device_cgroup: check if exception removal is allowed