cgroups: implement device whitelist