Hacker News Reader

Debian 12 now includes opensnitch, but it isn't installed by default:

https://people.skolelinux.org/pere/blog/OpenSnitch_available...

For permission management you want all your apps from outside the distro (like Flathub), or you can manually use bubblewrap or firejail to create custom sandboxes.

Manjaro actually includes Portmaster [0] as a package [1], which is now being moved to "extra".

[0] https://safing.io/portmaster

[1] https://software.manjaro.org/package/portmaster-stub

I think PureOS includes GUFW by default. Does that count or do you mean something else by application firewall?

I mean something else. An application firewall is something like opensnitch where you can block processes from communicating with specific external domains/ips.