30

In Android 6, the user has (finally!) the possibility of approving or denying specific permissions to an app.

However, I couldn't find a way to approve or deny network access, either via Wi-Fi or via cellular data connection. The relevant permission appears in "Other app capabilities" and it's only informative -- apparently there's no way to change it.

Here's an example with the Chess Free app:

screenshot

|improve this question
  • 4
    You can't. Let me find a credible source but you can't do it natively since it would hurt Google's interests a lot (ads, that is). Edit: You would find this article interesting: androidpolice.com/2015/06/06/… – Firelord♦ Feb 27 '16 at 23:32
27

You won't be able to achieve success through the native mechanism of Android.

Cody Toombs at Android Police has very well pointed this out in the article: Android M Will Never Ask Users For Permission To Use The Internet, And That's Probably Okay.

In the section Normal and Dangerous Permissions of the document Permissions Overview, Google has noted:

Permissions are divided into several protection levels.

There are two protection levels that affect thrid party apps: normal and dangerous permissions.

  • Normal permissions cover areas where your app needs to access data or resources outside the app's sandbox, but where there's very little risk to the user's privacy or the operation of other apps. For example, permission to set the time zone is a normal permission.

    If an app declares in its manifest that it needs a normal permission, the system automatically grants the app that permission at install time. The system does not prompt the user to grant normal permissions, and users cannot revoke these permissions.

  • Dangerous permissions cover areas where the app wants data or resources that involve the user's private information, or could potentially affect the user's stored data or the operation of other apps. For example, the ability to read the user's contacts is a dangerous permission. If an app declares that it needs a dangerous permission, the user has to explicitly grant the permission to the app.

(Emphasis mine)

Surprising or not, the following permissions comes under the list of Normal Permissions:

  • CHANGE_NETWORK_STATE - allows applications to change network connectivity state - i.e. mobile data;
  • CHANGE_WIFI_STATE - allows applications to change Wi-Fi connectivity state;
  • INTERNET - allows applications to open network sockets.

If that doesn't suffice, checkout the permissions managed by AppOps here. If you don't find your permission listed there, you won't be able to do anything with it in GUI.

Since alternative methods are already extensively covered on this site, refer to:

|improve this answer
  • 11
    Thanks for your answer. It's disappointing when features are crippled not because of technical impossibilities but because of market reasons. – dr01 Feb 28 '16 at 11:25
25

You could use NetGuard (see my list of Internet Firewalls for other alternatives), which works without root and lets you block internet access for apps selectively (WiFi or mobile data, and even always or only if screen is off). It's from the dev of XPrivacy, so it has to be good ;)

Netguard Netguard Netguard
NetGuard (source: Google Play; click images for larger variants)

NetGuard is open source, so you can also find it at F-Droid.

Update: Note that recent versions of Netguard include Google Ads as well as Firebase Analytics – two things which IMHO have no business in a firewall (or any other security) application – which most likely is the reason it is no longer updated on F-Droid's official repo (still available in mine with the appropriate warnings).

|improve this answer
  • 1
    NetGuard's F-Droid variant actually has added functionality beyond that allowed in the Play Store. – andDevW May 24 '16 at 20:27
  • Can it block in-app ads? – Immortal Player Dec 13 '17 at 1:04
  • 1
    @ImmortalPlayer if an app is denied network access, it cannot load ads either. So the answer to that would be "yes". – Izzy♦ Dec 13 '17 at 7:08
6

There are some really cool apps that can do it without rooting. Here are two examples:

|improve this answer
4

If you have root access you could also use:

I have updated my device to Android 6.0.1 and until now both seem to work.

|improve this answer
3

Internet access cannot be denied for individual apps on Android natively. Ads are the major sources of Google's revenue.

However if you're using Opera Max, you can restrict internet access to individual apps. You can even save data, thanks to Opera's compression technology.

Install Opera Max from Play Store. It's completely free and easy to use. No root required.

|improve this answer
  • Update: No longer a fan of Opera Max after they started serving too many ads. – NVZ Jan 12 at 20:08
3

In light of some recent events, I'd like to improve this question by introducing Triangle by Google. Get it on APKMirror or APKPure and install it with ADB.

Here are some of the key features.

Mobile data used Ask to allow data for blocked apps Turn off when on Wi-Fi Block everything by default

It's not a VPN, it blocks locally your apps' access to Internet. Think of it as a new permission just like using the camera or having access to your location.

|improve this answer
  • 1
    Does this use a VPN/proxy like similar apps? Does it block access from native libraries? – hackel Aug 7 '17 at 20:31
  • 1
    @hackel I installed it (had to sideload since it said not avilable in my country). It asked me to enable a VPN. Also doesn't seem to block WIFI. – Bort Nov 16 '17 at 1:17
3

Preamble

It may be late, but I wish to add my own take on your question, for completeness' sake. This answer is a surefire way to block internet access to an application. The downsides? It doesn't block Intents, it is convoluted and might make the target app crash, and it requires root privileges.

It has been tested and confirmed to work up to Android 7.1.2.

Rationale

As mentioned by the other answerers, any app which wishes to access the internet, must declare the android.permission.INTERNET undeniable permission within its AndroidManifest.xml. How does Android remember which permissions an app requested, though? By saving them inside packages.xml, a protected file located at /data/system.

It goes without saying that someone like us might be interested in editing said file, for the purpose of adding or removing a permission, provided they have root privileges. This is our way to negate internet access to an app without VPNs or firewall software.

The packages.xml file

The packages.xml file lists all of the installed apps, together with their paths and permissions. Each app is placed between the <package></package> tags; for the sake of my answer, I'll target Nova Launcher by TeslaCoil. The app's stanza in the file is as follows:

    <package name="com.teslacoilsw.launcher" codePath="/data/app/com.teslacoilsw.launcher-1" nativeLibraryPath="/data/app/com.teslacoilsw.launcher-1/lib" publicFlags="944258628" privateFlags="0" ft="16075caace8" it="16075cac965" ut="16075cac965" version="53000" userId="10083" installer="com.android.packageinstaller">
        <sigs count="1">
            <cert index="7" key="3082034d30820235a0030201020204638fbad3300d06092a864886f70d01010b05003057315530530603550403134c726f636b7a35353535204f553d44726f69642046726565646f6d20556e6974204f3d44726f69642046726565646f6d20496e63204c3d556e6b6e6f776e20533d556e6b6e6f776e20433d4c4b301e170d3134313230353030343535375a170d3434313132373030343535375a3057315530530603550403134c726f636b7a35353535204f553d44726f69642046726565646f6d20556e6974204f3d44726f69642046726565646f6d20496e63204c3d556e6b6e6f776e20533d556e6b6e6f776e20433d4c4b30820122300d06092a864886f70d01010105000382010f003082010a0282010100818b312365be3e55f48989d43468880067464eca65aa3ba73305178311fc2a053c143182f6d2ea635b57dc327adf8a5a9b763c03f0a48c38530114e6979358d6bfca37d161ca6fe8bb0d80f061d7b67bc1456cdfc38e0cda2ebd05c48113f701140950f0fe4315de6b95c7504129abb2c1a61f1e4f1229fb83f474dbcd7dc957b84a1b8a2aa0157b223609d77980a3f579c93fbb24a6f9fbb5a8e207cccdf1add616c95c732d5c114c0168fdbd9c00ddf211c2b8886b9498a34f389025802e334f404b7e4eb75f6308f086e5bdac64db10053c7ff8d21a350b941d5394ffbe2bd037139134eb065c2317625e65d3f628aecf7965a0d70b02e68aa8371efd1fe50203010001a321301f301d0603551d0e04160414a4e66b693ecdf3241883e3eed668354e1531ba11300d06092a864886f70d01010b050003820101003992f3f461a290db767911a4a519f035fe0c34e597e2fba2e31371e260bd2fc8f9a93c35e6f06553d02588d2f8453ee784d2ba09a696e66304e3e01f7c6bdf5b2747fc73f79d00379cc94eefa542c8eb308318364df2fa1a9c6a7ef0669d08f7b1f8635d0d4331e2817d5aeb0854760116c29801cf915ef67d5c0e04861cad4fa7b96fe8f9a0baf0cda649cd35a7122142ba38b2d16d9d319a8604a41fe0025d89be87f84ce8fc080ab54c76a96f3d9b70b1a5f5e18e48768e3684bca8a950665e16a6d50cf0045949baebca876d55eeba52ea421f33009872d9d654f8f8caa1bb465d754694d4bf6cb92f3299fbec3781849b37e6ba23ffe3d6c20ecb9bc65d" />
        </sigs>
        <perms>
            <item name="com.android.launcher3.permission.READ_SETTINGS" granted="true" flags="0" />
            <item name="com.google.android.c2dm.permission.RECEIVE" granted="true" flags="0" />
            <item name="com.teslacoilsw.launcher.permission.C2D_MESSAGE" granted="true" flags="0" />
            <item name="android.permission.EXPAND_STATUS_BAR" granted="true" flags="0" />
            <item name="android.permission.WRITE_MEDIA_STORAGE" granted="true" flags="0" />
            <item name="android.permission.INTERNET" granted="true" flags="0" />
            <item name="android.permission.ACCESS_NETWORK_STATE" granted="true" flags="0" />
            <item name="android.permission.SET_WALLPAPER" granted="true" flags="0" />
            <item name="android.permission.SET_WALLPAPER_HINTS" granted="true" flags="0" />
            <item name="android.permission.VIBRATE" granted="true" flags="0" />
            <item name="android.permission.ACCESS_WIFI_STATE" granted="true" flags="0" />
            <item name="android.permission.WAKE_LOCK" granted="true" flags="0" />
        </perms>
        <proper-signing-keyset identifier="10" />
    </package>

The indentation is reported verbatim from the file.

Procedure

Armed with the above knowledge, we can now proceed to examine Nova Launcher's permissions, wrapped between <perms></perms>. Soon enough, we will find the only one we need to edit:

            <item name="android.permission.INTERNET" granted="true" flags="0" />

To effectively deny internet access to the app, we merely need to delete the whole line and reboot our device. Commenting it out for future use is useless: Android examines this file at every boot, and will purge your comments.

Drawbacks

Following this procedure will net you an app which cannot communicate with the internet in any way. However, poorly coded apps and software intended for Marshmallow and above might crash upon trying to connect to the internet, as Nova does.

Moreover, as pointed out by Firelord, updating an app causes the changes to revert, effectively voiding our efforts and requiring the permission to be deleted anew.

Amending this procedure

To reverse what we did above, all that's needed is to add the permission we deleted back among the other ones and to reboot the device.

Disclaimer

I'm in no way affiliated to Nova Launcher or its developers.

|improve this answer

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.