iptables/pf rule to only allow XY application/user?

I think there is no iptables/pf solution to only allow an XY application on e.g.: outbound tcp port 80, eth0. So if I have a userid: “500″ then how could I block any other communications then the mentioned on port 80/outbound/tcp/eth0? (e.g.: just privoxy is using port 80 on eth0)

Extra: virtualbox uses port 80 too? when a browser on the guest os visits a site..how to declaire that? – setting the normal user would be too much hole