I'm curious what you'd consider a GSM or SIM firewall to look like. Typically from the perspective of Linux, a "old and busted" telephony devices will appear as

I'm curious what you'd consider a GSM or SIM firewall to look like. Typically from the perspective of Linux, a "old and busted" telephony devices will appear as a TTY which a (relatively) privileged process can use as a control channel and/or to set up a PPP interface. On devices supporting "the new hotness", you get a special character device that speaks the MBIM or QMI protocols for a control channel, and an "ethernet" interface for IP traffic. In both cases, access to the SIM is limited to processes that can speak to the telephony device's control channel, and the data side is firewalled with iptables like any other network interface. To further restrict access to telephony device capabilities you can break out ModemManager or oFono along with Polkit. Things get a little wonky when you start to talk about voice calls, as there isn't a lot of standardization in how to get the audio channel in/out of linux on telephony devices yet, but ofono and telepathy seem to have made strides in that direction.