Description of problem:
Firewalld replaces the existing .xml rather than appending after adding --set-log-denied=all 

Version-Release number of selected component (if applicable):
RHEL 7.4
firewalld-0.4.4.4

How reproducible:
Always

Steps to Reproduce:
1. List the firewalld rules.
 # firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 
  services: ssh dhcpv6-client
  ports: 
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 

2. Now enable logging using:
 # firewall-cmd --set-log-denied=all

3. Now add any service/port/rich rule to the existing zone.
 # firewall-cmd --permanent --zone=public --add-service=samba
 # systemctl restart firewalld

4. Now check the firewalld rules using:
 # firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 
  services: samba
  ports: 
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 

Actual results:
# firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 
  services: samba
  ports: 
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 

Expected results:
# firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 
  services: samba ssh dhcpv6-client  <<<---------
  ports: 
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 

Additional info:
It looks like after enabling the logging "--set-log-denied=all" the firewalld is replacing the configuration with the config which is added after mentioning the rule.

Here to reproduce the issue the important this is the "ordering" part!