@xiyuan, could you provide pointer on how to solve this?
Is it just as simple as adding Command line flag check in IsUpdateOverCellularAllowed

i.e.:

https://codereview.chromium.org/2413113003/diff/1/chrome/browser/ui/webui/help/help_utils_chromeos.cc

?

Re #2: The switch is only visible to chrome and IsUpdateOverCellularAllowed controls whether chrome can call update engine to trigger an update. It has no impact on update_engine. So effectively no use since update_engine by default would not update over cellular.

However, since we are going to ZTE w/ hands-off mode, if we can put correct values for allowed_connection_types AU policy. It should just work. There is no need to change code with ZTE.

@xiyuan - setting allowed_connection_types in the cloud-provisioned policy is not guaranteed to be sufficient: if there's a bug in a pushed build that stops the auto-enroll completing or the policy retrieval working, we still need to be sure we can push an update to those devices. This requires the image to provide a  baked in setting to allow update over cellular.
See  abodenha@ comment in https://bugs.chromium.org/p/chromium/issues/detail?id=574932#c1 and section 1.4 in go/rialto-kiosk-migration  for more details.

In this case, we need the flag to let chrome know it should trigger update on cellular. Additionally, chrome needs to let update_engine know that cellular update is allowed too. Update_engine has a DBUS interface SetUpdateOverCellularPermission [1] for that. Chrome should call this before triggering the update. Note that the DBUS call only works when there is no allowed_connection_types policy. 

[1]: https://cs.corp.google.com/android/system/update_engine/dbus_bindings/org.chromium.UpdateEngineInterface.dbus-xml?rcl=0eff452a9177c890734c5d34a5ca49f9a8284ae1&l=67

Thanks xiyuan. So steps are something like:
1/ expose SetUpdateOverCellularPermission on UpdateEngineClient, and plumb it up so login/wizard_controller can see it
2/ At an appropriate point (when/where?) check if that allow-data-roaming-by-default is set and is so call SetUpdateOverCellularPermission(true)
3/ update help_utils_chromeos::IsUpdateOverCellularAllowed to also observe this flag (I think) but only in the case of no policy (CrosSetting) being set for it (i.e. it overrides the first two uses of kDefaultUpdateOverCellularAllowed but not the final one)

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/platform/system_api/+/c08ae470458b06cf23c1907817490d2fc917ac29

commit c08ae470458b06cf23c1907817490d2fc917ac29
Author: Niranjan Kumar <kumarniranjan@chromium.org>
Date: Tue Feb 21 22:07:44 2017

Expose DBus API to enable cellular updates.

Can set UpdateEngine to either allow or prohibit updates over
cellular data network connections.

BUG= 640721 
TEST=none

Change-Id: I3322da7270243e0c070668c49175f34bf20eceb1
Reviewed-on: https://chromium-review.googlesource.com/441994
Commit-Ready: Niranjan Kumar <kumarniranjan@chromium.org>
Tested-by: Niranjan Kumar <kumarniranjan@chromium.org>
Reviewed-by: Xiyuan Xia <xiyuan@chromium.org>

[modify] https://crrev.com/c08ae470458b06cf23c1907817490d2fc917ac29/dbus/update_engine/dbus-constants.h

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/platform2/+/e03e8b641ec39840a24705ba29fad3829b9f43de

commit e03e8b641ec39840a24705ba29fad3829b9f43de
Author: Niranjan Kumar <kumarniranjan@chromium.org>
Date: Wed Mar 01 21:19:49 2017

login: Make Rialto a Cellular First device

Replaced --enable-data-roaming-by-default with the more inclusive flag
--cellular-first which indicates not only that cellular data roaming
is allowed by default, but also that updates will be allowed
over cellular connections.

BUG= chromium:640721 
TEST=Deployed on device and verified that feature is working.

Change-Id: I030b32fd4adb9f8b0e801301c4e3f9a5808a9c49
Reviewed-on: https://chromium-review.googlesource.com/448236
Commit-Ready: Niranjan Kumar <kumarniranjan@chromium.org>
Tested-by: Niranjan Kumar <kumarniranjan@chromium.org>
Reviewed-by: Dan Erat <derat@chromium.org>

[modify] https://crrev.com/e03e8b641ec39840a24705ba29fad3829b9f43de/login_manager/chrome_setup.cc

+tbuckley@ - We will want to take this into consideration when we revamp the cellular update UI.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/24eccbeb16b71a0a1eaae619f2d2d336b2ec9b90

commit 24eccbeb16b71a0a1eaae619f2d2d336b2ec9b90
Author: kumarniranjan <kumarniranjan@google.com>
Date: Thu Mar 02 19:21:37 2017

Roll DEPS for cros_system_api changes to UpdateEngine DBus API.

BUG= 640721 
TEST=none

Review-Url: https://codereview.chromium.org/2729433004
Cr-Commit-Position: refs/heads/master@{#454332}

[modify] https://crrev.com/24eccbeb16b71a0a1eaae619f2d2d336b2ec9b90/DEPS

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b9afef64d11bfc58e7611620c528b2cb5f766748

commit b9afef64d11bfc58e7611620c528b2cb5f766748
Author: kumarniranjan <kumarniranjan@google.com>
Date: Thu Mar 02 21:42:22 2017

Appropriate handling for Cellular First devices.

"Cellular First" devices rely on cellular telphone data networks as their
primary means of connecting to the internet.
Supplying the --cellular-first command line flag has two consequences:
1. Cellular data roaming will be enabled by default.
2. UpdateEngine will be instructed to allow updates over cellular connections.

BUG= 640721 
TEST=browser test
CQ-DEPEND=2729433004

Review-Url: https://codereview.chromium.org/2694923005
Cr-Commit-Position: refs/heads/master@{#454386}

[modify] https://crrev.com/b9afef64d11bfc58e7611620c528b2cb5f766748/chrome/browser/chromeos/login/wizard_controller.cc
[modify] https://crrev.com/b9afef64d11bfc58e7611620c528b2cb5f766748/chrome/browser/chromeos/login/wizard_controller.h
[modify] https://crrev.com/b9afef64d11bfc58e7611620c528b2cb5f766748/chrome/browser/chromeos/login/wizard_controller_browsertest.cc
[modify] https://crrev.com/b9afef64d11bfc58e7611620c528b2cb5f766748/chrome/browser/chromeos/policy/device_network_configuration_updater.cc
[modify] https://crrev.com/b9afef64d11bfc58e7611620c528b2cb5f766748/chrome/browser/ui/webui/help/help_utils_chromeos.cc
[modify] https://crrev.com/b9afef64d11bfc58e7611620c528b2cb5f766748/chromeos/chromeos_switches.cc
[modify] https://crrev.com/b9afef64d11bfc58e7611620c528b2cb5f766748/chromeos/chromeos_switches.h
[modify] https://crrev.com/b9afef64d11bfc58e7611620c528b2cb5f766748/chromeos/dbus/fake_update_engine_client.cc
[modify] https://crrev.com/b9afef64d11bfc58e7611620c528b2cb5f766748/chromeos/dbus/fake_update_engine_client.h
[modify] https://crrev.com/b9afef64d11bfc58e7611620c528b2cb5f766748/chromeos/dbus/update_engine_client.cc
[modify] https://crrev.com/b9afef64d11bfc58e7611620c528b2cb5f766748/chromeos/dbus/update_engine_client.h