The security model for Android is that all of the protected resources (Identity, Contacts, Camera, GPS, etc, [Full list of permissions you can request here]) are protected inside the operating system API. That means that an app does not have direct access to the hardware, instead it has to ask the operating system to talk to the hardware for it. That way, the operating system has a chance to check the app's permissions and refuse to give the data.
Let's say I write an app that wants access to the GPS location, I have to do two things:
At install time, request the appropriate permissions in the manifest file
<manifest ... >
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
At runtime, ask the operating system to give me the GPS location:
String locationProvider = LocationManager.GPS_PROVIDER;
Location lastKnownLocation = locationManager.getLastKnownLocation(locationProvider);
During that call to
.getLastKnownLocation(...) the operating system will check that my app has the
ACCESS_FINE_LOCATION permission. If it does, then it'll hand me back the location data, if not then it'll throw a
java.lang.SecurityException and refuse to give me any data.