AppFilter is intended to be an application firewall for the Linux kernel. The kernel space code should provide a generic interface for application firewalls to userspace tools allowing realtime decision making in userspace. In short this means that the kernel module sends information about all socket related calls down to connected userspace daemons, which then send their decision on whether to allow the call or not back up to the kernel, which enforces the policy.