That hostname
file is owned by group ID 1002, and there is no entry in /etc/group
mapping any group name to GID 1002, so ls -l
simply shows the group number instead of a name. And when a bare GID is displayed, unlike a named group, it is right-justified, making it look like it has leading spaces compared to any longer group names. Here you can see with three files that I created and gave user/group ownerships that would demonstrate this:
$ ls -l foo*
-rw-r--r-- 1 gowenfawr 1002 0 Aug 23 01:29 foo
-rw-r--r-- 1 systemd-resolve nogroup 0 Aug 23 01:30 foo2
-rw-r--r-- 1 gowenfawr cdrom 0 Aug 23 01:33 foo3
$
There's no particular security concern here, except perhaps that somehow your /etc/hostname
file got it's group ownership changed. You might want to search for any users which belong to that group:
$ awk -F: '$4 == 1002 {print $0}' /etc/passwd
and you might want to search for other files with that group ownership:
$ find /etc -gid 1002 -ls
136023 4 -rw-r--r-- 1 root 1002 25 Aug 13 05:26 /etc/hostname
If you were to find that, say, /etc/passwd
and /etc/shadow
were owned by 1002, that would like indicate a serious security concern.
If, as you comment, /etc/resolv.conf
and /etc/network/interfaces
are also owned by that file, then you almost certainly have a DHCP client or other network manager that is managing those files and setting the group ownership to 1002 when it updates them, likely in response to a configuration file that says to use GID 1002. A blunt way to check for this would be
$ grep -r 1002 /etc/*
but that may have a false positive or two. If you find a networky named config file with an entry like "group = 1002" then that's your culprit :)