Mounting or remounting a filesystem is done using the
mount(2) syscall. When remounting, this takes the target location (the mountpoint), the flags to be used in the mount operation, and any extra data used for the specific filesystem involved. When remounting read-only, the flags used are
MS_REMOUNT; you're also supposed to provide any other flags which were used when the filesystem was first mounted.
Remounting a filesystem read-only does indeed set a flag in the kernel's filesystem data structures, after performing some clean-up (basically finishing any outstanding writes). You can see how it's handled in the
ext4 source code: if an
ext4 filesystem is mounted read-write and then remounted read-only, the filesystem is synced, quotas are suspended, and
s_flags in the superblock structure is updated to indicate the filesystem is read-only. This is then used throughout the kernel to deny writes; see for example
sb_permission which prevents write access on a read-only filesystem.
If you want to do this yourself, you can try just calling
mount() with the appropriate options as per the manpage linked above. For a complete solution I believe you'd need to determine the current mount flags and update them, but you could hard-code a simple program to match what your filesystems currently are mounted as...