In Android 6, how to deny an app permission to access the network?

Question

In Android 6, the user has (finally!) the possibility of approving or denying specific permissions to an app.

However, I couldn't find a way to approve or deny network access, either via Wi-Fi or via cellular data connection. The relevant permission appears in "Other app capabilities" and it's only informative -- apparently there's no way to change it.

Here's an example with the Chess Free app:

Answer 1

You won't be able to achieve success through the native mechanism of Android.

Cody Toombs at Android Police has very well pointed this out in the article: Android M Will Never Ask Users For Permission To Use The Internet, And That's Probably Okay.

In the section Normal and Dangerous Permissions of the document Permissions Overview, Google has noted:

Permissions are divided into several protection levels.

There are two protection levels that affect thrid party apps: normal and dangerous permissions.

• Normal permissions cover areas where your app needs to access data or resources outside the app's sandbox, but where there's very little risk to the user's privacy or the operation of other apps. For example, permission to set the time zone is a normal permission.

  If an app declares in its manifest that it needs a normal permission, the system automatically grants the app that permission at install time. The system does not prompt the user to grant normal permissions, and users cannot revoke these permissions.

• Dangerous permissions cover areas where the app wants data or resources that involve the user's private information, or could potentially affect the user's stored data or the operation of other apps. For example, the ability to read the user's contacts is a dangerous permission. If an app declares that it needs a dangerous permission, the user has to explicitly grant the permission to the app.

_{(Emphasis mine)}

Surprising or not, the following permissions comes under the list of Normal Permissions:

• CHANGE_NETWORK_STATE - allows applications to change network connectivity state - i.e. mobile data;
• CHANGE_WIFI_STATE - allows applications to change Wi-Fi connectivity state;
• INTERNET - allows applications to open network sockets.

If that doesn't suffice, checkout the permissions managed by AppOps here. If you don't find your permission listed there, you won't be able to do anything with it in GUI.

Since alternative methods are already extensively covered on this site, refer to:

• Block apps from accessing the Internet on Android device
• Are there any tools to sandbox a malware application even more than the granted permissions on Android?

Answer 2

You could use NetGuard (see my list of Internet Firewalls for other alternatives), which works without root and lets you block internet access for apps selectively (WiFi or mobile data, and even always or only if screen is off). It's from the dev of XPrivacy, so it has to be good ;)

^{NetGuard (source: Google Play; click images for larger variants)}

NetGuard is open source, so you can also find it at F-Droid.

Update: Note that recent versions of Netguard include Google Ads as well as Firebase Analytics – two things which IMHO have no business in a firewall (or any other security) application – which most likely is the reason it is no longer updated on F-Droid's official repo (still available in mine with the appropriate warnings).

Answer 3

There are some really cool apps that can do it without rooting. Here are two examples:

• LostNet Firewall Free:

  _{(Click image to enlarge)}

  

• Mobiwol: NoRoot Firewall

  _{(Click image to enlarge)}

  

Answer 4

If you have root access you could also use:

• AFWall+ - there seem to be some issues with Android M, so you should check this first "...tested with Android version 4.xx - 5.
• XPrivacy - requires the Xposed framework and supports "Android version 4.0.3 - 6.0.1"

I have updated my device to Android 6.0.1 and until now both seem to work.

Answer 5

Internet access cannot be denied for individual apps on Android natively. Ads are the major sources of Google's revenue.

However if you're using Opera Max, you can restrict internet access to individual apps. You can even save data, thanks to Opera's compression technology.

Install Opera Max from Play Store. It's completely free and easy to use. No root required.

Answer 6

In light of some recent events, I'd like to improve this question by introducing Triangle by Google. Get it on APKMirror or APKPure and install it with ADB.

Here are some of the key features.

It's not a VPN, it blocks locally your apps' access to Internet. Think of it as a new permission just like using the camera or having access to your location.

Answer 7

Preamble

It may be late, but I wish to add my own take on your question, for completeness' sake. This answer is a surefire way to block internet access to an application. The downsides? It doesn't block Intents, it is convoluted and might make the target app crash, and it requires root privileges.

It has been tested and confirmed to work up to Android 7.1.2.

---

Rationale

As mentioned by the other answerers, any app which wishes to access the internet, must declare the android.permission.INTERNET undeniable permission within its AndroidManifest.xml. How does Android remember which permissions an app requested, though? By saving them inside packages.xml, a protected file located at /data/system.

It goes without saying that someone like us might be interested in editing said file, for the purpose of adding or removing a permission, provided they have root privileges. This is our way to negate internet access to an app without VPNs or firewall software.

---

The packages.xml file

The packages.xml file lists all of the installed apps, together with their paths and permissions. Each app is placed between the <package></package> tags; for the sake of my answer, I'll target Nova Launcher by TeslaCoil. The app's stanza in the file is as follows:

    <package name="com.teslacoilsw.launcher" codePath="/data/app/com.teslacoilsw.launcher-1" nativeLibraryPath="/data/app/com.teslacoilsw.launcher-1/lib" publicFlags="944258628" privateFlags="0" ft="16075caace8" it="16075cac965" ut="16075cac965" version="53000" userId="10083" installer="com.android.packageinstaller">
        <sigs count="1">
            <cert index="7" key="3082034d30820235a0030201020204638fbad3300d06092a864886f70d01010b05003057315530530603550403134c726f636b7a35353535204f553d44726f69642046726565646f6d20556e6974204f3d44726f69642046726565646f6d20496e63204c3d556e6b6e6f776e20533d556e6b6e6f776e20433d4c4b301e170d3134313230353030343535375a170d3434313132373030343535375a3057315530530603550403134c726f636b7a35353535204f553d44726f69642046726565646f6d20556e6974204f3d44726f69642046726565646f6d20496e63204c3d556e6b6e6f776e20533d556e6b6e6f776e20433d4c4b30820122300d06092a864886f70d01010105000382010f003082010a0282010100818b312365be3e55f48989d43468880067464eca65aa3ba73305178311fc2a053c143182f6d2ea635b57dc327adf8a5a9b763c03f0a48c38530114e6979358d6bfca37d161ca6fe8bb0d80f061d7b67bc1456cdfc38e0cda2ebd05c48113f701140950f0fe4315de6b95c7504129abb2c1a61f1e4f1229fb83f474dbcd7dc957b84a1b8a2aa0157b223609d77980a3f579c93fbb24a6f9fbb5a8e207cccdf1add616c95c732d5c114c0168fdbd9c00ddf211c2b8886b9498a34f389025802e334f404b7e4eb75f6308f086e5bdac64db10053c7ff8d21a350b941d5394ffbe2bd037139134eb065c2317625e65d3f628aecf7965a0d70b02e68aa8371efd1fe50203010001a321301f301d0603551d0e04160414a4e66b693ecdf3241883e3eed668354e1531ba11300d06092a864886f70d01010b050003820101003992f3f461a290db767911a4a519f035fe0c34e597e2fba2e31371e260bd2fc8f9a93c35e6f06553d02588d2f8453ee784d2ba09a696e66304e3e01f7c6bdf5b2747fc73f79d00379cc94eefa542c8eb308318364df2fa1a9c6a7ef0669d08f7b1f8635d0d4331e2817d5aeb0854760116c29801cf915ef67d5c0e04861cad4fa7b96fe8f9a0baf0cda649cd35a7122142ba38b2d16d9d319a8604a41fe0025d89be87f84ce8fc080ab54c76a96f3d9b70b1a5f5e18e48768e3684bca8a950665e16a6d50cf0045949baebca876d55eeba52ea421f33009872d9d654f8f8caa1bb465d754694d4bf6cb92f3299fbec3781849b37e6ba23ffe3d6c20ecb9bc65d" />
        </sigs>
        <perms>
            <item name="com.android.launcher3.permission.READ_SETTINGS" granted="true" flags="0" />
            <item name="com.google.android.c2dm.permission.RECEIVE" granted="true" flags="0" />
            <item name="com.teslacoilsw.launcher.permission.C2D_MESSAGE" granted="true" flags="0" />
            <item name="android.permission.EXPAND_STATUS_BAR" granted="true" flags="0" />
            <item name="android.permission.WRITE_MEDIA_STORAGE" granted="true" flags="0" />
            <item name="android.permission.INTERNET" granted="true" flags="0" />
            <item name="android.permission.ACCESS_NETWORK_STATE" granted="true" flags="0" />
            <item name="android.permission.SET_WALLPAPER" granted="true" flags="0" />
            <item name="android.permission.SET_WALLPAPER_HINTS" granted="true" flags="0" />
            <item name="android.permission.VIBRATE" granted="true" flags="0" />
            <item name="android.permission.ACCESS_WIFI_STATE" granted="true" flags="0" />
            <item name="android.permission.WAKE_LOCK" granted="true" flags="0" />
        </perms>
        <proper-signing-keyset identifier="10" />
    </package>

The indentation is reported verbatim from the file.

---

Procedure

Armed with the above knowledge, we can now proceed to examine Nova Launcher's permissions, wrapped between <perms></perms>. Soon enough, we will find the only one we need to edit:

            <item name="android.permission.INTERNET" granted="true" flags="0" />

To effectively deny internet access to the app, we merely need to delete the whole line and reboot our device. Commenting it out for future use is useless: Android examines this file at every boot, and will purge your comments.

---

Drawbacks

Following this procedure will net you an app which cannot communicate with the internet in any way. However, poorly coded apps and software intended for Marshmallow and above might crash upon trying to connect to the internet, as Nova does.

Moreover, as pointed out by Firelord, updating an app causes the changes to revert, effectively voiding our efforts and requiring the permission to be deleted anew.

---

Amending this procedure

To reverse what we did above, all that's needed is to add the permission we deleted back among the other ones and to reboot the device.

---

Disclaimer

I'm in no way affiliated to Nova Launcher or its developers.