Don't do auto-enrollment if the write protect switch is off.

chrome/browser/chromeos/login/enrollment/auto_enrollment_controller.cc

Index: chrome/browser/chromeos/login/enrollment/auto_enrollment_controller.cc
diff --git a/chrome/browser/chromeos/login/enrollment/auto_enrollment_controller.cc b/chrome/browser/chromeos/login/enrollment/auto_enrollment_controller.cc
index ad3dc0c4a561ad54e8a32786ef62f09804922778..f028b46d55f910bcda7f123b54c3f979c01f2270 100644
--- a/chrome/browser/chromeos/login/enrollment/auto_enrollment_controller.cc
+++ b/chrome/browser/chromeos/login/enrollment/auto_enrollment_controller.cc
@@ -86,7 +86,16 @@ AutoEnrollmentController::Mode AutoEnrollmentController::GetMode() {
         system::StatisticsProvider::GetInstance()->GetMachineStatistic(
             system::kFirmwareTypeKey, &firmware_type) &&
         firmware_type == system::kFirmwareTypeValueNonchrome;
-    return non_chrome_firmware ? MODE_NONE : MODE_FORCED_RE_ENROLLMENT;
+
+    std::string write_protect_switch_boot;

[bartfab (slow), 2015/01/26 15:48:55]

Nit: Maybe s/boot/on_boot/? The name does not make much sense otherwise.

[Mattias Nissler (ping if slow), 2015/01/26 20:08:50]

This name is consistent with system::kWriteProtectSwitchBootKey, which is
consistent with the underlying crossystem value named wpsw_boot. So I'd rather
keep the name.

+    const bool write_protect_switch_off =
+        system::StatisticsProvider::GetInstance()->GetMachineStatistic(
+            system::kWriteProtectSwitchBootKey, &write_protect_switch_boot) &&
+        write_protect_switch_boot == system::kWriteProtectSwitchBootValueOff;
+
+    return (non_chrome_firmware || write_protect_switch_off)
+               ? MODE_NONE
+               : MODE_FORCED_RE_ENROLLMENT;
 #else
     return MODE_NONE;
 #endif