Where does xhost store the allowed network addresses?

Question

Where does xhost store the allowed network addresses?

Answer 1

xhost simply calls XAddHost etc., which manipulates a list held by the server. See xhost/xhost.c for the client-side and xserver/os/access.c for the server-side.

You really should try to use xauth instead of xhost if possible. It keeps a list of permissible keys which can be used on a per-user, per-client basis instead of relying on just hostname (spoofable in an unfriendly environment).