Certainly! But its not yet there, mbox is closest - as it can intercept any socket syscalls from a process, and then choose to deny based on the socket syscall

Certainly! But its not yet there, mbox is closest - as it can intercept any socket syscalls from a process, and then choose to deny based on the socket syscall arguments. Firejail could do the same, as it also has seccomp filters. Firejail is pre-compiled with syscall filter table, but could be extended/fixed to provide those in a config file. Hm, actually Im thinking firejail extended like this - firejailed process could be run in its own network namespace, catch any socket syscalls with a seccomp-filter, show what the process attempted to do to the user (through syslog or another daemon listening to present question to user with choice of UI), then if he denies/accepts it - run iptables -A OUTPUT -j REJECT/DROP/ACCEPT in the namespace of the process. Then save the "profile" for the process somewhere for next time it is invoked with firejail! Yes, yes, this would be quite nice! And all of this, even the invocation of programs using firejail with their respective profiles could be automated/integrated seamlessly, with say KDE! This would be BEAUTIFUL.