Preamble
It may be late, but I wish to add my own take on your question, for completeness' sake. This answer is a surefire way to block internet access to an application. The downsides? It doesn't block Intents, it is convoluted and might make the target app crash, and it requires root privileges.
It has been tested and confirmed to work up to Android 7.1.2.
Rationale
As mentioned by the other answerers, any app which wishes to access the internet, must declare the android.permission.INTERNET
undeniable permission within its AndroidManifest.xml
. How does Android remember which permissions an app requested, though? By saving them inside packages.xml
, a protected file located at /data/system
.
It goes without saying that someone like us might be interested in editing said file, for the purpose of adding or removing a permission, provided they have root privileges. This is our way to negate internet access to an app without VPNs or firewall software.
The packages.xml
file
The packages.xml
file lists all of the installed apps, together with their paths and permissions. Each app is placed between the <package></package>
tags; for the sake of my answer, I'll target Nova Launcher by TeslaCoil. The app's stanza in the file is as follows:
<package name="com.teslacoilsw.launcher" codePath="/data/app/com.teslacoilsw.launcher-1" nativeLibraryPath="/data/app/com.teslacoilsw.launcher-1/lib" publicFlags="944258628" privateFlags="0" ft="16075caace8" it="16075cac965" ut="16075cac965" version="53000" userId="10083" installer="com.android.packageinstaller">
<sigs count="1">
<cert index="7" key="3082034d30820235a0030201020204638fbad3300d06092a864886f70d01010b05003057315530530603550403134c726f636b7a35353535204f553d44726f69642046726565646f6d20556e6974204f3d44726f69642046726565646f6d20496e63204c3d556e6b6e6f776e20533d556e6b6e6f776e20433d4c4b301e170d3134313230353030343535375a170d3434313132373030343535375a3057315530530603550403134c726f636b7a35353535204f553d44726f69642046726565646f6d20556e6974204f3d44726f69642046726565646f6d20496e63204c3d556e6b6e6f776e20533d556e6b6e6f776e20433d4c4b30820122300d06092a864886f70d01010105000382010f003082010a0282010100818b312365be3e55f48989d43468880067464eca65aa3ba73305178311fc2a053c143182f6d2ea635b57dc327adf8a5a9b763c03f0a48c38530114e6979358d6bfca37d161ca6fe8bb0d80f061d7b67bc1456cdfc38e0cda2ebd05c48113f701140950f0fe4315de6b95c7504129abb2c1a61f1e4f1229fb83f474dbcd7dc957b84a1b8a2aa0157b223609d77980a3f579c93fbb24a6f9fbb5a8e207cccdf1add616c95c732d5c114c0168fdbd9c00ddf211c2b8886b9498a34f389025802e334f404b7e4eb75f6308f086e5bdac64db10053c7ff8d21a350b941d5394ffbe2bd037139134eb065c2317625e65d3f628aecf7965a0d70b02e68aa8371efd1fe50203010001a321301f301d0603551d0e04160414a4e66b693ecdf3241883e3eed668354e1531ba11300d06092a864886f70d01010b050003820101003992f3f461a290db767911a4a519f035fe0c34e597e2fba2e31371e260bd2fc8f9a93c35e6f06553d02588d2f8453ee784d2ba09a696e66304e3e01f7c6bdf5b2747fc73f79d00379cc94eefa542c8eb308318364df2fa1a9c6a7ef0669d08f7b1f8635d0d4331e2817d5aeb0854760116c29801cf915ef67d5c0e04861cad4fa7b96fe8f9a0baf0cda649cd35a7122142ba38b2d16d9d319a8604a41fe0025d89be87f84ce8fc080ab54c76a96f3d9b70b1a5f5e18e48768e3684bca8a950665e16a6d50cf0045949baebca876d55eeba52ea421f33009872d9d654f8f8caa1bb465d754694d4bf6cb92f3299fbec3781849b37e6ba23ffe3d6c20ecb9bc65d" />
</sigs>
<perms>
<item name="com.android.launcher3.permission.READ_SETTINGS" granted="true" flags="0" />
<item name="com.google.android.c2dm.permission.RECEIVE" granted="true" flags="0" />
<item name="com.teslacoilsw.launcher.permission.C2D_MESSAGE" granted="true" flags="0" />
<item name="android.permission.EXPAND_STATUS_BAR" granted="true" flags="0" />
<item name="android.permission.WRITE_MEDIA_STORAGE" granted="true" flags="0" />
<item name="android.permission.INTERNET" granted="true" flags="0" />
<item name="android.permission.ACCESS_NETWORK_STATE" granted="true" flags="0" />
<item name="android.permission.SET_WALLPAPER" granted="true" flags="0" />
<item name="android.permission.SET_WALLPAPER_HINTS" granted="true" flags="0" />
<item name="android.permission.VIBRATE" granted="true" flags="0" />
<item name="android.permission.ACCESS_WIFI_STATE" granted="true" flags="0" />
<item name="android.permission.WAKE_LOCK" granted="true" flags="0" />
</perms>
<proper-signing-keyset identifier="10" />
</package>
The indentation is reported verbatim from the file.
Procedure
Armed with the above knowledge, we can now proceed to examine Nova Launcher's permissions, wrapped between <perms></perms>
. Soon enough, we will find the only one we need to edit:
<item name="android.permission.INTERNET" granted="true" flags="0" />
To effectively deny internet access to the app, we merely need to delete the whole line and reboot our device. Commenting it out for future use is useless: Android examines this file at every boot, and will purge your comments.
Drawbacks
Following this procedure will net you an app which cannot communicate with the internet in any way. However, poorly coded apps and software intended for Marshmallow and above might crash upon trying to connect to the internet, as Nova does.
Moreover, as pointed out by Firelord, updating an app causes the changes to revert, effectively voiding our efforts and requiring the permission to be deleted anew.
Amending this procedure
To reverse what we did above, all that's needed is to add the permission we deleted back among the other ones and to reboot the device.
Disclaimer
I'm in no way affiliated to Nova Launcher or its developers.