In this lesson, you will learn how to enforce granular security policies for hardware access by leveraging Device Cgroups to restrict which device nodes a containerized process can interact with.
The Principle of Hardware Isolation
While namespaces provide a view of the system, they do not inherently block access to raw hardware. A process might be isolated in a PID or Mount namespace, but if it gains access to a sensitive device node—such as /dev/sda or a GPU interface—it can bypass container boundaries and impact the host kernel or hardware integrity. The Device Cgroup controller acts as a whitelist-based firewall, mediating all mknod, open, and read/write requests to character and block devices.
Implementing Granular Access Policies
The Device Cgroup operates by evaluating a list of access rules. Each rule consists of a type (character c or block b), a major/minor device number, and an access mask (read r, write w, or create m).
By default, in a locked-down container, we typically deny all access and selectively permit only the bare essentials. You manage these via the devices.allow and devices.deny files within the cgroup filesystem.
For example, to permit a container access to a specific GPU (assuming it has major number 195 and minor number 0), you would write the following to the cgroup's devices.allow file:
# Allow read/write access to character device 195:0
echo "c 195:0 rw" > /sys/fs/cgroup/container_name/devices.allow
If you attempt to access /dev/null without explicit permission, the kernel will return an EPERM error immediately. This mechanism ensures that even if a process manages to find a device node path within its mount namespace, the kernel driver will refuse the operation unless the Cgroup policy explicitly grants the authorization. By enforcing this "deny-by-default" approach, you minimize the blast radius of a compromised container and ensure that hardware resources are partitioned securely.
Key Takeaway: Device Cgroups provide a mandatory access control layer that prevents processes from interacting with hardware nodes, even when other namespace boundaries are established, by enforcing a strict whitelist of permitted device operations.