@chrishamm That solution wont work completely, I tested it. By putting the files on read only mode, they are not protected from the user dwc. DWC (I might be wrong about whi is doing this ) open the files, reads them, and I have seen they are modified on their atributes.
What I did and worked @trulm (my situation is the same as you) is changing the sticky bits on the files;
sudo chattr +i /opt/dsf/sd/sys/*.g
sudo chattr -i /opt/dsf/sd/sys/config-override.g
This bit makes the files imposible to be modified. Do the same with the macros and the filaments directories.
Also, I have modified the html files on DWC deleting the links to the areas I didnt want my student even look, like for example I deleted the posibility to manually introduce a temperature for the hotend and I also deleted the fill area in the console . In that way students can modified temperature, can not enter gcode comands either ,)