Default on Debian, and seems to be reasonable for us since we also don't allow access to the system journal by default.