Glossary¶

Terms used throughout this handbook. Where a term maps to a specific Etminan mechanism, the definition says so.

Agent (`etminan-agent`)¶

The relay that runs on each monitored host. It needs a TPM. On request it returns a TPM-signed quote over PCR 10 plus the raw IMA measurement-log delta. It makes no pass/fail decision and raises no alarm — it only produces signed, verifiable evidence.

AK — Attestation Key¶

The TPM key that signs quotes. Etminan creates the AK from a fixed, never-changing template via TPM2_CreatePrimary, so the derived key is deterministic and its fingerprint is stable — that fingerprint is pinned at enrollment. Re-bind a changed AK within the same TPM with rotate-ak.

Anchor (audit-head anchor)¶

A small file <baseline.db>.audit-head outside the database recording the highest committed audit-log (seq, entry_hash). It lets verify_chain detect tail-truncation and whole-DB rollback that a forward-only chain cannot see. See The audit log.

Baseline¶

The set of measurements an operator has approved as expected for a host. A new or changed measurement becomes a pending item until reviewed. The baseline lives in baseline.db on the verifier; drift is proposed, never auto-accepted.

Drift¶

A measured file whose hash differs from (or is absent from) the approved baseline — surfaced in baseline review as a pending item, and as a finding if seen during a run cycle.

Dual control / four-eyes (Enterprise)¶

An M-of-N approval requirement: a configured action is not applied on one signature; a second, distinct authorized operator must co-sign the same payload. See Dual control.

EK — Endorsement Key¶

The TPM's manufacturer-provisioned identity key. Etminan uses EK credential activation at enrollment to prove the AK resides in a real TPM, and as the continuity anchor for rotate-ak (a different EK means a different TPM). With enroll --ek-roots, the EK certificate is additionally chained to a manufacturer root for genuine-hardware provenance.

Enrollment¶

The trust-on-first-use ceremony that admits a host: take and self-validate a first quote, pin the AK, EK, and TLS fingerprints, and record the host's measurements as pending. The single highest-consequence operator action.

Finding¶

A verification failure detected during check/run — a signature or nonce mismatch, a PcrDigestMismatch, an unreachable host, a rejected measurement. A finding travels the alarm path.

IMA — Integrity Measurement Architecture¶

The Linux kernel subsystem that hashes files as they are accessed and extends those hashes into a TPM PCR, appending each to a measurement log. Etminan reads the SHA-256 log (ascii_runtime_measurements_sha256).

Measurement log¶

The kernel's append-only record of every IMA-measured event this boot, each line carrying the full path and template hash. The agent returns the delta since the last consumed offset; the verifier replays it.

mTLS — mutual TLS¶

The mandatory, mutually-authenticated transport between agent and verifier. Both certificate fingerprints are pinned at enrollment; every call site is compiler-forced through the TLS wrapper. See Mutual TLS.

Operator identity / daemon signing key¶

Operators hold no signing keys. Every trust-changing action goes through the etminan-verifierd daemon, which authenticates the caller by kernel peer-UID (SO_PEERCRED) and applies their role. The daemon holds the single Ed25519 signing key; it signs each action and folds the signature into the audit-log row. (The earlier per-operator operator-key model is retired — op is the only path.)

PCR — Platform Configuration Register¶

A TPM register that can only be extended (new value = hash of old value ‖ new measurement), never set arbitrarily. Etminan attests PCR 10, the IMA PCR.

Pending review¶

A measurement that is new or changed relative to the baseline and awaits an operator's approve/reject. Items past ETMINAN_PENDING_REVIEW_SLA_HOURS are marked [SLA EXCEEDED].

Quote¶

A TPM-signed statement of the current PCR values plus a verifier-supplied nonce (anti-replay). The agent returns a quote over PCR 10; the verifier checks the signature against the pinned AK and replays the log to reproduce the signed PCR.

RBAC — role-based access control (Standard)¶

The default access-control model: the etminan-verifierd daemon authenticates each operator by kernel peer-UID and maps it to a role (admin / operator / viewer) and host-group scope, default-deny. See RBAC.

SIEM output (Enterprise)¶

CEF / LEEF events over syslog for a SOC pipeline, controlled by ETMINAN_SIEM_FORMAT. See SIEM output.

Verifier (`etminan-verifier`)¶

The independently-administered binary that makes every trust decision. It needs no TPM — quote verification is offline signature math. Its load-bearing step: replay the IMA log, recompute PCR 10, and confirm it equals the value the TPM signed.