Application should request the ports to be opened and the firewalld
layer should then confirm with the user stating which ports and
which app requested said ports. The app can't lie if the firewall
layer is the one asking for confirmation.
But a malicious app can pretend to be another one, unless there is a way for the
firewall to know which app is asking in a way that cannot be forged.
Pierre