By default, the Fedora SELinux policy does not allow containers to access device nodes. This setting is independent of CGroup device rules.