Bug reports are often the best way to learn about Moodle. MDL-14174
resolved: not a bug. Reason: "User context is used for something that you can do to other users, not yourself." (Skodak) Things that you can do to yourself are always tested in the System context.
- if you want to update your own profile, you need moodle/user:editownprofile in the System context. Normally everyone can update their own profile because it is allowed in Authenticated user
- if you want to update another user's profile, you need moodle/user:editprofile in the other user's personal User context.
To remove all Students' ability to update their own profiles, you could edit the Student role, setting editownprofile = Prevent. Since Student is (usually) assigned in a course context, it will take priority over the permission
in Auth user. To remove the ability from Students in a particular course, you could override Student in the course context. To remove the ability from specific students, I would create a new role "CannotEditOwnProfile" with just the one capability set to prevent, and assign it selectively to those students.