[gentoo-hardened] whitelist of apps granted network access?

[Jan Klod]

Is there some known good way to make an effective whitelist of applications, 
which are granted network access?

By the way, there is another related question: I remember, I once started 
googleearth as user1 and had firefox running as user2; really, googleearth 
opened link into user2's firefox! So I can easily have an illusion of 
protection such a way (user1 application bypasses firewall by signalling 
user2 application somehow).
What the question really is? How can I know, that particular application can 
make / accept a dangerous signal (or other interprocess comm.) and how can I 
forbid that, if necessary? 

Jan