Editing the rules as a user with a GUI is the easy part. The more difficult parts are in details: - how do you recognize which applications the packets belongs

Editing the rules as a user with a GUI is the easy part. The more difficult parts are in details: - how do you recognize which applications the packets belongs to? Even if you would get pid in the rules engine (which you normally don't), how do you name it? /proc/$pid/cmdline can be manipulated at will by the process; then you need to recognize additional parameters when you are using applications that run other code, from bash to virtualbox. - what happens to the connection while the firewall is waiting for the user input in the UI? Linux apps handle long timeouts badly - what happens to other connections while the firewall is waiting for the user input in the UI? Right now, unfortunately, whey would have to wait too. - LittleSnitch does interesting heuristic wrt hostname/ip translation - you can get different (or no) hostname via reverse query than the application asked for. You need to monitor what each application is resolving and what answers it get. If you get same IPs for different hostnames for a single application, all bets are off, only application knows which one it connects to (you can eventually learn with DPI, but for that it might be too late). For applications with their own resolvers using DoH/DoT, tough luck. The first problem could be solved at the level of sandbox runtimes (i.e. flatpak et al), i.e. when you know, that the application is running in the namespace belonging to specific flatpak package, you would present that as that specific application, they cannot lie about that anymore but the price is, that you can handle only sandboxed apps; for scripting and so on you still have to find how to distinguish specific instances. For all the other problems, you would have to figure them out.