I'd like to run KWin under Wayland without giving the user the ability to run X clients. Is there a way to disable Xwayland support such that a non-root user cannot re-enable it? I know about having the ExecStart line in ~/.config/systemd/user/plasma-kwin_wayland.service to not have --xwayland, but the user can modify that. I am looking for something that the user cannot override.

Alternatively, is there a way to make it impossible for a non-root user to enable XwaylandEavesdrops in their ~/.config/kwinrc file?

Otherwise, it seems like a malicious user-owned app can alter these files and run a keylogger.

I'm using OpenSUSE Tumbleweed with KDE Plasma 5.27.1