It depends. In the 4.4 "KitKat" release, the list was
contained in init's property_service.c (look around line 65). You can
see, for example, that properties named debug.* can be updated by the
"system" or "shell" user. (The mapping of system-recognized user IDs
to numeric values can be found in android_filesystem_config.h.)
Some properties, such as ro., persist., and ctl.*, have additional
restrictions or special behaviors.
In Android 5.0 "Lollipop", the list moved, but the behavior is the
same.
Use adb shell ps to see what user ID your app is running under. If
it's not system or shell, it won't be able to set system properties.