Index: src/os_unix.c
==================================================================
--- src/os_unix.c
+++ src/os_unix.c
@@ -3535,11 +3535,12 @@
   unixInodeInfo *pInode;     /* unixInodeInfo that owns this SHM node */
   sqlite3_mutex *mutex;      /* Mutex to access this object */
   char *zFilename;           /* Name of the mmapped file */
   int h;                     /* Open file descriptor */
   int szRegion;              /* Size of shared-memory regions */
-  int nRegion;               /* Size of array apRegion */
+  u16 nRegion;               /* Size of array apRegion */
+  u8 isReadonly;             /* True if read-only */
   char **apRegion;           /* Array of mapped shared-memory regions */
   int nRef;                  /* Number of unixShm objects pointing to this */
   unixShm *pFirst;           /* All unixShm objects pointing to this */
 #ifdef SQLITE_DEBUG
   u8 exclMask;               /* Mask of exclusive locks held */
@@ -3782,12 +3783,21 @@
 
     if( pInode->bProcessLock==0 ){
       pShmNode->h = robust_open(zShmFilename, O_RDWR|O_CREAT,
                                (sStat.st_mode & 0777));
       if( pShmNode->h<0 ){
-        rc = unixLogError(SQLITE_CANTOPEN_BKPT, "open", zShmFilename);
-        goto shm_open_err;
+        const char *zRO;
+        zRO = sqlite3_uri_parameter(pDbFd->zPath, "readonly_shm");
+        if( zRO && sqlite3GetBoolean(zRO) ){
+          pShmNode->h = robust_open(zShmFilename, O_RDONLY,
+                                    (sStat.st_mode & 0777));
+          pShmNode->isReadonly = 1;
+        }
+        if( pShmNode->h<0 ){
+          rc = unixLogError(SQLITE_CANTOPEN_BKPT, "open", zShmFilename);
+          goto shm_open_err;
+        }
       }
   
       /* Check to see if another process is holding the dead-man switch.
       ** If not, truncate the file to zero length. 
       */
@@ -3922,11 +3932,12 @@
     }
     pShmNode->apRegion = apNew;
     while(pShmNode->nRegion<=iRegion){
       void *pMem;
       if( pShmNode->h>=0 ){
-        pMem = mmap(0, szRegion, PROT_READ|PROT_WRITE, 
+        pMem = mmap(0, szRegion,
+            pShmNode->isReadonly ? PROT_READ : PROT_READ|PROT_WRITE, 
             MAP_SHARED, pShmNode->h, pShmNode->nRegion*szRegion
         );
         if( pMem==MAP_FAILED ){
           rc = unixLogError(SQLITE_IOERR_SHMMAP, "mmap", pShmNode->zFilename);
           goto shmpage_out;
@@ -3948,10 +3959,11 @@
   if( pShmNode->nRegion>iRegion ){
     *pp = pShmNode->apRegion[iRegion];
   }else{
     *pp = 0;
   }
+  if( pShmNode->isReadonly && rc==SQLITE_OK ) rc = SQLITE_READONLY;
   sqlite3_mutex_leave(pShmNode->mutex);
   return rc;
 }
 
 /*

Index: src/sqlite.h.in
==================================================================
--- src/sqlite.h.in
+++ src/sqlite.h.in
@@ -452,10 +452,12 @@
 #define SQLITE_IOERR_SEEK              (SQLITE_IOERR | (22<<8))
 #define SQLITE_LOCKED_SHAREDCACHE      (SQLITE_LOCKED |  (1<<8))
 #define SQLITE_BUSY_RECOVERY           (SQLITE_BUSY   |  (1<<8))
 #define SQLITE_CANTOPEN_NOTEMPDIR      (SQLITE_CANTOPEN | (1<<8))
 #define SQLITE_CORRUPT_VTAB            (SQLITE_CORRUPT | (1<<8))
+#define SQLITE_READONLY_RECOVERY       (SQLITE_READONLY | (1<<8))
+#define SQLITE_READONLY_CANTLOCK       (SQLITE_READONLY | (2<<8))
 
 /*
 ** CAPI3REF: Flags For File Open Operations
 **
 ** These bit values are intended for use in the

Index: src/test1.c
==================================================================
--- src/test1.c
+++ src/test1.c
@@ -162,10 +162,12 @@
     case SQLITE_IOERR_ACCESS:        zName = "SQLITE_IOERR_ACCESS";      break;
     case SQLITE_IOERR_CHECKRESERVEDLOCK:
                                zName = "SQLITE_IOERR_CHECKRESERVEDLOCK"; break;
     case SQLITE_IOERR_LOCK:          zName = "SQLITE_IOERR_LOCK";        break;
     case SQLITE_CORRUPT_VTAB:        zName = "SQLITE_CORRUPT_VTAB";      break;
+    case SQLITE_READONLY_RECOVERY:   zName = "SQLITE_READONLY_RECOVERY"; break;
+    case SQLITE_READONLY_CANTLOCK:   zName = "SQLITE_READONLY_CANTLOCK"; break;
     default:                         zName = "SQLITE_Unknown";           break;
   }
   return zName;
 }
 #define t1ErrorName sqlite3TestErrorName

Index: src/wal.c
==================================================================
--- src/wal.c
+++ src/wal.c
@@ -418,11 +418,11 @@
   u32 szPage;                /* Database page size */
   i16 readLock;              /* Which read lock is being held.  -1 for none */
   u8 exclusiveMode;          /* Non-zero if connection is in exclusive mode */
   u8 writeLock;              /* True if in a write transaction */
   u8 ckptLock;               /* True if holding a checkpoint lock */
-  u8 readOnly;               /* True if the WAL file is open read-only */
+  u8 readOnly;               /* WAL_RDWR, WAL_RDONLY, or WAL_SHM_RDONLY */
   WalIndexHdr hdr;           /* Wal-index header for current transaction */
   const char *zWalName;      /* Name of WAL file */
   u32 nCkpt;                 /* Checkpoint sequence counter in the wal-header */
 #ifdef SQLITE_DEBUG
   u8 lockError;              /* True if a locking error has occurred */
@@ -434,10 +434,17 @@
 */
 #define WAL_NORMAL_MODE     0
 #define WAL_EXCLUSIVE_MODE  1     
 #define WAL_HEAPMEMORY_MODE 2
 
+/*
+** Possible values for WAL.readOnly
+*/
+#define WAL_RDWR        0    /* Normal read/write connection */
+#define WAL_RDONLY      1    /* The WAL file is readonly */
+#define WAL_SHM_RDONLY  2    /* The SHM file is readonly */
+
 /*
 ** Each page of the wal-index mapping contains a hash-table made up of
 ** an array of HASHTABLE_NSLOT elements of the following type.
 */
 typedef u16 ht_slot;
@@ -527,10 +534,14 @@
       if( !pWal->apWiData[iPage] ) rc = SQLITE_NOMEM;
     }else{
       rc = sqlite3OsShmMap(pWal->pDbFd, iPage, WALINDEX_PGSZ, 
           pWal->writeLock, (void volatile **)&pWal->apWiData[iPage]
       );
+      if( rc==SQLITE_READONLY ){
+        pWal->readOnly |= WAL_SHM_RDONLY;
+        rc = SQLITE_OK;
+      }
     }
   }
 
   *ppPage = pWal->apWiData[iPage];
   assert( iPage==0 || *ppPage || rc!=SQLITE_OK );
@@ -1274,11 +1285,11 @@
 
   /* Open file handle on the write-ahead log file. */
   flags = (SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE|SQLITE_OPEN_WAL);
   rc = sqlite3OsOpen(pVfs, zWalName, pRet->pWalFd, flags, &flags);
   if( rc==SQLITE_OK && flags&SQLITE_OPEN_READONLY ){
-    pRet->readOnly = 1;
+    pRet->readOnly = WAL_RDONLY;
   }
 
   if( rc!=SQLITE_OK ){
     walIndexClose(pRet, 0);
     sqlite3OsClose(pRet->pWalFd);
@@ -1915,25 +1926,32 @@
 
   /* If the first attempt failed, it might have been due to a race
   ** with a writer.  So get a WRITE lock and try again.
   */
   assert( badHdr==0 || pWal->writeLock==0 );
-  if( badHdr && SQLITE_OK==(rc = walLockExclusive(pWal, WAL_WRITE_LOCK, 1)) ){
-    pWal->writeLock = 1;
-    if( SQLITE_OK==(rc = walIndexPage(pWal, 0, &page0)) ){
-      badHdr = walIndexTryHdr(pWal, pChanged);
-      if( badHdr ){
-        /* If the wal-index header is still malformed even while holding
-        ** a WRITE lock, it can only mean that the header is corrupted and
-        ** needs to be reconstructed.  So run recovery to do exactly that.
-        */
-        rc = walIndexRecover(pWal);
-        *pChanged = 1;
-      }
-    }
-    pWal->writeLock = 0;
-    walUnlockExclusive(pWal, WAL_WRITE_LOCK, 1);
+  if( badHdr ){
+    if( pWal->readOnly & WAL_SHM_RDONLY ){
+      if( SQLITE_OK==(rc = walLockShared(pWal, WAL_WRITE_LOCK)) ){
+        walUnlockShared(pWal, WAL_WRITE_LOCK);
+        rc = SQLITE_READONLY_RECOVERY;
+      }
+    }else if( SQLITE_OK==(rc = walLockExclusive(pWal, WAL_WRITE_LOCK, 1)) ){
+      pWal->writeLock = 1;
+      if( SQLITE_OK==(rc = walIndexPage(pWal, 0, &page0)) ){
+        badHdr = walIndexTryHdr(pWal, pChanged);
+        if( badHdr ){
+          /* If the wal-index header is still malformed even while holding
+          ** a WRITE lock, it can only mean that the header is corrupted and
+          ** needs to be reconstructed.  So run recovery to do exactly that.
+          */
+          rc = walIndexRecover(pWal);
+          *pChanged = 1;
+        }
+      }
+      pWal->writeLock = 0;
+      walUnlockExclusive(pWal, WAL_WRITE_LOCK, 1);
+    }
   }
 
   /* If the header is read successfully, check the version number to make
   ** sure the wal-index was not constructed with some future format that
   ** this version of SQLite cannot understand.
@@ -2116,11 +2134,13 @@
       mxI = i;
     }
   }
   /* There was once an "if" here. The extra "{" is to preserve indentation. */
   {
-    if( mxReadMark < pWal->hdr.mxFrame || mxI==0 ){
+    if( (pWal->readOnly & WAL_SHM_RDONLY)==0
+     && (mxReadMark<pWal->hdr.mxFrame || mxI==0)
+    ){
       for(i=1; i<WAL_NREADER; i++){
         rc = walLockExclusive(pWal, WAL_READ_LOCK(i), 1);
         if( rc==SQLITE_OK ){
           mxReadMark = pInfo->aReadMark[i] = pWal->hdr.mxFrame;
           mxI = i;
@@ -2131,11 +2151,11 @@
         }
       }
     }
     if( mxI==0 ){
       assert( rc==SQLITE_BUSY );
-      return WAL_RETRY;
+      return rc==SQLITE_BUSY ? WAL_RETRY : SQLITE_READONLY_CANTLOCK;
     }
 
     rc = walLockShared(pWal, WAL_READ_LOCK(mxI));
     if( rc ){
       return rc==SQLITE_BUSY ? WAL_RETRY : rc;
@@ -2773,10 +2793,11 @@
   int eMode2 = eMode;             /* Mode to pass to walCheckpoint() */
 
   assert( pWal->ckptLock==0 );
   assert( pWal->writeLock==0 );
 
+  if( pWal->readOnly ) return SQLITE_READONLY;
   WALTRACE(("WAL%p: checkpoint begins\n", pWal));
   rc = walLockExclusive(pWal, WAL_CKPT_LOCK, 1);
   if( rc ){
     /* Usually this is SQLITE_BUSY meaning that another thread or process
     ** is already running a checkpoint, or maybe a recovery.  But it might

Index: test/lock_common.tcl
==================================================================
--- test/lock_common.tcl
+++ test/lock_common.tcl
@@ -53,12 +53,12 @@
     proc csql3 {sql} { list [catch { sql3 $sql } msg] $msg }
 
     uplevel set $varname $tn
     uplevel $script
 
-    code2 { db2 close }
-    code3 { db3 close }
+    catch { code2 { db2 close } }
+    catch { code3 { db3 close } }
     catch { close $::code2_chan }
     catch { close $::code3_chan }
     catch { db close }
   }
 }

ADDED   test/walro.test
Index: test/walro.test
==================================================================
--- /dev/null
+++ test/walro.test
@@ -0,0 +1,159 @@
+# 2011 May 09
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+#
+# This file contains tests for using WAL databases in read-only mode.
+#
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+source $testdir/lock_common.tcl
+set ::testprefix walro
+
+
+do_multiclient_test tn {
+  # These tests are only going to work on unix.
+  #
+  if {$tcl_platform(platform) != "unix"} continue
+
+  # Do not run tests with the connections in the same process.
+  #
+  if {$tn==2} continue
+  
+  # Close all connections and delete the database.
+  #
+  code1 { db close  }
+  code2 { db2 close }
+  code3 { db3 close }
+  forcedelete test.db
+  forcedelete walro
+
+  foreach c {code1 code2 code3} {
+    $c {
+      sqlite3_shutdown
+      sqlite3_config_uri 1
+    }
+  }
+
+  file mkdir walro
+
+  do_test 1.1.1 {
+    code2 { sqlite3 db2 test.db }
+    sql2 { 
+      PRAGMA journal_mode = WAL;
+      CREATE TABLE t1(x, y);
+      INSERT INTO t1 VALUES('a', 'b');
+    }
+    file exists test.db-shm
+  } {1}
+
+  do_test 1.1.2 {
+    file attributes test.db-shm -permissions r--r--r--
+    code1 { sqlite3 db file:test.db?readonly_shm=1 }
+  } {}
+
+  do_test 1.1.3 { sql1 "SELECT * FROM t1" }                {a b}
+  do_test 1.1.4 { sql2 "INSERT INTO t1 VALUES('c', 'd')" } {}
+  do_test 1.1.5 { sql1 "SELECT * FROM t1" }                {a b c d}
+
+  # Check that the read-only connection cannot write or checkpoint the db.
+  #
+  do_test 1.1.6 { 
+    csql1 "INSERT INTO t1 VALUES('e', 'f')" 
+  } {1 {attempt to write a readonly database}}
+  do_test 1.1.7 { 
+    csql1 "PRAGMA wal_checkpoint"
+  } {1 {attempt to write a readonly database}}
+
+  do_test 1.1.9  { sql2 "INSERT INTO t1 VALUES('e', 'f')" } {}
+  do_test 1.1.10 { sql1 "SELECT * FROM t1" }                {a b c d e f}
+
+  do_test 1.1.11 { 
+    sql2 {
+      INSERT INTO t1 VALUES('g', 'h');
+      PRAGMA wal_checkpoint;
+    }
+    set {} {}
+  } {}
+  do_test 1.1.12 { sql1 "SELECT * FROM t1" }                {a b c d e f g h}
+  do_test 1.1.13  { sql2 "INSERT INTO t1 VALUES('i', 'j')" } {}
+
+  do_test 1.2.1 {
+    code2 { db2 close }
+    code1 { db close }
+    list [file exists test.db-wal] [file exists test.db-shm]
+  } {1 1}
+  do_test 1.2.2 {
+    code1 { sqlite3 db file:test.db?readonly_shm=1 }
+    sql1 { SELECT * FROM t1 }
+  } {a b c d e f g h i j}
+
+  do_test 1.2.3 {
+    code1 { db close }
+    file attributes test.db-shm -permissions rw-r--r--
+    hexio_write test.db-shm 0 01020304 
+    file attributes test.db-shm -permissions r--r--r--
+    code1 { sqlite3 db file:test.db?readonly_shm=1 }
+    csql1 { SELECT * FROM t1 }
+  } {1 {attempt to write a readonly database}}
+  do_test 1.2.4 {
+    code1 { sqlite3_extended_errcode db } 
+  } {SQLITE_READONLY_RECOVERY}
+
+  do_test 1.2.5 {
+    file attributes test.db-shm -permissions rw-r--r--
+    code2 { sqlite3 db2 test.db }
+    sql2 "SELECT * FROM t1" 
+  } {a b c d e f g h i j}
+  file attributes test.db-shm -permissions r--r--r--
+  do_test 1.2.6 { sql1 "SELECT * FROM t1" } {a b c d e f g h i j}
+
+  do_test 1.2.7 { 
+    sql2 {
+      PRAGMA wal_checkpoint;
+      INSERT INTO t1 VALUES('k', 'l');
+    }
+    set {} {}
+  } {}
+  do_test 1.2.8 { sql1 "SELECT * FROM t1" } {a b c d e f g h i j k l}
+
+  # Now check that if the readonly_shm option is not supplied, or if it
+  # is set to zero, it is not possible to connect to the database without
+  # read-write access to the shm.
+  do_test 1.3.1 {
+    code1 { db close }
+    code1 { sqlite3 db test.db }
+    csql1 { SELECT * FROM t1 }
+  } {1 {unable to open database file}}
+
+  # Also test that if the -shm file can be opened for read/write access,
+  # it is, even if readonly_shm=1 is present in the URI.
+  do_test 1.3.2.1 {
+    code1 { db close }
+    code2 { db2 close }
+    file exists test.db-shm
+  } {0}
+  do_test 1.3.2.2 {
+    code1 { sqlite3 db file:test.db?readonly_shm=1 }
+    sql1 { SELECT * FROM t1 }
+  } {a b c d e f g h i j k l}
+  do_test 1.3.2.3 {
+    code1 { db close }
+    close [open test.db-shm w]
+    file attributes test.db-shm -permissions r--r--r--
+    code1 { sqlite3 db file:test.db?readonly_shm=1 }
+    csql1 { SELECT * FROM t1 }
+  } {1 {attempt to write a readonly database}}
+  do_test 1.3.2.4 {
+    code1 { sqlite3_extended_errcode db } 
+  } {SQLITE_READONLY_RECOVERY}
+}
+
+finish_test