Replace get_attr usage in has_child_permission

Fix subtle attribute resolution bug in permission checking.