If anyone's interested, on CyanogenMod 7.2 the relevant setting's in Settings -> CyanogenMod settings -> Application -> Permission management. After that, you can turn permissions on and off from the app manager. (As far as I can tell, this hasn't been implemented in any of the CM9 nightlies.)
The problem with this approach is that the app expects the permission and will most likely crash if rejected. One alternative which works better is the LBE Privacy Guard app, what it does is, instead of denying the app to read the contacts list for example, it simply gives it an empty one.
