I could do that, that is a good idea.  Though it couldn't be named "DeviceString" because there are multiple possible "DeviceString"s it would have to be "CgroupDeviceAllowString" or something.