Comment 69 for bug 1073433

I fail to understand why so many people are insisting this is a kernel bug. It isn't. What basically happens is that the network-manager process is not killed by killall5. This process also has an open file descriptor and therefore the root partitions cannot be mounted read-only before shutdown, as the kernel reports it is busy. Network-manager will not be killed due to the ubuntu patch add_sendsigs_omissions.patch, which was added to NM for a similar reason:

From: Mathieu Trudel-Lapierre <email address hidden>
Subject: Move NM's spawns pid files to /run/sendsigs.omit.d.
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/network-manager/+bug/869635

The pidfiles are only used by NM to start and be able to stop the same process,
their actual location doesn't overly matter. In this case, putting them
under /run/sendsigs.omit.d allows shutdown to skip over those as handled by
an upstart job, and in fact they are (although indirectly).

I have no idea what Mathieu actually intended with this patch, but it is entirely wrong and made everything worse. Instead of refusing to kill NM, it needs to be killed, which is just the other way around than what the patch is doing.
The only way to fix this from kernel point of view would be to write a kernel patch to allow to mount read-only while there are still file descriptors, which have write access. All those FDs would need to be closed from the kernel side and propably would cause application crashes.