code: func (w *patternWhitelist) validateSysctl(sysctl string, hostNet, hostIPC bool) error {
  	nsErrorFmt := "%q not allowed with host %s enabled"
  	if ns, found := w.sysctls[sysctl]; found {
  		if ns == IpcNamespace && hostIPC {
  			return fmt.Errorf(nsErrorFmt, sysctl, ns)
  		}
  		if ns == NetNamespace && hostNet {
  			return fmt.Errorf(nsErrorFmt, sysctl, ns)
  		}
  		return nil
  	}
  	for p, ns := range w.prefixes {
  		if strings.HasPrefix(sysctl, p) {
  			if ns == IpcNamespace && hostIPC {
  				return fmt.Errorf(nsErrorFmt, sysctl, ns)
  			}
  			if ns == NetNamespace && hostNet {
  				return fmt.Errorf(nsErrorFmt, sysctl, ns)
  			}
  			return nil
  		}
  	}
  	return fmt.Errorf("%q not whitelisted", sysctl)
  }
docs: // validateSysctl checks that a sysctl is whitelisted because it is known
  // to be namespaced by the Linux kernel. Note that being whitelisted is required, but not
  // sufficient: the container runtime might have a stricter check and refuse to launch a pod.
  //
  // The parameters hostNet and hostIPC are used to forbid sysctls for pod sharing the
  // respective namespaces with the host. This check is only possible for sysctls on
  // the static default whitelist, not those on the custom whitelist provided by the admin.