1. 找到system/core/init/stable_properties.h文件,添加only_for_test属性

	static const std::set<std::string> kExportedActionableProperties = {
	    "dev.bootcomplete",
	    "init.svc.console",
	    "init.svc.mediadrm",
	    "init.svc.surfaceflinger",
	    "init.svc.zygote",
	    "persist.bluetooth.btsnoopenable",
	    "persist.sys.crash_rcu",
	    "persist.sys.usb.usbradio.config",
	    "persist.sys.zram_enabled",
	    "ro.board.platform",
	    "ro.bootmode",
	    "ro.build.type",
	    "ro.crypto.state",
	    "ro.crypto.type",
	    "ro.debuggable",
	    "sys.boot_completed",
	    "sys.boot_from_charger_mode",
	    "sys.retaildemo.enabled",
	    "sys.shutdown.requested",
	    "sys.usb.config",
	    "sys.usb.configfs",
	    "sys.usb.ffs.mtp.ready",
	    "sys.usb.ffs.ready",
	    "sys.user.0.ce_available",
	    "sys.vdso",
	    "vold.decrypt",
	    "vold.post_fs_data_done",
	    "vts.native_server.on",
	    "wlan.driver.status",
		"only_for_test",
	};

2. 找到system/core/rootdir/init.rc后增加触发行为

on property:ro.debuggable=1
    # Give writes to anyone for the trace folder on debug builds.
    # The folder is used to store method traces.
    chmod 0773 /data/misc/trace
    # Give reads to anyone for the window trace folder on debug builds.
    chmod 0775 /data/misc/wmtrace
    start console

# only_for_test start
on property:only_for_test=1
    chmod 0777 /data/test

on property:only_for_test=0
    chmod 0333 /data/test
# only_for_test end

3. 编译system image后烧录重启设备
4. 获取属性值getprop,这个时候有看到only_for_test为空[]

[sys.sysctl.extra_free_kbytes]: [28125]
[sys.usb.config]: [diag,adb]
[only_for_test]: []
[sys.usb.configfs]: [1]
[sys.usb.controller]: [a600000.dwc3]

5. 手动修改属性值,setprop only_for_test 1后,查看/data/test文件权限变为0777

同时getprop only_for_test值变为1
[sys.sysctl.extra_free_kbytes]: [28125]
[sys.usb.config]: [diag,adb]
[only_for_test]: [1]
[sys.usb.configfs]: [1]
[sys.usb.controller]: [a600000.dwc3]

6. 手动修改属性值,setprop only_for_test 0后,查看/data/test文件权限变为0333

同时getprop only_for_test值变为0
[sys.sysctl.extra_free_kbytes]: [28125]
[sys.usb.config]: [diag,adb]
[only_for_test]: [0]
[sys.usb.configfs]: [1]
[sys.usb.controller]: [a600000.dwc3]

总结
也就是说改变only_for_test后有触发chmod命令,当然可以做想做的其他行为,读写文件都是可以的,当然也可以利用此方式来和内核做交互