The design for this ticket
is
http://directory.fedoraproject.org/wiki/Access_control_on_trees_specified_in_MODDN_operation
The fix is
https://fedorahosted.org/389/attachment/ticket/47553/0001-Ticket-47553-Enhance-ACIs-to-have-more-control-over-.patch
The test case is:
https://fedorahosted.org/389/attachment/ticket/47553/0001-Ticket-47553-test-case.patch