Second this. Privacy Guard in CM11 solves this and is quite simple to configure. Add to this Droidwall and whitelist only the apps you need and you have a fairly god setup.