pledge-fig2.dot

digraph {
	graph [rankdir="LR"];
	bgcolor="transparent";

	app [label="application"];
	subgraph cluster_0 {
		label="kernel";
		sandbox [label="sandbox"];
		res [label="file"];
		sandbox -> res [style="dashed"; label="denied"]; 
	};
	app -> sandbox [label="read(2)"; color="red"; fontcolor="white"];
}