Mandatory Access Control: SELinux/AppArmor Type Enforcement (2D)

Every process and every resource on a hardened Linux system carries a security type assigned by policy, and a request is granted only if an explicit rule allows that exact (subject type, object type, action) combination — everything else is denied by default. This 2D canvas simulator renders that decision engine directly: pick any of the five real SELinux-style process domains (user_t, httpd_t, sshd_t, backup_t, or an injected compromised_t) and any of the six labelled resources (web_content_t, etc_t, the sensitive shadow_t, log_t, tmp_t, backup_store_t), request a permission, and watch two genuinely independent checks run side by side — a simulated Unix DAC permission-bits check, and the real SELinux-style policy-table (MAC) check with default-deny — so you can see the exact case where DAC bits alone would allow access but mandatory policy still blocks it. The policy table itself is fully editable: toggle, remove, or add rules and watch every future request re-evaluate against it live.