acl: fix matching rule