//go:build unix

package credentiallease

import (
	"os"
	"syscall"
)

func privateKeyFileSecure(_ *os.File, info os.FileInfo) bool {
	if info.Mode().Perm()&0o077 != 0 {
		return false
	}
	st, ok := info.Sys().(*syscall.Stat_t)
	return ok && (st.Uid == uint32(os.Getuid()) || st.Uid == 0)
}
