Restrict permissions on the journalctl command

Description

The /usr/bin/journalctl command must have a mode of 0740 so that only root can execute it and read the systemd journal, which may contain sensitive operational information.

Rationale

The systemd journal can expose sensitive system and security detail. Restricting the journalctl binary to root-only execution prevents unprivileged users from reading it.

Framework references

Live verification