Make them call into qubesd. Create separate socket for "misc" calls - VM accessible, but not part of Admin API.
QubesOS/qubes-issues#1637