code: func validateSysctl(sysctl string, hostNet, hostIPC bool) error {
  	nsErrorFmt := "%q not allowed with host %s enabled"
  	if ns, found := namespaces[sysctl]; found {
  		if ns == IpcNamespace && hostIPC {
  			return errors.Errorf(nsErrorFmt, sysctl, ns)
  		}
  		if ns == NetNamespace && hostNet {
  			return errors.Errorf(nsErrorFmt, sysctl, ns)
  		}
  		return nil
  	}
  	for p, ns := range prefixNamespaces {
  		if strings.HasPrefix(sysctl, p) {
  			if ns == IpcNamespace && hostIPC {
  				return errors.Errorf(nsErrorFmt, sysctl, ns)
  			}
  			if ns == NetNamespace && hostNet {
  				return errors.Errorf(nsErrorFmt, sysctl, ns)
  			}
  			return nil
  		}
  	}
  	return errors.Errorf("%q not whitelisted", sysctl)
  }
docs: // validateSysctl checks that a sysctl is whitelisted because it is known
  // to be namespaced by the Linux kernel.
  // The parameters hostNet and hostIPC are used to forbid sysctls for pod sharing the
  // respective namespaces with the host. This check is only used on sysctls defined by
  // the user in the crio.conf file.