&#62; Except of course on Linux, the firewall isn't application-aware, so you can't even control which processes are allowed to open inbound communication.<p>You certainly can set application-level network privileges, and Red Hat derived distros do by default.  For example, to list all the applications that are allowed to bind to port 80:<p><pre><code>  [sweeks@kweh ~]$ sudo sesearch --allow -t http_port_t -p name_bind
  Found 15 semantic av rules:
     allow httpd_t http_port_t : tcp_socket { name_bind name_connect } ; 
     allow kerneloops_t http_port_t : tcp_socket { name_bind name_connect } ; 
     allow varnishd_t http_port_t : tcp_socket { name_bind name_connect } ; 
     allow dnsmasq_t port_type : udp_socket { recv_msg send_msg name_bind } ; 
     allow svirt_t port_type : tcp_socket { name_bind name_connect } ; 
     allow svirt_t port_type : udp_socket { recv_msg send_msg name_bind } ; 
     allow squid_t http_port_t : tcp_socket { name_bind name_connect } ; 
     allow corenet_unconfined_type port_type : tcp_socket { recv_msg send_msg name_bind name_connect } ; 
     allow portreserve_t port_type : tcp_socket name_bind ; 
     allow corenet_unconfined_type port_type : udp_socket { recv_msg send_msg name_bind } ; 
     allow portreserve_t port_type : udp_socket name_bind ; 
     allow varnishd_t port_type : tcp_socket { name_bind name_connect } ; 
     allow qemu_t port_type : tcp_socket { name_bind name_connect } ; 
     allow qemu_t port_type : udp_socket { recv_msg send_msg name_bind } ; 
     allow squid_t port_type : tcp_socket { name_bind name_connect } ;
</code></pre>
Any processes running under other domains won't be allowed to bind to port 80.