driver-manager/post-fs-data.sh

#!/system/bin/sh
# Driver Manager - post-fs-data
# EARLY BOOT — runs before verification checks
#
# IMPORTANT: Keep this CLEAN. Only set props that already exist
# on stock or that won't trigger root/mod detection.
# All custom/non-stock props are deferred to service.sh (after PI).

MODDIR=${0%/*}
CONFDIR="$MODDIR/config"

# GPU — these are stock props, safe to set early
resetprop ro.hardware.egl powervr
resetprop ro.hardware.vulkan powervr

# Boot state — ensure these look locked/verified from the start
# These are checked by early-running verification services
BOOT_TIMING=$(cat "$CONFDIR/boot_timing" 2>/dev/null || echo "0")
if [ "$BOOT_TIMING" = "1" ]; then
    resetprop ro.boot.verifiedbootstate green
    resetprop ro.boot.flash.locked 1
    resetprop ro.boot.vbmeta.device_state locked
    resetprop ro.boot.veritymode enforcing
    resetprop ro.build.selinux 1

    # Hide KernelSU props if they exist
    resetprop --delete ro.kernelsu.version 2>/dev/null
    resetprop --delete ro.kernelsu.versionCode 2>/dev/null
fi

# DO NOT set these during early boot — they're non-stock:
#   vendor.powervr.opencl.allowfp16
#   vendor.powervr.opencl.profiling
#   persist.sys.usb.otg
#   input.gamepad.enabled
#   bluetooth.le.no_location_permission_scan
# These are applied later by service.sh or boot_timing.sh