How would iOS or Android app "firewall" for extended permissions (location, etc) work?

Question

I'm interested in blocking or reporting any application's usage of extended permissions, regardless if they are granted those rights, such as:

• GPS / Location / Wifi
• Radio signal data
• Telemetry

My rational is related to a person's privacy. For example Facebook Messenger has an application-level icon to disable location reporting. How can I theoretically force the app to no longer use that feature at an OS level? (yes, Settings will do it, but where in the OS stack does it operate?)

The answer I'm interested in will refer to iOS and Android Operating System details, and not a simple security on/off switch available in Settings.

Example answer

Taking the Windows OS as an example, most of this would be handled in the Kernel, and within that, a protected subsystem that probably doesn't operate in privileged ring 0. Interesting API's would be located in XXX library (kernel.dll?)

• What layer in the Android and iOS operating system is most suited to blocking or controlling permission access at runtime?

Answer 1

I can only speak for Android, I have no idea of iOS.

Granting permissions is (mostly) handled in the framework, while the Linux kernel and appropriate Linux-Users and Linux-Groups for each app ensure that the framework is not circumvented. Interesting internal APIs are mostly located in /frameworks/base within a regular Android source tree

In Android, the framework will take care of filtering requests on runtime, based on the permission model. The process is roughly as follows:

If an app uses the API to perform some protected operation (such as reading your current GPS location) the handler (in this case, the LocationManagerService) will check if the required permission has been available to the calling context (roughly: the app's manifest, which has been confirmed by the user while installing). If so, it will perform the action requested; if not, a SecurityException is thrown. Regular Linux kernel mechanics prevent apps from accessing ressources without using the suitable API (excluding, of course, apps running as root on a rooted device).

---

You can find a general overview article on the Android security features at the official documentation homepage. It is, however, not tied to permissions.

Answer 2

I dodn't find a good way to filter permissions on my iPhone, but I can help you for the Android. I use two apps on my tablet. the first is DroidWall which I use to stop Internet connection for most of the apps,

To restrict permissions of the apps, the best app for me is XPrivacy . When you download app it just shows 1-3-10 permissions to give access, but the real thing is that these apps take access to hundred permissions.

Some apps doesn;t work if you block some of the permission (like location), but XPrivacy has a feature "to lie" about your location. So the app will work but will think that you are somewhere else.