Comment 7 for bug 1277146

The command mount(8) does not write anywhere, if you see any change in the filesystem then it's done by kernel filesystem driver.

I guess the confusing thing for users is that mount(8) command calls mount(2) syscall two times:

# strace -e mount mount /dev/loop0 /mnt/test
mount("/dev/loop0", "/mnt/test", "udf", MS_MGC_VAL, NULL) = -1 EACCES (Permission denied)
mount: /dev/loop0 is write-protected, mounting read-only
mount("/dev/loop0", "/mnt/test", "udf", MS_MGC_VAL|MS_RDONLY, NULL) = 0

The first attempt failed with EACCES, then mount(8) retry with MS_RDONLY. This is expected and wanted behaviour. I guess that kernel udf driver write to the filesystem during the first attempt when it's read-write.

If you try mount with "-o ro" then you won't see the issue.

IMHO udf kernel driver is little bit inconsistent. It does not allow to mount the image read-write, but it modifies the filesystem before it returns EACCES :-)