Index: doc/book/book/ch05.xml
===================================================================
--- doc/book/book/ch05.xml	(revision 4824)
+++ doc/book/book/ch05.xml	(working copy)
@@ -1950,6 +1950,46 @@
 </Location>
 </screen>
 
+      <para>If you need to limit access to a portion of the repository,
+        additional <literal>&lt;Location&gt;</literal>, or
+        <literal>&lt;LocationMatch&gt;</literal> blocks can be used
+        for subdirectories in your repository.  You should not include
+        the <literal>DAV</literal>, <literal>SVNPath</literal>, or
+        <literal>SVNParentPath</literal> directives in these sections.
+        The <literal>&lt;Location&gt;</literal> block you have for
+        the base will suffice for all the subdirectories.</para>
+
+      <para>Additionally, preventing read access to a subdirectory in a
+        repository is currently somewhat problematic.  There are two
+        major issues.  The first is that a
+        <literal>&lt;LocationMatch&gt;</literal> block is required
+        because of the way Subversion fetches specific revisions out of
+        the repository.  Here is an example of restricting read access
+        to the repository directory <systemitem
+        class="url">http://svn.collab.net/repos/svn/private</systemitem>
+        to authenticated users.</para>
+
+      <screen>
+&lt;LocationMatch ^/repos/svn/(/\!svn/bc/[0-9]+)?/private&gt;
+   AuthType Basic
+   AuthName "Subversion repository"
+   AuthUserFile /usr/local/apache/svnauth/passwd
+   Require valid-user
+&lt;/LocationMatch&gt;
+</screen>
+
+     <para>The second issue is that Subversion currently handles
+       checkouts that don't complete rather poorly.  In this example, if
+       someone tried to check out the entire Subversion repository, it
+       would balk when it got the <literal>private</literal> directory,
+       requiring and authorization.  If it didn't get it, the checkout
+       would abort in the middle, leaving your working directory in an
+       ill-defined state.  You couldn't put your repository back into a
+       defined sate, because no matter what you did, it would balk at
+       the <literal>private</literal> directory.  This isn't a problem
+       if you only check out sections of the repository where you have
+       read access to every directory.</para>
+
       <para>These are only a few simple examples.  For more in-depth
         information about Apache access control, take a look at the
         <literal>Security</literal> section of the Apache