-content img {
    height: auto !important;
}
/* ckeditor5-image/theme/image.css */
.ck-content .image-inline {
    /*
     * Normally, the .image-inline would have "display: inline-block" and "=
img { width: 100% }" (to follow the wrapper while resizing).;
     * Unfortunately, together with "srcset", it gets automatically stretch=
ed up to the width of the editing root.
     * This strange behavior does not happen with inline-flex.
     */
    display: inline-flex;
    max-width: 100%;
    align-items: flex-start;
}
/* ckeditor5-image/theme/image.css */
.ck-content .image-inline picture {
    display: flex;
}
/* ckeditor5-image/theme/image.css */
.ck-content .image-inline picture,
.ck-content .image-inline img {
    flex-grow: 1;
    flex-shrink: 1;
    max-width: 100%;
}
/* ckeditor5-highlight/theme/highlight.css */
.ck-content .marker-yellow {
    background-color: var(--ck-highlight-marker-yellow);
}
/* ckeditor5-highlight/theme/highlight.css */
.ck-content .marker-green {
    background-color: var(--ck-highlight-marker-green);
}
/* ckeditor5-highlight/theme/highlight.css */
.ck-content .marker-pink {
    background-color: var(--ck-highlight-marker-pink);
}
/* ckeditor5-highlight/theme/highlight.css */
.ck-content .marker-blue {
    background-color: var(--ck-highlight-marker-blue);
}
/* ckeditor5-highlight/theme/highlight.css */
.ck-content .pen-red {
    color: var(--ck-highlight-pen-red);
    background-color: transparent;
}
/* ckeditor5-highlight/theme/highlight.css */
.ck-content .pen-green {
    color: var(--ck-highlight-pen-green);
    background-color: transparent;
}
/* ckeditor5-horizontal-line/theme/horizontalline.css */
.ck-content hr {
    margin: 15px 0;
    height: 4px;
    background: #dedede;
    border: 0;
}
/* ckeditor5-block-quote/theme/blockquote.css */
.ck-content blockquote {
    overflow: hidden;
    padding-right: 0;
    padding-left: 1ex;
    margin-left: 0;
    margin-right: 0;
    font-style: unset !important;
    border-left: solid 1px #cccccc !important;
}
/* ckeditor5-table/theme/blockquote.css */
/* THIS IS A VISENA SPECIFIC CONFIG */
.ck-content .blockquote {
    font-style: unset;
}
/* ckeditor5-block-quote/theme/blockquote.css */
.ck-content[dir=3D"rtl"] blockquote {
    border-left: 0;
    border-right: solid 1px #cccccc;
}
/* ckeditor5-basic-styles/theme/code.css */
.ck-content code {
    background-color: #c7c7c7;
    padding: 0 1px;
    font-size: small;
    border-radius: 2px;
}
/* ckeditor5-table/theme/tablecaption.css */
.ck-content .table > figcaption {
    display: table-caption;
    caption-side: top;
    word-break: break-word;
    text-align: center;
    color: var(--ck-color-table-caption-text);
    background-color: var(--ck-color-table-caption-background);
    padding: .6em;
    font-size: .75em;
    outline-offset: -1px;
}
/* ckeditor5-table/theme/table.css */
.ck-content .table {
    margin: 0 auto;
    display: table;
}
/* ckeditor5-table/theme/table.css */
.ck-content .table table {
    border-collapse: collapse;
    border-spacing: 0;
    width: 100%;
    height: 100%;
    border: 1px double #b3b3b3;
}
/* ckeditor5-table/theme/table.css */
.ck-content .table table td,
.ck-content .table table th {
    min-width: 2em;
    padding: .4em;
    border: 1px solid #bfbfbf;
}
/* ckeditor5-table/theme/table.css */
.ck-content .table table th {
    font-weight: bold;
    background: #000000E6;
}
/* ckeditor5-table/theme/table.css */
.ck-content[dir=3D"rtl"] .table th {
    text-align: right;
}
/* ckeditor5-table/theme/table.css */
.ck-content[dir=3D"ltr"] .table th {
    text-align: left;
}

/*Visena specific*/
.ck-content .table {
    margin-left: 0 !important;
    /*float: left;*/
}

/* ckeditor5-page-break/theme/pagebreak.css */
.ck-content .page-break {
    position: relative;
    clear: both;
    padding: 5px 0;
    display: flex;
    align-items: center;
    justify-content: center;
}
/* ckeditor5-page-break/theme/pagebreak.css */
.ck-content .page-break::after {
    content: '';
    position: absolute;
    border-bottom: 2px dashed #c4c4c4;
    width: 100%;
}
/* ckeditor5-page-break/theme/pagebreak.css */
.ck-content .page-break__label {
    position: relative;
    z-index: 1;
    padding: .3em .6em;
    display: block;
    text-transform: uppercase;
    border: 1px solid #c4c4c4;
    border-radius: 2px;
    font-family: Arial, Helvetica, sans-serif;
    font-size: 0.75em;
    font-weight: bold;
    color: #333333;
    background: #ffffff;
    box-shadow: 2px 2px 1px #000000;
    -webkit-user-select: none;
    -moz-user-select: none;
    -ms-user-select: none;
    user-select: none;
}
/* ckeditor5-media-embed/theme/mediaembed.css */
.ck-content .media {
    clear: both;
    margin: 0 0;
    display: block;
    min-width: 15em;
}
/* ckeditor5-list/theme/todolist.css */
.ck-content .todo-list {
    list-style: none;
}
/* ckeditor5-list/theme/todolist.css */
.ck-content .todo-list li {
    margin-bottom: 5px;
}
/* ckeditor5-list/theme/todolist.css */
.ck-content .todo-list li .todo-list {
    margin-top: 5px;
}
/* ckeditor5-list/theme/todolist.css */
.ck-content .todo-list .todo-list__label > input {
    -webkit-appearance: none;
    display: inline-block;
    position: relative;
    width: var(--ck-todo-list-checkmark-size);
    height: var(--ck-todo-list-checkmark-size);
    vertical-align: middle;
    border: 0;
    left: -25px;
    margin-right: -15px;
    right: 0;
    margin-left: 0;
}
/* ckeditor5-list/theme/todolist.css */
.ck-content .todo-list .todo-list__label > input::before {
    display: block;
    position: absolute;
    box-sizing: border-box;
    content: '';
    width: 100%;
    height: 100%;
    border: 1px solid #333333;
    border-radius: 2px;
    transition: 250ms ease-in-out box-shadow, 250ms ease-in-out background,=
 250ms ease-in-out border;
}
/* ckeditor5-list/theme/todolist.css */
.ck-content .todo-list .todo-list__label > input::after {
    display: block;
    position: absolute;
    box-sizing: content-box;
    pointer-events: none;
    content: '';
    left: calc( var(--ck-todo-list-checkmark-size) / 3 );
    top: calc( var(--ck-todo-list-checkmark-size) / 5.3 );
    width: calc( var(--ck-todo-list-checkmark-size) / 5.3 );
    height: calc( var(--ck-todo-list-checkmark-size) / 2.6 );
    border-style: solid;
    border-color: transparent;
    border-width: 0 calc( var(--ck-todo-list-checkmark-size) / 8 ) calc( va=
r(--ck-todo-list-checkmark-size) / 8 ) 0;
    transform: rotate(45deg);
}
/* ckeditor5-list/theme/todolist.css */
.ck-content .todo-list .todo-list__label > input[checked]::before {
    background: #26ab33;
    border-color: #26ab33;
}
/* ckeditor5-list/theme/todolist.css */
.ck-content .todo-list .todo-list__label > input[checked]::after {
    border-color: #ffffff;
}
/* ckeditor5-list/theme/todolist.css */
.ck-content .todo-list .todo-list__label .todo-list__label__description {
    vertical-align: middle;
}
/* ckeditor5-code-block/theme/codeblock.css */
.ck-content pre {
    padding: 1em;
    color: #353535;
    background: #c7c7c7;
    border: 1px solid #c4c4c4;
    border-radius: 2px;
    text-align: left;
    direction: ltr;
    tab-size: 4;
    white-space: pre-wrap;
    font-style: normal;
    min-width: 200px;
}
/* ckeditor5-code-block/theme/codeblock.css */
.ck-content pre code {
    background: unset;
    padding: 0;
    border-radius: 0;
}
/* ckeditor5-mention/theme/mention.css */
.ck-content .mention {
    background: var(--ck-color-mention-background);
    color: var(--ck-color-mention-text);
}
@media print {
    /* ckeditor5-page-break/theme/pagebreak.css */
    .ck-content .page-break {
        padding: 0;
    }
    /* ckeditor5-page-break/theme/pagebreak.css */
    .ck-content .page-break::after {
        display: none;
    }
}
.ck-content figure.image {
    margin-left: 0;
}
.ck-content .image.image-style-block-align-right {
    margin-left: auto;
    margin-right: 0;
    float: none !important;
    display: table !important;
}
.ck-content .image.image-style-align-center {
    margin-left: auto;
    float: none !important;
    display: table !important;
}

p.MsoNormal, li.MsoNormal, div.MsoNormal {
    margin: 0;
}</style><div class=3D"ck-content" data-visena-message-id=3D"_VisenaEmail.6=
d.85d4cf952480c677.18fb8f6e74b@origo-test01.app.internal.visena.net_"><div>=
P=C3=A5 fredag 24. mai 2024 kl. 19:02:13, skrev Tom Lane &lt;<a href=3D"mai=
lto:tgl@sss.pgh.pa.us">tgl@sss.pgh.pa.us</a>&gt;:</div><blockquote style=3D=
"border-left:1px solid rgb(204, 204, 204);margin:0pt 0pt 0pt 0.8ex;padding-=
left:1ex;"><div style=3D"display:inline;font-family:monospace;font-size:12p=
x;">Andreas Joseph Krogh &lt;andreas@visena.com&gt; writes:<br>&gt; Hi, is =
there a way to prevent a user/role from SELECT-ing from certain=C2=A0<br>&g=
t; system-tables?<br>&gt; I'd like the contents of pg_{user,roles,database}=
 to not be visible to all=C2=A0<br>&gt; users.<br><br>As noted, you can in =
principle revoke the public SELECT grant from<br>those views/catalogs.=C2=
=A0 However, the system is not designed to hide<br>such information, which =
means you'll have (at least) two kinds of<br>issues to worry about:<br><br>=
1. Queries or tools breaking that you didn't expect to break.<br>It's hardl=
y uncommon for instance for queries on pg_class to<br>join to pg_roles to g=
et the owner names for tables.<br><br>2. Information leaks.=C2=A0 For examp=
le, mapping role OID to role name<br>is trivial with either regrole or pg_g=
et_userbyid(), so it<br>wouldn't take long to scan the plausible range of r=
ole OIDs and<br>get all their names, even without SQL access to the underly=
ing<br>catalog.<br><br>regards, tom lane</div></blockquote><p class=3D"vise=
naNormal">=C2=A0</p><p class=3D"visenaNormal">I tried:</p><pre><code class=
=3D"language-plaintext">REVOKE SELECT ON pg_catalog.pg_database FROM public=
;</code></pre><p class=3D"visenaNormal">But that doesn't prevent a normal u=
ser from querying <code>pg_database</code> it seems=E2=80=A6</p><p class=3D=
"visenaNormal">=C2=A0</p><div class=3D"visena-email-signature" data-visena-=
message-id=3D"_VisenaEmail.6d.85d4cf952480c677.18fb8f6e74b@origo-test01.app=
.internal.visena.net_"><div><div><div>--</div><div><span style=3D"font-fami=
ly:arial,helvetica,sans-serif;"><strong>Andreas Joseph Krogh</strong></span=
></div><div><span style=3D"font-family:arial,helvetica,sans-serif;">CTO / P=
artner</span> - Visena AS</div><div><span style=3D"font-family:arial,helvet=
ica,sans-serif;">Mobile: +47 909 56 963</span></div><div><a href=3D"mailto:=
andreas@visena.com">andreas@visena.com</a></div><div><a href=3D"https://www=
.visena.com">www.visena.com</a></div><div style=3D"padding-top:5px;"><a hre=
f=3D"https://www.visena.com"><img alt=3D"" src=3D"cid:part_F1404601225759AR=
QFDY"></a></div></div></div></div><div>=C2=A0</div></div>
------=_Part_368830_1544392916.1716795231727--

------=_Part_368829_512658776.1716795231712
Content-Type: image/png
Content-Transfer-Encoding: base64
Content-Disposition: inline
Content-ID: <part_F1404601225759ARQFDY>

iVBORw0KGgoAAAANSUhEUgAAAIUAAAAYCAYAAADUIj6hAAAABHNCSVQICAgIfAhkiAAABzBJREFU
aEPtmNFxHDcMhmVP3i1VECpvnjzkVIHWFfhcgVcVRKrAUgWRK/C6Al8H3lTgy0PGbzFdQc4VJP/H
ADs43q6kROeJNbOYgQACIAgCWJKng4MZ5gxUGXh0U0b+SIuF9G+EWXj2Q15vbrE/NPtk9uub7Gfd
t5mBx1NhqSEo8HshjbEUtlO2yIM9tsx5dZP9rPt2MzDZFAqZE4LGcFjdsg3saQaHt7fY70X949On
aS+OZidDBkavD33157L4xaw2os+Mp/DAC10l2XhOCeStj0W5ajrJL8WfCi80Xgf9vVlrhg9yRONe
/f7xI2vNsIcM7JwU9o6oGyJrLT8JOA1aX9sKP4wl94bAniukEbo/n7YPmuTETzIab4Y9ZWCrKexd
8M58lxPCvvD6aihfvexbEQoPYO8NQRO0JnddGO6FJYaVsBde7cXj7KRk4LsqDxQzCYeGsJNgaXZe
+JXkyGgWINq3Gp+bHNILz+wEYs5qH1eJrouNrpDXtk4O6x1IvtD40GWyJYYdkF0jIbYZlN16xygI
gl9smbMDsmFdfAKb23xGB8H/mv3tOJfArs1kukk79DEPdQ5u0g1vCvvqKXIW8mZYW+F3Tg4r8HvZ
kQCCLydK8EFMQCe5N8RgL9mRG0SqQFuNvdE6beSs0qPDBuCdg0+gvClso8SbTO4ki7mQzQqBrcMH
QPwReg2wW8umEe/+L8T/LEzBGF9nXjzZ46s+ITHvhegW8LL39xm6App7KYL/GE+vcYnFbJiP/0aY
hdiCnRC7jaj7eiK2ETInC5PRF6LYkSN0+HabF75WuT6syCyI0YkVGGMvUC33AmfZTDUEj8u6IVhu
EhRUJ2U2g6UlugyNb03Hl9obHwlxJbcRzcYjO4QPjVfGFTQav4vrmp7cpMp2qbHnBxWJbisbho2Q
XI6C1sIHDUFhH4Hij4UbIev66eANeiwbkA+LBsO36zAHzoXU7AhbqLAXEiOYTXcSdO8VS9L4wN8U
BIYhBd6oSUgYMijOkecRuTdQa/YiBXhbXFcnCnI2SrfeBG9NydrLYMhGHa5qB9pQIxlzAE6Okjzx
JO5afGe6kmhBicWKQNKuTZ5EW+MjQY8v/9rQ0bhJSJyNGUe/JH1t8h1iMbdSPAvxHYin6YmN9YBX
QmTYZZNh14vHhhhal5vtcIrJjmvszPRJdExH3MWHvykoBEc9CoCGWJisOLOGoCORs1FvIMbYA8z3
kwM59oemy6LlWrLxFLmWgiQAfEGd8S+NssbK+EhyGLxUkhhiy717waBqHOJYSEacwBejkFNhjJNj
v/gANOdQxPfciP/JVBCK2cOIcg3RRJ+CPrLPNVhhN6F38VKMF3XLlIJrjU5C8gMFxvKDvOcPc4rV
NjCn7KM0BV+161V8viSCuJZ8SITGJGEh7IUUlxOFMYUH1kJOCN4Wh+I5pqCuK01k40kSNtnKiKIl
UfxAgW5sU5JlS05rtt5YFJF1SWoqHv6BRgQcA4/bdb9WRjmMk3jyUMAbIoyJq9e4cVmgzKt9j5gN
J/aYDhk+hhjExwaPcz5PObA5Zd9bvz5UzCTZuZDidu5AchpiKSwPR+TV1bCWqBQ9nCjJ5neivC82
Nr4LeS2j1gw5LUqwBuhGQQU5UwHeSslXkwIynz2U2A2yKDgG7OffwLA3TpGRpk0Tzpj3ZEJXi/GR
a6GN0e0NtppChePdcAz1FTS+FN8Kpxoiykk+J8fC5tenjbu9kSqpHLu9jBrhUuhNwVGbpyZrzrl0
HPVD8SXj5EOOD/eDC64VjvYBZLuUbIVAfBN1t/C/SU+cAGtdGo+fVnzycUX5wmn6eCKPmWYJG2E/
ppTsuRCbvUD9fwquksG5GqLVKhzDQ3GrEyLKSXhsiK3T5j9EyxffCFOYi2wUlPyFFDQAhehESDjQ
GoX0ho0oj8RPou6TxHJdcT0NTcWkO0AnG7+uXsnHqcas/72wvWF+mSf7N/Watp9kTXoluzeS0fB9
9CcZ/hvhSZTfh99pispZOXL9KrGrARkNUMu9ITbScZWs7xOYNt9pwxSZtYDsX/GE3xTkrXgwAsXm
fud08FiTeC+m2/o7ppo+PTS/NBK5ARpDG5YHr++DpmVfreYdiX8mnp+DzPEG9WbqJON0JBenZofs
sxBA1gj5NXGvfJu/Qh7HwQh/VDUEyUxCit5hH94QfKkEdu+GwK8BX0hvCF+D67xhjmXQCXMwJCZ+
olK0A1EKRCE4snsh42w8Mv/Zhxw9iD7Cjo7CyQC/KyF6oBfShL4PYgG+CHsYKyZxvxZSZBAgjhIz
YDz+AbfD37GtbaoSKzgGt+lKfI/GZtay6vG4VXTpPsh+IcQhOk9I7WYeP5AM3HZ9+DaSGIp9HIuu
huC4pCGGx+YD2fcc5tfIAA0h/Et4/jX8zz4fWAasIf4UbR9Y6HO4d8jAnd4U0Y8ageuCB+c+H5R3
CHU2mTMwZ+B/y8DfSMBLLOYXVuEAAAAASUVORK5CYII=
------=_Part_368829_512658776.1716795231712--

------=_Part_368828_1892252810.1716795231712--