Mandatory Access Control: SELinux/AppArmor Type Enforcement

Every process and every resource on a hardened Linux system carries a security type assigned by policy, and a request is granted only if an explicit rule allows that exact (subject type, object type, action) combination — everything else is denied by default. This simulator renders that decision engine in 3D: five processes with real SELinux-style domains (user_t, httpd_t, sshd_t, backup_t) sit above six labelled resources (web_content_t, etc_t, the sensitive shadow_t, log_t, tmp_t, backup_store_t), and every access attempt fires a live pulse colored by the policy engine's verdict. Toggle Enforcing vs Permissive mode, loosen or tighten the policy, inject a compromised process with no legitimate rules of its own, and watch the AVC-style audit log fill with the same `avc: denied {...}` lines a real `audit.log` would show.