code: func SetJournalPermissions(p *stage1commontypes.Pod) error {
  	s1 := common.Stage1ImagePath(p.Root)
  
  	rktgid, err := common.LookupGid(common.RktGroup)
  	if err != nil {
  		return fmt.Errorf("group %q not found", common.RktGroup)
  	}
  
  	journalPath := filepath.Join(s1, "rootfs", "var", "log", "journal")
  	if err := os.MkdirAll(journalPath, os.FileMode(0755)); err != nil {
  		return errwrap.Wrap(errors.New("error creating journal dir"), err)
  	}
  
  	a, err := acl.InitACL()
  	if err != nil {
  		return err
  	}
  	defer a.Free()
  
  	if err := a.ParseACL(fmt.Sprintf("g:%d:r-x,m:r-x", rktgid)); err != nil {
  		return errwrap.Wrap(errors.New("error parsing ACL string"), err)
  	}
  
  	if err := a.AddBaseEntries(journalPath); err != nil {
  		return errwrap.Wrap(errors.New("error adding base ACL entries"), err)
  	}
  
  	if err := a.Valid(); err != nil {
  		return err
  	}
  
  	if err := a.SetFileACLDefault(journalPath); err != nil {
  		return errwrap.Wrap(fmt.Errorf("error setting default ACLs on %q", journalPath), err)
  	}
  
  	return nil
  }
docs: // SetJournalPermissions sets ACLs and permissions so the rkt group can access
  // the pod's logs