It may not be obvious but one (lesser) application is to block all ports to PID 1 ... for logging purpose. Most of this kind of firewall rule get created after

It may not be obvious but one (lesser) application is to block all ports to PID 1 ... for logging purpose. Most of this kind of firewall rule get created after such executable starts ... by a dedicated firewall daemon monitoring the operating system's PID state (creation/deletion/child).