Restore ACI when aci_mod fails

aci_mod command is composed of 2 ACI commands: aci_del which
deletes the old ACI and aci_add which adds the new modified ACI.
However, if aci_add command fails then both new and the old ACI
are lost. Old ACI must be restored in this case.

https://fedorahosted.org/freeipa/ticket/2013
https://fedorahosted.org/freeipa/ticket/2014

tests/test_xmlrpc/test_selfservice_plugin.py

@@ -172,6 +172,31 @@ class test_selfservice(Declarative):
         ),
 
 
+        dict(
+            desc='Try to update %r with empty permissions' % selfservice1,
+            command=(
+                'selfservice_mod', [selfservice1], dict(permissions=None)
+            ),
+            expected=errors.RequirementError(name='permissions'),
+        ),
+
+
+        dict(
+            desc='Retrieve %r to verify invalid update' % selfservice1,
+            command=('selfservice_show', [selfservice1], {}),
+            expected=dict(
+                value=selfservice1,
+                summary=None,
+                result={
+                        'attrs': [u'street', u'c', u'l', u'st', u'postalcode'],
+                        'permissions': [u'read'],
+                        'selfaci': True,
+                        'aciname': selfservice1,
+                },
+            ),
+        ),
+
+
         dict(
             desc='Delete %r' % selfservice1,
             command=('selfservice_del', [selfservice1], {}),