Ensure systemd journal files and directories are not more permissive than 0640

# Fail if any journal dir/file carries permission bits beyond 0640
# (rw-r-----). The low three octal digits are tested; the setgid/sticky
# bit is ignored for the permissiveness comparison.
bad=$(find /run/log/journal /var/log/journal \( -type d -o -type f \) 2>/dev/null | while IFS= read -r p; do
  m=$(stat -c '%a' "$p" 2>/dev/null)
  perm=$(printf '%s' "$m" | tail -c 3)
  if [ $(( 0$perm & ~0640 & 0777 )) -ne 0 ]; then printf '%s %s\n' "$p" "$m"; fi
done)
[ -z "$bad" ] || { echo "FAIL: journal paths more permissive than 0640:"; printf '%s\n' "$bad"; exit 1; }
echo "OK: journal files/dirs are 0640 or less permissive"; exit 0

expected_exit:

0

note:

Tighten permissions to 0640 via a /etc/tmpfiles.d drop-in for /run/log/journal and /var/log/journal (and their contents), then run systemd-tmpfiles --create.