diff --git a/libcontainer/cgroups/devices/devices_emulator.go b/libcontainer/cgroups/devices/devices_emulator.go
index 670c14736..3572a5eae 100644
--- a/libcontainer/cgroups/devices/devices_emulator.go
+++ b/libcontainer/cgroups/devices/devices_emulator.go
@@ -32,24 +32,24 @@ import (
 	"github.com/pkg/errors"
 )
 
-// deviceMeta is a DeviceRule without the Allow or Permissions fields, and no
+// deviceMeta is a Rule without the Allow or Permissions fields, and no
 // wildcard-type support. It's effectively the "match" portion of a metadata
 // rule, for the purposes of our emulation.
 type deviceMeta struct {
-	node  devices.DeviceType
+	node  devices.Type
 	major int64
 	minor int64
 }
 
-// deviceRule is effectively the tuple (deviceMeta, DevicePermissions).
+// deviceRule is effectively the tuple (deviceMeta, Permissions).
 type deviceRule struct {
 	meta  deviceMeta
-	perms devices.DevicePermissions
+	perms devices.Permissions
 }
 
 // deviceRules is a mapping of device metadata rules to the associated
 // permissions in the ruleset.
-type deviceRules map[deviceMeta]devices.DevicePermissions
+type deviceRules map[deviceMeta]devices.Permissions
 
 func (r deviceRules) orderedEntries() []deviceRule {
 	var rules []deviceRule
@@ -134,7 +134,7 @@ func parseLine(line string) (*deviceRule, error) {
 	}
 
 	// Parse the access permissions.
-	rule.perms = devices.DevicePermissions(perms)
+	rule.perms = devices.Permissions(perms)
 	if !rule.perms.IsValid() || rule.perms.IsEmpty() {
 		// Should never happen!
 		return nil, errors.Errorf("parse access mode: contained unknown modes or is empty: %q", perms)
@@ -144,7 +144,7 @@ func parseLine(line string) (*deviceRule, error) {
 
 func (e *Emulator) addRule(rule deviceRule) error {
 	if e.rules == nil {
-		e.rules = make(map[deviceMeta]devices.DevicePermissions)
+		e.rules = make(map[deviceMeta]devices.Permissions)
 	}
 
 	// Merge with any pre-existing permissions.
@@ -239,7 +239,7 @@ func (e *Emulator) deny(rule *deviceRule) error {
 	return err
 }
 
-func (e *Emulator) Apply(rule devices.DeviceRule) error {
+func (e *Emulator) Apply(rule devices.Rule) error {
 	if !rule.Type.CanCgroup() {
 		return errors.Errorf("cannot add rule [%#v] with non-cgroup type %q", rule, rule.Type)
 	}
@@ -307,8 +307,8 @@ func EmulatorFromList(list io.Reader) (*Emulator, error) {
 // This function is the sole reason for all of Emulator -- to allow us
 // to figure out how to update a containers' cgroups without causing spurrious
 // device errors (if possible).
-func (source *Emulator) Transition(target *Emulator) ([]*devices.DeviceRule, error) {
-	var transitionRules []*devices.DeviceRule
+func (source *Emulator) Transition(target *Emulator) ([]*devices.Rule, error) {
+	var transitionRules []*devices.Rule
 	oldRules := source.rules
 
 	// If the default policy doesn't match, we need to include a "disruptive"
@@ -319,11 +319,11 @@ func (source *Emulator) Transition(target *Emulator) ([]*devices.DeviceRule, err
 	// deny rules are in place in a black-list cgroup. Thus if the source is a
 	// black-list we also have to include a disruptive rule.
 	if source.IsBlacklist() || source.defaultAllow != target.defaultAllow {
-		transitionRules = append(transitionRules, &devices.DeviceRule{
+		transitionRules = append(transitionRules, &devices.Rule{
 			Type:        'a',
 			Major:       -1,
 			Minor:       -1,
-			Permissions: devices.DevicePermissions("rwm"),
+			Permissions: devices.Permissions("rwm"),
 			Allow:       target.defaultAllow,
 		})
 		// The old rules are only relevant if we aren't starting out with a
@@ -342,7 +342,7 @@ func (source *Emulator) Transition(target *Emulator) ([]*devices.DeviceRule, err
 		newPerms := target.rules[meta]
 		droppedPerms := oldPerms.Difference(newPerms)
 		if !droppedPerms.IsEmpty() {
-			transitionRules = append(transitionRules, &devices.DeviceRule{
+			transitionRules = append(transitionRules, &devices.Rule{
 				Type:        meta.node,
 				Major:       meta.major,
 				Minor:       meta.minor,
@@ -360,7 +360,7 @@ func (source *Emulator) Transition(target *Emulator) ([]*devices.DeviceRule, err
 		oldPerms := oldRules[meta]
 		gainedPerms := newPerms.Difference(oldPerms)
 		if !gainedPerms.IsEmpty() {
-			transitionRules = append(transitionRules, &devices.DeviceRule{
+			transitionRules = append(transitionRules, &devices.Rule{
 				Type:        meta.node,
 				Major:       meta.major,
 				Minor:       meta.minor,
diff --git a/libcontainer/cgroups/devices/devices_emulator_test.go b/libcontainer/cgroups/devices/devices_emulator_test.go
index 9ea02e7f6..5dbcbdee6 100644
--- a/libcontainer/cgroups/devices/devices_emulator_test.go
+++ b/libcontainer/cgroups/devices/devices_emulator_test.go
@@ -48,7 +48,7 @@ func TestDeviceEmulatorLoad(t *testing.T) {
 						node:  devices.CharDevice,
 						major: 4,
 						minor: 2,
-					}: devices.DevicePermissions("rw"),
+					}: devices.Permissions("rw"),
 				},
 			},
 		},
@@ -62,7 +62,7 @@ func TestDeviceEmulatorLoad(t *testing.T) {
 						node:  devices.BlockDevice,
 						major: 0,
 						minor: devices.Wildcard,
-					}: devices.DevicePermissions("m"),
+					}: devices.Permissions("m"),
 				},
 			},
 		},
@@ -77,13 +77,13 @@ c 1:1 r`,
 						node:  devices.CharDevice,
 						major: devices.Wildcard,
 						minor: devices.Wildcard,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 					// To match the kernel, we allow redundant rules.
 					{
 						node:  devices.CharDevice,
 						major: 1,
 						minor: 1,
-					}: devices.DevicePermissions("r"),
+					}: devices.Permissions("r"),
 				},
 			},
 		},
@@ -107,57 +107,57 @@ c 10:200 rwm`,
 						node:  devices.CharDevice,
 						major: devices.Wildcard,
 						minor: devices.Wildcard,
-					}: devices.DevicePermissions("m"),
+					}: devices.Permissions("m"),
 					{
 						node:  devices.BlockDevice,
 						major: devices.Wildcard,
 						minor: devices.Wildcard,
-					}: devices.DevicePermissions("m"),
+					}: devices.Permissions("m"),
 					{
 						node:  devices.CharDevice,
 						major: 1,
 						minor: 3,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 					{
 						node:  devices.CharDevice,
 						major: 1,
 						minor: 5,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 					{
 						node:  devices.CharDevice,
 						major: 1,
 						minor: 7,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 					{
 						node:  devices.CharDevice,
 						major: 1,
 						minor: 8,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 					{
 						node:  devices.CharDevice,
 						major: 1,
 						minor: 9,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 					{
 						node:  devices.CharDevice,
 						major: 5,
 						minor: 0,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 					{
 						node:  devices.CharDevice,
 						major: 5,
 						minor: 2,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 					{
 						node:  devices.CharDevice,
 						major: 136,
 						minor: devices.Wildcard,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 					{
 						node:  devices.CharDevice,
 						major: 10,
 						minor: 200,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 				},
 			},
 		},
@@ -220,17 +220,17 @@ c 10:200 rwm`,
 func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 	tests := []struct {
 		name           string
-		rule           devices.DeviceRule
+		rule           devices.Rule
 		base, expected *Emulator
 	}{
 		// Switch between default modes.
 		{
 			name: "SwitchToOtherMode",
-			rule: devices.DeviceRule{
+			rule: devices.Rule{
 				Type:        devices.WildcardDevice,
 				Major:       devices.Wildcard,
 				Minor:       devices.Wildcard,
-				Permissions: devices.DevicePermissions("rwm"),
+				Permissions: devices.Permissions("rwm"),
 				Allow:       !baseDefaultAllow,
 			},
 			base: &Emulator{
@@ -240,12 +240,12 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: devices.Wildcard,
 						minor: devices.Wildcard,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 					{
 						node:  devices.CharDevice,
 						major: 1,
 						minor: 1,
-					}: devices.DevicePermissions("r"),
+					}: devices.Permissions("r"),
 				},
 			},
 			expected: &Emulator{
@@ -255,11 +255,11 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 		},
 		{
 			name: "SwitchToSameModeNoop",
-			rule: devices.DeviceRule{
+			rule: devices.Rule{
 				Type:        devices.WildcardDevice,
 				Major:       devices.Wildcard,
 				Minor:       devices.Wildcard,
-				Permissions: devices.DevicePermissions("rwm"),
+				Permissions: devices.Permissions("rwm"),
 				Allow:       baseDefaultAllow,
 			},
 			base: &Emulator{
@@ -273,11 +273,11 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 		},
 		{
 			name: "SwitchToSameMode",
-			rule: devices.DeviceRule{
+			rule: devices.Rule{
 				Type:        devices.WildcardDevice,
 				Major:       devices.Wildcard,
 				Minor:       devices.Wildcard,
-				Permissions: devices.DevicePermissions("rwm"),
+				Permissions: devices.Permissions("rwm"),
 				Allow:       baseDefaultAllow,
 			},
 			base: &Emulator{
@@ -287,12 +287,12 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: devices.Wildcard,
 						minor: devices.Wildcard,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 					{
 						node:  devices.CharDevice,
 						major: 1,
 						minor: 1,
-					}: devices.DevicePermissions("r"),
+					}: devices.Permissions("r"),
 				},
 			},
 			expected: &Emulator{
@@ -303,11 +303,11 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 		// Rule addition logic.
 		{
 			name: "RuleAdditionBasic",
-			rule: devices.DeviceRule{
+			rule: devices.Rule{
 				Type:        devices.CharDevice,
 				Major:       42,
 				Minor:       1337,
-				Permissions: devices.DevicePermissions("rm"),
+				Permissions: devices.Permissions("rm"),
 				Allow:       !baseDefaultAllow,
 			},
 			base: &Emulator{
@@ -317,12 +317,12 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 2,
 						minor: 1,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 					{
 						node:  devices.BlockDevice,
 						major: 1,
 						minor: 5,
-					}: devices.DevicePermissions("r"),
+					}: devices.Permissions("r"),
 				},
 			},
 			expected: &Emulator{
@@ -332,27 +332,27 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 2,
 						minor: 1,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 					{
 						node:  devices.BlockDevice,
 						major: 1,
 						minor: 5,
-					}: devices.DevicePermissions("r"),
+					}: devices.Permissions("r"),
 					{
 						node:  devices.CharDevice,
 						major: 42,
 						minor: 1337,
-					}: devices.DevicePermissions("rm"),
+					}: devices.Permissions("rm"),
 				},
 			},
 		},
 		{
 			name: "RuleAdditionBasicDuplicate",
-			rule: devices.DeviceRule{
+			rule: devices.Rule{
 				Type:        devices.CharDevice,
 				Major:       42,
 				Minor:       1337,
-				Permissions: devices.DevicePermissions("rm"),
+				Permissions: devices.Permissions("rm"),
 				Allow:       !baseDefaultAllow,
 			},
 			base: &Emulator{
@@ -362,7 +362,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 42,
 						minor: devices.Wildcard,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 				},
 			},
 			expected: &Emulator{
@@ -372,23 +372,23 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 42,
 						minor: devices.Wildcard,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 					// To match the kernel, we allow redundant rules.
 					{
 						node:  devices.CharDevice,
 						major: 42,
 						minor: 1337,
-					}: devices.DevicePermissions("rm"),
+					}: devices.Permissions("rm"),
 				},
 			},
 		},
 		{
 			name: "RuleAdditionBasicDuplicateNoop",
-			rule: devices.DeviceRule{
+			rule: devices.Rule{
 				Type:        devices.CharDevice,
 				Major:       42,
 				Minor:       1337,
-				Permissions: devices.DevicePermissions("rm"),
+				Permissions: devices.Permissions("rm"),
 				Allow:       !baseDefaultAllow,
 			},
 			base: &Emulator{
@@ -398,7 +398,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 42,
 						minor: 1337,
-					}: devices.DevicePermissions("rm"),
+					}: devices.Permissions("rm"),
 				},
 			},
 			expected: &Emulator{
@@ -408,17 +408,17 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 42,
 						minor: 1337,
-					}: devices.DevicePermissions("rm"),
+					}: devices.Permissions("rm"),
 				},
 			},
 		},
 		{
 			name: "RuleAdditionMerge",
-			rule: devices.DeviceRule{
+			rule: devices.Rule{
 				Type:        devices.BlockDevice,
 				Major:       5,
 				Minor:       12,
-				Permissions: devices.DevicePermissions("rm"),
+				Permissions: devices.Permissions("rm"),
 				Allow:       !baseDefaultAllow,
 			},
 			base: &Emulator{
@@ -428,12 +428,12 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 2,
 						minor: 1,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 					{
 						node:  devices.BlockDevice,
 						major: 5,
 						minor: 12,
-					}: devices.DevicePermissions("rw"),
+					}: devices.Permissions("rw"),
 				},
 			},
 			expected: &Emulator{
@@ -443,22 +443,22 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 2,
 						minor: 1,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 					{
 						node:  devices.BlockDevice,
 						major: 5,
 						minor: 12,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 				},
 			},
 		},
 		{
 			name: "RuleAdditionMergeWildcard",
-			rule: devices.DeviceRule{
+			rule: devices.Rule{
 				Type:        devices.BlockDevice,
 				Major:       5,
 				Minor:       devices.Wildcard,
-				Permissions: devices.DevicePermissions("rm"),
+				Permissions: devices.Permissions("rm"),
 				Allow:       !baseDefaultAllow,
 			},
 			base: &Emulator{
@@ -468,12 +468,12 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 2,
 						minor: 1,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 					{
 						node:  devices.BlockDevice,
 						major: 5,
 						minor: devices.Wildcard,
-					}: devices.DevicePermissions("rw"),
+					}: devices.Permissions("rw"),
 				},
 			},
 			expected: &Emulator{
@@ -483,22 +483,22 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 2,
 						minor: 1,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 					{
 						node:  devices.BlockDevice,
 						major: 5,
 						minor: devices.Wildcard,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 				},
 			},
 		},
 		{
 			name: "RuleAdditionMergeNoop",
-			rule: devices.DeviceRule{
+			rule: devices.Rule{
 				Type:        devices.BlockDevice,
 				Major:       5,
 				Minor:       12,
-				Permissions: devices.DevicePermissions("r"),
+				Permissions: devices.Permissions("r"),
 				Allow:       !baseDefaultAllow,
 			},
 			base: &Emulator{
@@ -508,12 +508,12 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 2,
 						minor: 1,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 					{
 						node:  devices.BlockDevice,
 						major: 5,
 						minor: 12,
-					}: devices.DevicePermissions("rw"),
+					}: devices.Permissions("rw"),
 				},
 			},
 			expected: &Emulator{
@@ -523,23 +523,23 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 2,
 						minor: 1,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 					{
 						node:  devices.BlockDevice,
 						major: 5,
 						minor: 12,
-					}: devices.DevicePermissions("rw"),
+					}: devices.Permissions("rw"),
 				},
 			},
 		},
 		// Rule removal logic.
 		{
 			name: "RuleRemovalBasic",
-			rule: devices.DeviceRule{
+			rule: devices.Rule{
 				Type:        devices.CharDevice,
 				Major:       42,
 				Minor:       1337,
-				Permissions: devices.DevicePermissions("rm"),
+				Permissions: devices.Permissions("rm"),
 				Allow:       baseDefaultAllow,
 			},
 			base: &Emulator{
@@ -549,12 +549,12 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 42,
 						minor: 1337,
-					}: devices.DevicePermissions("rm"),
+					}: devices.Permissions("rm"),
 					{
 						node:  devices.BlockDevice,
 						major: 1,
 						minor: 5,
-					}: devices.DevicePermissions("r"),
+					}: devices.Permissions("r"),
 				},
 			},
 			expected: &Emulator{
@@ -564,17 +564,17 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 						node:  devices.BlockDevice,
 						major: 1,
 						minor: 5,
-					}: devices.DevicePermissions("r"),
+					}: devices.Permissions("r"),
 				},
 			},
 		},
 		{
 			name: "RuleRemovalNonexistent",
-			rule: devices.DeviceRule{
+			rule: devices.Rule{
 				Type:        devices.CharDevice,
 				Major:       4,
 				Minor:       1,
-				Permissions: devices.DevicePermissions("rw"),
+				Permissions: devices.Permissions("rw"),
 				Allow:       baseDefaultAllow,
 			},
 			base: &Emulator{
@@ -584,7 +584,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 						node:  devices.BlockDevice,
 						major: 1,
 						minor: 5,
-					}: devices.DevicePermissions("r"),
+					}: devices.Permissions("r"),
 				},
 			},
 			expected: &Emulator{
@@ -594,17 +594,17 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 						node:  devices.BlockDevice,
 						major: 1,
 						minor: 5,
-					}: devices.DevicePermissions("r"),
+					}: devices.Permissions("r"),
 				},
 			},
 		},
 		{
 			name: "RuleRemovalFull",
-			rule: devices.DeviceRule{
+			rule: devices.Rule{
 				Type:        devices.CharDevice,
 				Major:       42,
 				Minor:       1337,
-				Permissions: devices.DevicePermissions("rw"),
+				Permissions: devices.Permissions("rw"),
 				Allow:       baseDefaultAllow,
 			},
 			base: &Emulator{
@@ -614,12 +614,12 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 42,
 						minor: 1337,
-					}: devices.DevicePermissions("w"),
+					}: devices.Permissions("w"),
 					{
 						node:  devices.BlockDevice,
 						major: 1,
 						minor: 5,
-					}: devices.DevicePermissions("r"),
+					}: devices.Permissions("r"),
 				},
 			},
 			expected: &Emulator{
@@ -629,17 +629,17 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 						node:  devices.BlockDevice,
 						major: 1,
 						minor: 5,
-					}: devices.DevicePermissions("r"),
+					}: devices.Permissions("r"),
 				},
 			},
 		},
 		{
 			name: "RuleRemovalPartial",
-			rule: devices.DeviceRule{
+			rule: devices.Rule{
 				Type:        devices.CharDevice,
 				Major:       42,
 				Minor:       1337,
-				Permissions: devices.DevicePermissions("r"),
+				Permissions: devices.Permissions("r"),
 				Allow:       baseDefaultAllow,
 			},
 			base: &Emulator{
@@ -649,12 +649,12 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 42,
 						minor: 1337,
-					}: devices.DevicePermissions("rm"),
+					}: devices.Permissions("rm"),
 					{
 						node:  devices.BlockDevice,
 						major: 1,
 						minor: 5,
-					}: devices.DevicePermissions("r"),
+					}: devices.Permissions("r"),
 				},
 			},
 			expected: &Emulator{
@@ -664,12 +664,12 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 42,
 						minor: 1337,
-					}: devices.DevicePermissions("m"),
+					}: devices.Permissions("m"),
 					{
 						node:  devices.BlockDevice,
 						major: 1,
 						minor: 5,
-					}: devices.DevicePermissions("r"),
+					}: devices.Permissions("r"),
 				},
 			},
 		},
@@ -677,11 +677,11 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 		// out" holes in a wildcard rule.
 		{
 			name: "RuleRemovalWildcardPunchoutImpossible",
-			rule: devices.DeviceRule{
+			rule: devices.Rule{
 				Type:        devices.CharDevice,
 				Major:       42,
 				Minor:       1337,
-				Permissions: devices.DevicePermissions("r"),
+				Permissions: devices.Permissions("r"),
 				Allow:       baseDefaultAllow,
 			},
 			base: &Emulator{
@@ -691,23 +691,23 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 42,
 						minor: devices.Wildcard,
-					}: devices.DevicePermissions("rm"),
+					}: devices.Permissions("rm"),
 					{
 						node:  devices.CharDevice,
 						major: 42,
 						minor: 1337,
-					}: devices.DevicePermissions("r"),
+					}: devices.Permissions("r"),
 				},
 			},
 			expected: nil,
 		},
 		{
 			name: "RuleRemovalWildcardPunchoutPossible",
-			rule: devices.DeviceRule{
+			rule: devices.Rule{
 				Type:        devices.CharDevice,
 				Major:       42,
 				Minor:       1337,
-				Permissions: devices.DevicePermissions("r"),
+				Permissions: devices.Permissions("r"),
 				Allow:       baseDefaultAllow,
 			},
 			base: &Emulator{
@@ -717,12 +717,12 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 42,
 						minor: devices.Wildcard,
-					}: devices.DevicePermissions("wm"),
+					}: devices.Permissions("wm"),
 					{
 						node:  devices.CharDevice,
 						major: 42,
 						minor: 1337,
-					}: devices.DevicePermissions("r"),
+					}: devices.Permissions("r"),
 				},
 			},
 			expected: &Emulator{
@@ -732,7 +732,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 42,
 						minor: devices.Wildcard,
-					}: devices.DevicePermissions("wm"),
+					}: devices.Permissions("wm"),
 				},
 			},
 		},
@@ -767,7 +767,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 	tests := []struct {
 		name           string
 		source, target *Emulator
-		expected       []*devices.DeviceRule
+		expected       []*devices.Rule
 	}{
 		// No-op changes.
 		{
@@ -779,7 +779,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 42,
 						minor: devices.Wildcard,
-					}: devices.DevicePermissions("wm"),
+					}: devices.Permissions("wm"),
 				},
 			},
 			target: &Emulator{
@@ -789,7 +789,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 42,
 						minor: devices.Wildcard,
-					}: devices.DevicePermissions("wm"),
+					}: devices.Permissions("wm"),
 				},
 			},
 			// Identical white-lists produce no extra rules.
@@ -805,7 +805,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 1,
 						minor: 2,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 				},
 			},
 			target: &Emulator{
@@ -815,16 +815,16 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 						node:  devices.BlockDevice,
 						major: 42,
 						minor: devices.Wildcard,
-					}: devices.DevicePermissions("wm"),
+					}: devices.Permissions("wm"),
 				},
 			},
-			expected: []*devices.DeviceRule{
+			expected: []*devices.Rule{
 				// Clear-all rule.
 				{
 					Type:        devices.WildcardDevice,
 					Major:       devices.Wildcard,
 					Minor:       devices.Wildcard,
-					Permissions: devices.DevicePermissions("rwm"),
+					Permissions: devices.Permissions("rwm"),
 					Allow:       !sourceDefaultAllow,
 				},
 				// The actual rule-set.
@@ -832,7 +832,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 					Type:        devices.BlockDevice,
 					Major:       42,
 					Minor:       devices.Wildcard,
-					Permissions: devices.DevicePermissions("wm"),
+					Permissions: devices.Permissions("wm"),
 					Allow:       sourceDefaultAllow,
 				},
 			},
@@ -847,7 +847,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 1,
 						minor: 2,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 				},
 			},
 			target: &Emulator{
@@ -857,20 +857,20 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 1,
 						minor: 2,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 					{
 						node:  devices.BlockDevice,
 						major: 42,
 						minor: 1337,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 				},
 			},
-			expected: []*devices.DeviceRule{
+			expected: []*devices.Rule{
 				{
 					Type:        devices.BlockDevice,
 					Major:       42,
 					Minor:       1337,
-					Permissions: devices.DevicePermissions("rwm"),
+					Permissions: devices.Permissions("rwm"),
 					Allow:       !sourceDefaultAllow,
 				},
 			},
@@ -884,12 +884,12 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 1,
 						minor: 2,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 					{
 						node:  devices.BlockDevice,
 						major: 42,
 						minor: 1337,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 				},
 			},
 			target: &Emulator{
@@ -899,15 +899,15 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 1,
 						minor: 2,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 				},
 			},
-			expected: []*devices.DeviceRule{
+			expected: []*devices.Rule{
 				{
 					Type:        devices.BlockDevice,
 					Major:       42,
 					Minor:       1337,
-					Permissions: devices.DevicePermissions("rwm"),
+					Permissions: devices.Permissions("rwm"),
 					Allow:       sourceDefaultAllow,
 				},
 			},
@@ -921,12 +921,12 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 1,
 						minor: 2,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 					{
 						node:  devices.BlockDevice,
 						major: 3,
 						minor: 9,
-					}: devices.DevicePermissions("rw"),
+					}: devices.Permissions("rw"),
 				},
 			},
 			target: &Emulator{
@@ -936,15 +936,15 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 1,
 						minor: 2,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 				},
 			},
-			expected: []*devices.DeviceRule{
+			expected: []*devices.Rule{
 				{
 					Type:        devices.BlockDevice,
 					Major:       3,
 					Minor:       9,
-					Permissions: devices.DevicePermissions("rw"),
+					Permissions: devices.Permissions("rw"),
 					Allow:       sourceDefaultAllow,
 				},
 			},
@@ -959,7 +959,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 1,
 						minor: 2,
-					}: devices.DevicePermissions("r"),
+					}: devices.Permissions("r"),
 				},
 			},
 			target: &Emulator{
@@ -969,15 +969,15 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 1,
 						minor: 2,
-					}: devices.DevicePermissions("rwm"),
+					}: devices.Permissions("rwm"),
 				},
 			},
-			expected: []*devices.DeviceRule{
+			expected: []*devices.Rule{
 				{
 					Type:        devices.CharDevice,
 					Major:       1,
 					Minor:       2,
-					Permissions: devices.DevicePermissions("wm"),
+					Permissions: devices.Permissions("wm"),
 					Allow:       !sourceDefaultAllow,
 				},
 			},
@@ -991,7 +991,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 1,
 						minor: 2,
-					}: devices.DevicePermissions("rw"),
+					}: devices.Permissions("rw"),
 				},
 			},
 			target: &Emulator{
@@ -1001,15 +1001,15 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 1,
 						minor: 2,
-					}: devices.DevicePermissions("w"),
+					}: devices.Permissions("w"),
 				},
 			},
-			expected: []*devices.DeviceRule{
+			expected: []*devices.Rule{
 				{
 					Type:        devices.CharDevice,
 					Major:       1,
 					Minor:       2,
-					Permissions: devices.DevicePermissions("r"),
+					Permissions: devices.Permissions("r"),
 					Allow:       sourceDefaultAllow,
 				},
 			},
@@ -1023,7 +1023,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 1,
 						minor: 2,
-					}: devices.DevicePermissions("rw"),
+					}: devices.Permissions("rw"),
 				},
 			},
 			target: &Emulator{
@@ -1033,22 +1033,22 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 						node:  devices.CharDevice,
 						major: 1,
 						minor: 2,
-					}: devices.DevicePermissions("rm"),
+					}: devices.Permissions("rm"),
 				},
 			},
-			expected: []*devices.DeviceRule{
+			expected: []*devices.Rule{
 				{
 					Type:        devices.CharDevice,
 					Major:       1,
 					Minor:       2,
-					Permissions: devices.DevicePermissions("w"),
+					Permissions: devices.Permissions("w"),
 					Allow:       sourceDefaultAllow,
 				},
 				{
 					Type:        devices.CharDevice,
 					Major:       1,
 					Minor:       2,
-					Permissions: devices.DevicePermissions("m"),
+					Permissions: devices.Permissions("m"),
 					Allow:       !sourceDefaultAllow,
 				},
 			},
@@ -1063,15 +1063,15 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 			// white-list mode in mind), and then make a full copy of the
 			// target rules.
 			if sourceDefaultAllow && test.source.defaultAllow == test.target.defaultAllow {
-				test.expected = []*devices.DeviceRule{{
+				test.expected = []*devices.Rule{{
 					Type:        devices.WildcardDevice,
 					Major:       devices.Wildcard,
 					Minor:       devices.Wildcard,
-					Permissions: devices.DevicePermissions("rwm"),
+					Permissions: devices.Permissions("rwm"),
 					Allow:       test.target.defaultAllow,
 				}}
 				for _, rule := range test.target.rules.orderedEntries() {
-					test.expected = append(test.expected, &devices.DeviceRule{
+					test.expected = append(test.expected, &devices.Rule{
 						Type:        rule.meta.node,
 						Major:       rule.meta.major,
 						Minor:       rule.meta.minor,
diff --git a/libcontainer/cgroups/ebpf/devicefilter/devicefilter.go b/libcontainer/cgroups/ebpf/devicefilter/devicefilter.go
index 44831dabd..a173fd4a1 100644
--- a/libcontainer/cgroups/ebpf/devicefilter/devicefilter.go
+++ b/libcontainer/cgroups/ebpf/devicefilter/devicefilter.go
@@ -22,7 +22,7 @@ const (
 )
 
 // DeviceFilter returns eBPF device filter program and its license string
-func DeviceFilter(devices []*devices.DeviceRule) (asm.Instructions, string, error) {
+func DeviceFilter(devices []*devices.Rule) (asm.Instructions, string, error) {
 	p := &program{}
 	p.init()
 	for i := len(devices) - 1; i >= 0; i-- {
@@ -68,7 +68,7 @@ func (p *program) init() {
 }
 
 // appendDevice needs to be called from the last element of OCI linux.resources.devices to the head element.
-func (p *program) appendDevice(dev *devices.DeviceRule) error {
+func (p *program) appendDevice(dev *devices.Rule) error {
 	if p.blockID < 0 {
 		return errors.New("the program is finalized")
 	}
@@ -88,7 +88,7 @@ func (p *program) appendDevice(dev *devices.DeviceRule) error {
 		hasType = false
 	default:
 		// if not specified in OCI json, typ is set to DeviceTypeAll
-		return errors.Errorf("invalid DeviceType %q", string(dev.Type))
+		return errors.Errorf("invalid Type %q", string(dev.Type))
 	}
 	if dev.Major > math.MaxUint32 {
 		return errors.Errorf("invalid major %d", dev.Major)
diff --git a/libcontainer/cgroups/ebpf/devicefilter/devicefilter_test.go b/libcontainer/cgroups/ebpf/devicefilter/devicefilter_test.go
index 2f21cf159..1ed7a0717 100644
--- a/libcontainer/cgroups/ebpf/devicefilter/devicefilter_test.go
+++ b/libcontainer/cgroups/ebpf/devicefilter/devicefilter_test.go
@@ -20,7 +20,7 @@ func hash(s, comm string) string {
 	return strings.Join(res, "\n")
 }
 
-func testDeviceFilter(t testing.TB, devices []*devices.DeviceRule, expectedStr string) {
+func testDeviceFilter(t testing.TB, devices []*devices.Rule, expectedStr string) {
 	insts, _, err := DeviceFilter(devices)
 	if err != nil {
 		t.Fatalf("%s: %v (devices: %+v)", t.Name(), err, devices)
@@ -137,15 +137,15 @@ block-11:
         62: Mov32Imm dst: r0 imm: 0
         63: Exit
 `
-	var devices []*devices.DeviceRule
+	var devices []*devices.Rule
 	for _, device := range specconv.AllowedDevices {
-		devices = append(devices, &device.DeviceRule)
+		devices = append(devices, &device.Rule)
 	}
 	testDeviceFilter(t, devices, expected)
 }
 
 func TestDeviceFilter_Privileged(t *testing.T) {
-	devices := []*devices.DeviceRule{
+	devices := []*devices.Rule{
 		{
 			Type:        'a',
 			Major:       -1,
@@ -172,7 +172,7 @@ block-0:
 }
 
 func TestDeviceFilter_PrivilegedExceptSingleDevice(t *testing.T) {
-	devices := []*devices.DeviceRule{
+	devices := []*devices.Rule{
 		{
 			Type:        'a',
 			Major:       -1,
@@ -212,7 +212,7 @@ block-1:
 }
 
 func TestDeviceFilter_Weird(t *testing.T) {
-	devices := []*devices.DeviceRule{
+	devices := []*devices.Rule{
 		{
 			Type:        'b',
 			Major:       8,
diff --git a/libcontainer/cgroups/fs/devices.go b/libcontainer/cgroups/fs/devices.go
index 91a70cf5d..9a37e68ec 100644
--- a/libcontainer/cgroups/fs/devices.go
+++ b/libcontainer/cgroups/fs/devices.go
@@ -43,7 +43,7 @@ func loadEmulator(path string) (*cgroupdevices.Emulator, error) {
 	return cgroupdevices.EmulatorFromList(bytes.NewBufferString(list))
 }
 
-func buildEmulator(rules []*devices.DeviceRule) (*cgroupdevices.Emulator, error) {
+func buildEmulator(rules []*devices.Rule) (*cgroupdevices.Emulator, error) {
 	// This defaults to a white-list -- which is what we want!
 	emu := &cgroupdevices.Emulator{}
 	for _, rule := range rules {
diff --git a/libcontainer/cgroups/fs/devices_test.go b/libcontainer/cgroups/fs/devices_test.go
index 43405c96d..752fadd90 100644
--- a/libcontainer/cgroups/fs/devices_test.go
+++ b/libcontainer/cgroups/fs/devices_test.go
@@ -19,12 +19,12 @@ func TestDevicesSetAllow(t *testing.T) {
 		"devices.list":  "a *:* rwm",
 	})
 
-	helper.CgroupData.config.Resources.Devices = []*devices.DeviceRule{
+	helper.CgroupData.config.Resources.Devices = []*devices.Rule{
 		{
 			Type:        devices.CharDevice,
 			Major:       1,
 			Minor:       5,
-			Permissions: devices.DevicePermissions("rwm"),
+			Permissions: devices.Permissions("rwm"),
 			Allow:       true,
 		},
 	}
diff --git a/libcontainer/cgroups/fs2/devices.go b/libcontainer/cgroups/fs2/devices.go
index 2bcb5e276..4c793a1cc 100644
--- a/libcontainer/cgroups/fs2/devices.go
+++ b/libcontainer/cgroups/fs2/devices.go
@@ -11,7 +11,7 @@ import (
 	"golang.org/x/sys/unix"
 )
 
-func isRWM(perms devices.DevicePermissions) bool {
+func isRWM(perms devices.Permissions) bool {
 	var r, w, m bool
 	for _, perm := range perms {
 		switch perm {
diff --git a/libcontainer/cgroups/systemd/common.go b/libcontainer/cgroups/systemd/common.go
index 882064718..9a30e4e16 100644
--- a/libcontainer/cgroups/systemd/common.go
+++ b/libcontainer/cgroups/systemd/common.go
@@ -89,7 +89,7 @@ func ExpandSlice(slice string) (string, error) {
 	return path, nil
 }
 
-func groupPrefix(ruleType devices.DeviceType) (string, error) {
+func groupPrefix(ruleType devices.Type) (string, error) {
 	switch ruleType {
 	case devices.BlockDevice:
 		return "block-", nil
@@ -104,7 +104,7 @@ func groupPrefix(ruleType devices.DeviceType) (string, error) {
 // /proc/devices) with the type prefixed as required for DeviceAllow, for a
 // given (type, major) combination. If more than one device group exists, an
 // arbitrary one is chosen.
-func findDeviceGroup(ruleType devices.DeviceType, ruleMajor int64) (string, error) {
+func findDeviceGroup(ruleType devices.Type, ruleMajor int64) (string, error) {
 	fh, err := os.Open("/proc/devices")
 	if err != nil {
 		return "", err
@@ -117,7 +117,7 @@ func findDeviceGroup(ruleType devices.DeviceType, ruleMajor int64) (string, erro
 	}
 
 	scanner := bufio.NewScanner(fh)
-	var currentType devices.DeviceType
+	var currentType devices.Type
 	for scanner.Scan() {
 		// We need to strip spaces because the first number is column-aligned.
 		line := strings.TrimSpace(scanner.Text())
@@ -164,7 +164,7 @@ func findDeviceGroup(ruleType devices.DeviceType, ruleMajor int64) (string, erro
 
 // generateDeviceProperties takes the configured device rules and generates a
 // corresponding set of systemd properties to configure the devices correctly.
-func generateDeviceProperties(rules []*devices.DeviceRule) ([]systemdDbus.Property, error) {
+func generateDeviceProperties(rules []*devices.Rule) ([]systemdDbus.Property, error) {
 	// DeviceAllow is the type "a(ss)" which means we need a temporary struct
 	// to represent it in Go.
 	type deviceAllowEntry struct {
diff --git a/libcontainer/configs/cgroup_linux.go b/libcontainer/configs/cgroup_linux.go
index 592595dd9..aada5d62f 100644
--- a/libcontainer/configs/cgroup_linux.go
+++ b/libcontainer/configs/cgroup_linux.go
@@ -43,7 +43,7 @@ type Cgroup struct {
 
 type Resources struct {
 	// Devices is the set of access rules for devices in the container.
-	Devices []*devices.DeviceRule `json:"devices"`
+	Devices []*devices.Rule `json:"devices"`
 
 	// Memory limit (in bytes)
 	Memory int64 `json:"memory"`
diff --git a/libcontainer/configs/devices.go b/libcontainer/configs/devices.go
index ac44ab5df..b9e3664ce 100644
--- a/libcontainer/configs/devices.go
+++ b/libcontainer/configs/devices.go
@@ -6,12 +6,12 @@ type (
 	// Deprecated: use libcontainer/devices.Device
 	Device = devices.Device
 
-	// Deprecated: use libcontainer/devices.DeviceRule
-	DeviceRule = devices.DeviceRule
+	// Deprecated: use libcontainer/devices.Rule
+	DeviceRule = devices.Rule
 
-	// Deprecated: use libcontainer/devices.DeviceType
-	DeviceType = devices.DeviceType
+	// Deprecated: use libcontainer/devices.Type
+	DeviceType = devices.Type
 
-	// Deprecated: use libcontainer/devices.DevicePermissions
-	DevicePermissions = devices.DevicePermissions
+	// Deprecated: use libcontainer/devices.Permissions
+	DevicePermissions = devices.Permissions
 )
diff --git a/libcontainer/devices/device.go b/libcontainer/devices/device.go
index 2fb33b00d..3eb73cc7c 100644
--- a/libcontainer/devices/device.go
+++ b/libcontainer/devices/device.go
@@ -11,7 +11,7 @@ const (
 )
 
 type Device struct {
-	DeviceRule
+	Rule
 
 	// Path to the device.
 	Path string `json:"path"`
@@ -26,10 +26,10 @@ type Device struct {
 	Gid uint32 `json:"gid"`
 }
 
-// DevicePermissions is a cgroupv1-style string to represent device access. It
+// Permissions is a cgroupv1-style string to represent device access. It
 // has to be a string for backward compatibility reasons, hence why it has
 // methods to do set operations.
-type DevicePermissions string
+type Permissions string
 
 const (
 	deviceRead uint = (1 << iota)
@@ -37,7 +37,7 @@ const (
 	deviceMknod
 )
 
-func (p DevicePermissions) toSet() uint {
+func (p Permissions) toSet() uint {
 	var set uint
 	for _, perm := range p {
 		switch perm {
@@ -52,7 +52,7 @@ func (p DevicePermissions) toSet() uint {
 	return set
 }
 
-func fromSet(set uint) DevicePermissions {
+func fromSet(set uint) Permissions {
 	var perm string
 	if set&deviceRead == deviceRead {
 		perm += "r"
@@ -63,53 +63,53 @@ func fromSet(set uint) DevicePermissions {
 	if set&deviceMknod == deviceMknod {
 		perm += "m"
 	}
-	return DevicePermissions(perm)
+	return Permissions(perm)
 }
 
-// Union returns the union of the two sets of DevicePermissions.
-func (p DevicePermissions) Union(o DevicePermissions) DevicePermissions {
+// Union returns the union of the two sets of Permissions.
+func (p Permissions) Union(o Permissions) Permissions {
 	lhs := p.toSet()
 	rhs := o.toSet()
 	return fromSet(lhs | rhs)
 }
 
-// Difference returns the set difference of the two sets of DevicePermissions.
+// Difference returns the set difference of the two sets of Permissions.
 // In set notation, A.Difference(B) gives you A\B.
-func (p DevicePermissions) Difference(o DevicePermissions) DevicePermissions {
+func (p Permissions) Difference(o Permissions) Permissions {
 	lhs := p.toSet()
 	rhs := o.toSet()
 	return fromSet(lhs &^ rhs)
 }
 
-// Intersection computes the intersection of the two sets of DevicePermissions.
-func (p DevicePermissions) Intersection(o DevicePermissions) DevicePermissions {
+// Intersection computes the intersection of the two sets of Permissions.
+func (p Permissions) Intersection(o Permissions) Permissions {
 	lhs := p.toSet()
 	rhs := o.toSet()
 	return fromSet(lhs & rhs)
 }
 
-// IsEmpty returns whether the set of permissions in a DevicePermissions is
+// IsEmpty returns whether the set of permissions in a Permissions is
 // empty.
-func (p DevicePermissions) IsEmpty() bool {
-	return p == DevicePermissions("")
+func (p Permissions) IsEmpty() bool {
+	return p == Permissions("")
 }
 
 // IsValid returns whether the set of permissions is a subset of valid
 // permissions (namely, {r,w,m}).
-func (p DevicePermissions) IsValid() bool {
+func (p Permissions) IsValid() bool {
 	return p == fromSet(p.toSet())
 }
 
-type DeviceType rune
+type Type rune
 
 const (
-	WildcardDevice DeviceType = 'a'
-	BlockDevice    DeviceType = 'b'
-	CharDevice     DeviceType = 'c' // or 'u'
-	FifoDevice     DeviceType = 'p'
+	WildcardDevice Type = 'a'
+	BlockDevice    Type = 'b'
+	CharDevice     Type = 'c' // or 'u'
+	FifoDevice     Type = 'p'
 )
 
-func (t DeviceType) IsValid() bool {
+func (t Type) IsValid() bool {
 	switch t {
 	case WildcardDevice, BlockDevice, CharDevice, FifoDevice:
 		return true
@@ -118,7 +118,7 @@ func (t DeviceType) IsValid() bool {
 	}
 }
 
-func (t DeviceType) CanMknod() bool {
+func (t Type) CanMknod() bool {
 	switch t {
 	case BlockDevice, CharDevice, FifoDevice:
 		return true
@@ -127,7 +127,7 @@ func (t DeviceType) CanMknod() bool {
 	}
 }
 
-func (t DeviceType) CanCgroup() bool {
+func (t Type) CanCgroup() bool {
 	switch t {
 	case WildcardDevice, BlockDevice, CharDevice:
 		return true
@@ -136,10 +136,10 @@ func (t DeviceType) CanCgroup() bool {
 	}
 }
 
-type DeviceRule struct {
+type Rule struct {
 	// Type of device ('c' for char, 'b' for block). If set to 'a', this rule
 	// acts as a wildcard and all fields other than Allow are ignored.
-	Type DeviceType `json:"type"`
+	Type Type `json:"type"`
 
 	// Major is the device's major number.
 	Major int64 `json:"major"`
@@ -149,13 +149,13 @@ type DeviceRule struct {
 
 	// Permissions is the set of permissions that this rule applies to (in the
 	// cgroupv1 format -- any combination of "rwm").
-	Permissions DevicePermissions `json:"permissions"`
+	Permissions Permissions `json:"permissions"`
 
 	// Allow specifies whether this rule is allowed.
 	Allow bool `json:"allow"`
 }
 
-func (d *DeviceRule) CgroupString() string {
+func (d *Rule) CgroupString() string {
 	var (
 		major = strconv.FormatInt(d.Major, 10)
 		minor = strconv.FormatInt(d.Minor, 10)
diff --git a/libcontainer/devices/device_unix.go b/libcontainer/devices/device_unix.go
index 3bc4e179c..a400341e4 100644
--- a/libcontainer/devices/device_unix.go
+++ b/libcontainer/devices/device_unix.go
@@ -8,7 +8,7 @@ import (
 	"golang.org/x/sys/unix"
 )
 
-func (d *DeviceRule) Mkdev() (uint64, error) {
+func (d *Rule) Mkdev() (uint64, error) {
 	if d.Major == Wildcard || d.Minor == Wildcard {
 		return 0, errors.New("cannot mkdev() device with wildcards")
 	}
diff --git a/libcontainer/devices/device_windows.go b/libcontainer/devices/device_windows.go
index 421f66c0e..8511bf00e 100644
--- a/libcontainer/devices/device_windows.go
+++ b/libcontainer/devices/device_windows.go
@@ -1,5 +1,5 @@
 package devices
 
-func (d *DeviceRule) Mkdev() (uint64, error) {
+func (d *Rule) Mkdev() (uint64, error) {
 	return 0, nil
 }
diff --git a/libcontainer/devices/devices.go b/libcontainer/devices/devices.go
index 59a3a4f8b..5011f373d 100644
--- a/libcontainer/devices/devices.go
+++ b/libcontainer/devices/devices.go
@@ -30,7 +30,7 @@ func DeviceFromPath(path, permissions string) (*Device, error) {
 	}
 
 	var (
-		devType   DeviceType
+		devType   Type
 		mode      = stat.Mode
 		devNumber = uint64(stat.Rdev)
 		major     = unix.Major(devNumber)
@@ -47,11 +47,11 @@ func DeviceFromPath(path, permissions string) (*Device, error) {
 		return nil, ErrNotADevice
 	}
 	return &Device{
-		DeviceRule: DeviceRule{
+		Rule: Rule{
 			Type:        devType,
 			Major:       int64(major),
 			Minor:       int64(minor),
-			Permissions: DevicePermissions(permissions),
+			Permissions: Permissions(permissions),
 		},
 		Path:     path,
 		FileMode: os.FileMode(mode),
diff --git a/libcontainer/integration/template_test.go b/libcontainer/integration/template_test.go
index 718e45c63..b8f7d0a48 100644
--- a/libcontainer/integration/template_test.go
+++ b/libcontainer/integration/template_test.go
@@ -30,9 +30,9 @@ type tParam struct {
 // it uses a network strategy of just setting a loopback interface
 // and the default setup for devices
 func newTemplateConfig(p *tParam) *configs.Config {
-	var allowedDevices []*devices.DeviceRule
+	var allowedDevices []*devices.Rule
 	for _, device := range specconv.AllowedDevices {
-		allowedDevices = append(allowedDevices, &device.DeviceRule)
+		allowedDevices = append(allowedDevices, &device.Rule)
 	}
 	config := &configs.Config{
 		Rootfs: p.rootfs,
diff --git a/libcontainer/specconv/spec_linux.go b/libcontainer/specconv/spec_linux.go
index 81d19aacb..07161ae0e 100644
--- a/libcontainer/specconv/spec_linux.go
+++ b/libcontainer/specconv/spec_linux.go
@@ -65,7 +65,7 @@ var mountPropagationMapping = map[string]int{
 var AllowedDevices = []*devices.Device{
 	// allow mknod for any device
 	{
-		DeviceRule: devices.DeviceRule{
+		Rule: devices.Rule{
 			Type:        devices.CharDevice,
 			Major:       devices.Wildcard,
 			Minor:       devices.Wildcard,
@@ -74,7 +74,7 @@ var AllowedDevices = []*devices.Device{
 		},
 	},
 	{
-		DeviceRule: devices.DeviceRule{
+		Rule: devices.Rule{
 			Type:        devices.BlockDevice,
 			Major:       devices.Wildcard,
 			Minor:       devices.Wildcard,
@@ -87,7 +87,7 @@ var AllowedDevices = []*devices.Device{
 		FileMode: 0666,
 		Uid:      0,
 		Gid:      0,
-		DeviceRule: devices.DeviceRule{
+		Rule: devices.Rule{
 			Type:        devices.CharDevice,
 			Major:       1,
 			Minor:       3,
@@ -100,7 +100,7 @@ var AllowedDevices = []*devices.Device{
 		FileMode: 0666,
 		Uid:      0,
 		Gid:      0,
-		DeviceRule: devices.DeviceRule{
+		Rule: devices.Rule{
 			Type:        devices.CharDevice,
 			Major:       1,
 			Minor:       8,
@@ -113,7 +113,7 @@ var AllowedDevices = []*devices.Device{
 		FileMode: 0666,
 		Uid:      0,
 		Gid:      0,
-		DeviceRule: devices.DeviceRule{
+		Rule: devices.Rule{
 			Type:        devices.CharDevice,
 			Major:       1,
 			Minor:       7,
@@ -126,7 +126,7 @@ var AllowedDevices = []*devices.Device{
 		FileMode: 0666,
 		Uid:      0,
 		Gid:      0,
-		DeviceRule: devices.DeviceRule{
+		Rule: devices.Rule{
 			Type:        devices.CharDevice,
 			Major:       5,
 			Minor:       0,
@@ -139,7 +139,7 @@ var AllowedDevices = []*devices.Device{
 		FileMode: 0666,
 		Uid:      0,
 		Gid:      0,
-		DeviceRule: devices.DeviceRule{
+		Rule: devices.Rule{
 			Type:        devices.CharDevice,
 			Major:       1,
 			Minor:       5,
@@ -152,7 +152,7 @@ var AllowedDevices = []*devices.Device{
 		FileMode: 0666,
 		Uid:      0,
 		Gid:      0,
-		DeviceRule: devices.DeviceRule{
+		Rule: devices.Rule{
 			Type:        devices.CharDevice,
 			Major:       1,
 			Minor:       9,
@@ -162,7 +162,7 @@ var AllowedDevices = []*devices.Device{
 	},
 	// /dev/pts/ - pts namespaces are "coming soon"
 	{
-		DeviceRule: devices.DeviceRule{
+		Rule: devices.Rule{
 			Type:        devices.CharDevice,
 			Major:       136,
 			Minor:       devices.Wildcard,
@@ -171,7 +171,7 @@ var AllowedDevices = []*devices.Device{
 		},
 	},
 	{
-		DeviceRule: devices.DeviceRule{
+		Rule: devices.Rule{
 			Type:        devices.CharDevice,
 			Major:       5,
 			Minor:       2,
@@ -181,7 +181,7 @@ var AllowedDevices = []*devices.Device{
 	},
 	// tuntap
 	{
-		DeviceRule: devices.DeviceRule{
+		Rule: devices.Rule{
 			Type:        devices.CharDevice,
 			Major:       10,
 			Minor:       200,
@@ -492,11 +492,11 @@ func CreateCgroupConfig(opts *CreateOpts, defaultDevs []*devices.Device) (*confi
 				if err != nil {
 					return nil, err
 				}
-				c.Resources.Devices = append(c.Resources.Devices, &devices.DeviceRule{
+				c.Resources.Devices = append(c.Resources.Devices, &devices.Rule{
 					Type:        dt,
 					Major:       major,
 					Minor:       minor,
-					Permissions: devices.DevicePermissions(d.Access),
+					Permissions: devices.Permissions(d.Access),
 					Allow:       d.Allow,
 				})
 			}
@@ -630,12 +630,12 @@ func CreateCgroupConfig(opts *CreateOpts, defaultDevs []*devices.Device) (*confi
 
 	// Append the default allowed devices to the end of the list.
 	for _, device := range defaultDevs {
-		c.Resources.Devices = append(c.Resources.Devices, &device.DeviceRule)
+		c.Resources.Devices = append(c.Resources.Devices, &device.Rule)
 	}
 	return c, nil
 }
 
-func stringToCgroupDeviceRune(s string) (devices.DeviceType, error) {
+func stringToCgroupDeviceRune(s string) (devices.Type, error) {
 	switch s {
 	case "a":
 		return devices.WildcardDevice, nil
@@ -648,7 +648,7 @@ func stringToCgroupDeviceRune(s string) (devices.DeviceType, error) {
 	}
 }
 
-func stringToDeviceRune(s string) (devices.DeviceType, error) {
+func stringToDeviceRune(s string) (devices.Type, error) {
 	switch s {
 	case "p":
 		return devices.FifoDevice, nil
@@ -701,7 +701,7 @@ next:
 				filemode = *d.FileMode
 			}
 			device := &devices.Device{
-				DeviceRule: devices.DeviceRule{
+				Rule: devices.Rule{
 					Type:  dt,
 					Major: d.Major,
 					Minor: d.Minor,
diff --git a/libcontainer/specconv/spec_linux_test.go b/libcontainer/specconv/spec_linux_test.go
index a49db6cc5..dc880f32c 100644
--- a/libcontainer/specconv/spec_linux_test.go
+++ b/libcontainer/specconv/spec_linux_test.go
@@ -727,7 +727,7 @@ func TestCreateDevices(t *testing.T) {
 				FileMode: 0666,
 				Uid:      1000,
 				Gid:      1000,
-				DeviceRule: devices.DeviceRule{
+				Rule: devices.Rule{
 					Type:  devices.CharDevice,
 					Major: 5,
 					Minor: 0,