vfs: make gcc generate more obvious code for acl permission checking