Make them call into qubesd. Create separate socket for "misc" calls - VM accessible, but not part of Admin API.
Marek Marczykowski-Górecki