lock sysctl cookbook