diff --git a/phpgwapi/inc/class.egw_sharing.inc.php b/phpgwapi/inc/class.egw_sharing.inc.php
index 1933ac4be9..e59ed173c4 100644
--- a/phpgwapi/inc/class.egw_sharing.inc.php
+++ b/phpgwapi/inc/class.egw_sharing.inc.php
@@ -73,6 +73,11 @@ class egw_sharing
 			common::egw_exit();
 		}
 		$share['resolve_url'] = egw_vfs::resolve_url($share['share_path']);
+		// if share not writable append ro=1 to mount url to make it readonly
+		if (!$this->db->from_bool($share['share_writable']))
+		{
+			$share['resolve_url'] .= (strpos($share['resolve_url'], '?') ? '&' : '?').'ro=1';
+		}
 		//_debug_array($share);
 
 		// arrange vfs to only contain shared url
diff --git a/phpgwapi/inc/class.egw_vfs.inc.php b/phpgwapi/inc/class.egw_vfs.inc.php
index c7a49b23ed..cf50193be9 100644
--- a/phpgwapi/inc/class.egw_vfs.inc.php
+++ b/phpgwapi/inc/class.egw_vfs.inc.php
@@ -717,6 +717,7 @@ class egw_vfs extends vfs_stream_wrapper
 	 *
 	 * @param string|array $urls url or array of url's
 	 * @param boolean $allow_urls=false allow to use url's, default no only pathes (to stay within the vfs)
+	 * @throws egw_exception_assertion_failed when trainig to remove /, /apps or /home
 	 * @return array
 	 */
 	static function remove($urls,$allow_urls=false)
diff --git a/phpgwapi/inc/class.vfs_stream_wrapper.inc.php b/phpgwapi/inc/class.vfs_stream_wrapper.inc.php
index bd728dbfe9..985dfe822f 100644
--- a/phpgwapi/inc/class.vfs_stream_wrapper.inc.php
+++ b/phpgwapi/inc/class.vfs_stream_wrapper.inc.php
@@ -293,6 +293,10 @@ class vfs_stream_wrapper implements iface_stream_wrapper
 		{
 			return false;
 		}
+		if ($mode != 'r' && self::url_is_readonly($url))
+		{
+			return false;
+		}
 		if (!($this->opened_stream = fopen($url,$mode,$options)))
 		{
 			return false;
@@ -463,6 +467,10 @@ class vfs_stream_wrapper implements iface_stream_wrapper
 		{
 			return false;
 		}
+		if (self::url_is_readonly($url))
+		{
+			return false;
+		}
 		$stat = self::url_stat($path, STREAM_URL_STAT_LINK);
 
 		self::symlinkCache_remove($path);
@@ -583,6 +591,10 @@ class vfs_stream_wrapper implements iface_stream_wrapper
 		{
 			return false;
 		}
+		if (self::url_is_readonly($url))
+		{
+			return false;
+		}
 		$stat = self::url_stat($path, STREAM_URL_STAT_LINK);
 
 		self::symlinkCache_remove($path);
@@ -957,6 +969,10 @@ class vfs_stream_wrapper implements iface_stream_wrapper
 		{
 			$stat['url'] = $url;
 		}
+		if (($stat['mode'] & 0222) && self::url_is_readonly($stat['url']))
+		{
+			$stat['mode'] &= ~0222;
+		}
 		if (self::LOG_LEVEL > 1) error_log(__METHOD__."('$path',$flags,try_create_home=$try_create_home,check_symlink_components=$check_symlink_components) returning ".array2string($stat));
 
 		return $stat;
@@ -1311,6 +1327,24 @@ class vfs_stream_wrapper implements iface_stream_wrapper
 		return $path;
 	}
 
+	/**
+	 * Check if url contains ro=1 parameter to mark mount readonly
+	 *
+	 * @param string $url
+	 * @return boolean
+	 */
+	static function url_is_readonly($url)
+	{
+		static $cache = array();
+		$ret =& $cache[$url];
+		if (!isset($ret))
+		{
+			$matches = null;
+			$ret = preg_match('/?(.*&)?ro=([^&]+)/', $url, $matches) && $matches[1];
+		}
+		return $ret;
+	}
+
 	/**
 	 * Init our static properties and register this wrapper
 	 *