ZoneAlarm-type firewall for Linux?

[Victor Odhner]

I love that ZoneAlarm gives me a fresh alert each
time I update Firefox, for example ... do you want
*this* version of Firefox to connect to the Internet?
I'd really like to see that kind of trojan protection
in the Linux world.

I tend to be overly trusting of the apps that I run
under Linux, but I'd certainly like to know when
one of them decides to phone home.

Is there anything available in the Linux world that
resembles ZoneAlarm's per-application outbound
firewall?  Does iptables know what application is
sourcing an outbound connection?  Is it technically
feasible to insert that kind of hook?

This is a question that came to me during a thread
on Adobe Reader, but I didn't see an answer.

Googling for "Outbound firewall" and "Linux"
just brought up a bunch of recent articles about
Vista's outbound firewall being disabled by
default.

I've been very impressed by ZoneAlarm.  This
evening it stepped in once again ... I brought up
Adobe Reader under Windows, and it tried to
connect out.  I've now disabled that feature.

Adobe Reader also claimed there was a script
inside the PDF, which I had generated with
"Cute PDF Writer", and didn't I want to enable
the scripts?

I suspect it is wrong about that, but it would be
nice if I could disassemble the PDF and see for
myself -- especially since I'm mailing that PDF
out to a few dozen people.

Vic