Below are what I believe are the minimal steps to achieve what I wanted. For now, the steps only work for an additional Wifi USB stick, not the built-in Wifi hardware. I will edit this as I learn more ...

Install and set up hostapd

In order to make the Wifi hardware (the one built into the laptop or some additional Wifi USB stick) work in non ad-hoc mode, the hostapd software is necessary. Note that for this to work at all, the Wifi hardware needs to be supported by the hostapd software and the hardware needs to be able to support non ad-hoc mode.

1. Install software with sudo apt-get install hostapd
2. Find the name of the network interface that corresponds to the Wifi hardware. For an additional Wifi USB stick this may be wlan1 or similar. The command ifconfig will show all availble network interfaces.

3. Create the config file /etc/hostapd/hostapd.conf (e.g. with the command gedit /etc/hostapd/hostapd.conf) with the following content where you replace <INTERFACENAME> with the name found in step 2, <MYSSID> with the name you chose for your network, <CODE> with the two-letter code of your country (e.g. US), <MODE> with the Wifi network mode (e.g. g) and channel with a valid channel number (e.g. 3). Alternately, the lines for hw_mode and channel can be left out entirely. Replace <MYPASSPHRASE> with a phassphrase you like (but avoid umlauts or accented characters).

   interface=<INTERFACENAME>
   driver=nl80211
   logger_stdout=-1
   logger_stdout_level=0
   ssid=<MYSSID>
   country_code=<CODE>
   hw_mode=<MODE>
   channel=<CHANNEL>
   macaddr_acl=0
   auth_algs=1
   ignore_broadcast_ssid=0
   wpa=2
   wpa_passphrase=<MYPASSPHRASE>
   wpa_key_mgmt=WPA-PSK
   wpa_pairwise=TKIP
   rsn_pairwise=CCMP
   

   See http://linuxwireless.org/en/users/Documentation/hostapd for more information.

4. Run the command sudo hostapd -d /etc/hostapd/hostapd.conf. This should start the Wifi network and it should be possible already to connect to this network from the mobile device: the network with the SSID you assigned should show up in the list and after entering the password, the device should connect to the network. However, the device will not get an IP address and so no real data transfer is possible yet. Terminate the command by pressing Ctl-C

Install DHCP and set up the network

In order to actually transfer data between the mobile device and the laptop, the network must know which range of IP addresses it should use and a program is needed to assign IP addresses to any device that wants to connect.

1. Use command sudo apt-get install isc-dhcp-server to install the DHCP server.

2. Edit the interface configuration file /etc/network/interfaces and add the following to the end:

   iface <INTERFACENAME> inet static
   address 192.168.2.1
   netmask 255.255.255.0
   

3. Edit the DHCP configuration file /etc/dhcp/dhcpd.conf and add the following to the end.

   subnet 192.168.2.0 netmask 255.255.255.0 {
     range 192.168.2.3 192.168.2.10;
     option broadcast-address 192.168.2.255;
     option routers 192.168.2.1;
   }
   

   If you know the MAC address of the mobile device and want assign a fixed IP address to it, you can add the following lines before the closing brace, replacing XX:XX:XX:XX:XX:XX by the MAC address. This will assign the fixed IP address 192.168.2.2:

     host device1 {
       hardware ethernet XX:XX:XX:XX:XX:XX;
       fixed-address 192.168.2.2;
     }
   

4. Bring up the the interface with the command sudo ifup <INTERFACENAME>
5. Start the DHCP server with the command sudo dhcpd -f -d <INTERFACENAME> (this will keep running until you terminate with Ctrl-C and show log messages to the terminal)
6. Start the managed network with the command sudo hostapd -d /etc/hostapd/hostapd.conf

If all goes well you should now be able to connect from a mobile device to that Wifi network and the device should be assigned an IP address in the 192.168.2.X range.

Accessing Files and Services on the Laptop

Once the network is started, the mobile device should be able to access services running on the laptop (but not the internet). The easiest way to share files from the laptop is to create a Samba share for a directory on the network. This can be done by right-clicking on the directory icon and choosing "Sharing options", then check "Share this folder" and optionally assign some share name, the click "create share".

For android devices, there are several apps that can be used to access Samba shares, I use "ES File Explorer". In the ES File Explorer app, change to the "LAN Shares" tab and add a new server. In the "server" field, enter the IP address of the server, e.g. 192.168.2.1, then enter the Ubuntu userid and password and touch "OK". When you touch the server IP address, all the shares you created should be listed and from there you can copy files or whole directories to the Android device.

Another way to access files on the laptop which is also supported by the "ES File Explorer" app is sftp.

This is being worked on as part of the Ubuntu App Developer Upload spec, in particular, the section on security.

This is still in early stages, but as an extract to the spec, and to provide some context:

Once an application is installed, AppArmor will provide a security sandbox to protect the user from malicious or simply broken code. To accomplish this, each application will need a properly constructed, and minimally permissive profile to restrict what their application can access on the local system.

Applications will be sandboxed via AppArmor, and permissions will be granted according to the app's AppArmor security profile.