Ensure the journalctl command is owned by root

Description

The /usr/bin/journalctl command must be owned by root so that only the root account can replace or tamper with the binary used to read the systemd journal.

Rationale

A journalctl binary owned by a non-root account could be modified by that account to hide or alter journal output, undermining the integrity of the audit and operational record.

Framework references

Live verification