Ensure the journalctl command is group-owned by root

Description

The /usr/bin/journalctl command must be group-owned by root so that no non-root group can replace or tamper with the binary used to read the systemd journal.

Rationale

A journalctl binary group-owned by a non-root group could be modified by members of that group to hide or alter journal output, undermining the integrity of the audit and operational record.

Framework references

Live verification