Skip to content

Commit d8521a2

Browse files
v-dirichardsv-dirichards
authored
Merge pull request #25583 from rwestMSFT/vyella-sqlmi-jan2023
Refresh TRUSTWORTHY article and update for SQL MI support
2 parents bac1791 + 7a98ec5 commit d8521a2

1 file changed

Lines changed: 52 additions & 47 deletions

File tree

‎docs/relational-databases/security/trustworthy-database-property.md‎

Lines changed: 52 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -1,87 +1,92 @@
11
---
2-
title: "TRUSTWORTHY Database Property | Microsoft Docs"
2+
title: TRUSTWORTHY database property
33
description: Learn about the TRUSTWORTHY database property, which indicates whether the instance of SQL Server trusts the database and its contents. The default is OFF.
4-
ms.custom: ""
5-
ms.date: 08/24/2022
4+
author: VanMSFT
5+
ms.author: vanto
6+
ms.reviewer: randolphwest
7+
ms.date: 01/16/2023
68
ms.service: sql
7-
ms.reviewer: ""
89
ms.subservice: security
910
ms.topic: conceptual
10-
helpviewer_keywords:
11+
helpviewer_keywords:
1112
- "TRUSTWORTHY database property"
12-
ms.assetid: 64b2a53d-4416-4a19-acc0-664a61b45348
13-
author: VanMSFT
14-
ms.author: vanto
1513
---
16-
1714
# TRUSTWORTHY database property
1815

19-
[!INCLUDE [SQL Server](../../includes/applies-to-version/sqlserver.md)]
20-
The TRUSTWORTHY database property is used to indicate whether the instance of [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] trusts the database and the contents within it. By default, this setting is OFF, but can be set to ON by using the `ALTER DATABASE` statement. For example, `ALTER DATABASE AdventureWorks2012 SET TRUSTWORTHY ON;`.
21-
16+
[!INCLUDE [sql-asdbmi](../../includes/applies-to-version/sql-asdbmi.md)]
17+
18+
The `TRUSTWORTHY` database property is used to indicate whether the instance of [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] trusts the database and the contents within it. By default, this setting is OFF, but can be set to ON by using the `ALTER DATABASE` statement. For example: `ALTER DATABASE AdventureWorks2019 SET TRUSTWORTHY ON;`.
19+
2220
> [!NOTE]
23-
> To set this option, you must be a member of the **sysadmin** fixed server role.
21+
> To set this option, you must be a member of the **sysadmin** fixed server role.
2422
25-
We recommend that you leave the TRUSTWORTHY database property set to OFF to mitigate certain threats that can exist as a result of attaching a database that contains one of the following objects:
26-
27-
- Malicious assemblies with an EXTERNAL_ACCESS or UNSAFE permission setting. For more information, see [CLR Integration Security](../../relational-databases/clr-integration/security/clr-integration-security.md).
28-
29-
- Malicious modules that are defined to execute as high privileged users. For more information, see [EXECUTE AS Clause (Transact-SQL)](../../t-sql/statements/execute-as-clause-transact-sql.md).
30-
31-
Both situations require a specific degree of privilege and are protected by appropriate mechanisms when they are used in the context of a database that is already attached to an instance of [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)]. However, if the database is taken offline, if you have access to the database file you can potentially attach it to an instance of [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] of your choice and add malicious content to the database. When databases are detached and attached in [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)], certain permissions are set on the data and log files that restrict access to the database files.
32-
33-
Because a database that is attached to an instance of [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] can't be immediately trusted, the database isn't allowed to access resources beyond the scope of the database until the database is explicitly marked trustworthy. Therefore, if you back up or detach a database that has the TRUSTWORTHY option ON and you attach or restore the database to the same or another SQL Server instance, the TRUSTWORTHY property will be set to OFF when attach or restore is completed. Also, modules that are designed to access resources outside the database, and assemblies with either the EXTERNAL_ACCESS and UNSAFE permission setting, have additional requirements to run successfully.
23+
We recommend that you leave the `TRUSTWORTHY` database property set to OFF to mitigate certain threats that can exist as a result of attaching a database that contains one of the following objects:
3424

35-
> [!NOTE]
36-
> By default, the TRUSTWORTHY setting is set to ON for the `msdb` database. If you change this setting from its default value, it might result in unexpected behavior by SQL Server components that use the `msdb` database.
25+
- Malicious assemblies with an EXTERNAL_ACCESS or UNSAFE permission setting. For more information, see [CLR Integration Security](../../relational-databases/clr-integration/security/clr-integration-security.md).
3726

38-
If the TRUSTWORTHY setting is set to ON, and if the owner of the database is a member of a group that has administrative credentials, such as the sysadmin group, the database owner can then be able to create and run unsafe assemblies that can compromise the instance of the SQL Server.
27+
- Malicious modules that are defined to execute as high privileged users. For more information, see [EXECUTE AS Clause (Transact-SQL)](../../t-sql/statements/execute-as-clause-transact-sql.md).
28+
29+
Both situations require a specific degree of privilege and are protected by appropriate mechanisms when they are used in the context of a database that is already attached to an instance of [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)]. However, if the database is taken offline, if you have access to the database file you can potentially attach it to an instance of [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] of your choice and add malicious content to the database. When databases are detached and attached in [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)], certain permissions are set on the data and log files that restrict access to the database files.
30+
31+
Because a database that is attached to an instance of [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] can't be immediately trusted, the database isn't allowed to access resources beyond the scope of the database until the database is explicitly marked trustworthy. Therefore, if you back up or detach a database that has the `TRUSTWORTHY` option ON and you attach or restore the database to the same or another SQL Server instance, the `TRUSTWORTHY` property will be set to OFF when attach or restore is completed. Also, modules that are designed to access resources outside the database, and assemblies with either the EXTERNAL_ACCESS and UNSAFE permission setting, have additional requirements to run successfully.
32+
33+
> [!NOTE]
34+
> By default, the `TRUSTWORTHY` setting is set to ON for the `msdb` database. If you change this setting from its default value, it might result in unexpected behavior by SQL Server components that use the `msdb` database.
35+
36+
If the `TRUSTWORTHY` setting is set to ON, and if the owner of the database is a member of a group that has administrative credentials, such as the sysadmin group, the database owner can then be able to create and run unsafe assemblies that can compromise the instance of the SQL Server.
3937

4038
## More information
4139

4240
In an Internet Service Provider (ISP) environment (for example, in a web-hosting service), each customer is permitted to manage their own database and is restricted from accessing system databases and other user databases. For example, the databases of two competing companies could be hosted by the same ISP and exist in the same instance of SQL Server. Dangerous code could be added to a user database when the database is attached to its original instance, and the code would be enabled on the ISP instance when the database is deployed. This situation makes controlling cross-database access crucial.
4341

44-
If the same general entity owns and manages each database, it is still not a good practice to establish a trust relationship with a database unless an application-specific feature, such as a cross-database Service Broker communication, is required. A trust relationship between databases can be established by enabling cross-database ownership chaining or by marking a database as trusted by the instance using the TRUSTWORTHY property. The `is_trustworthy_on` column of the `sys.databases` catalog view indicates if a database has its TRUSTWORTHY property set.
42+
If the same general entity owns and manages each database, it is still not a good practice to establish a trust relationship with a database unless an application-specific feature, such as a cross-database Service Broker communication, is required. A trust relationship between databases can be established by enabling cross-database ownership chaining or by marking a database as trusted by the instance using the `TRUSTWORTHY` property. The `is_trustworthy_on` column of the `sys.databases` catalog view indicates if a database has its `TRUSTWORTHY` property set.
4543

4644
The best practices for database ownership and trust include the following:
4745

4846
- Have distinct owners for databases. Not all databases should be owned by the system administrator.
4947
- Limit the number of owners for each database.
5048
- Confer trust selectively.
5149
- Leave the [cross db ownership chaining](../../database-engine/configure-windows/cross-db-ownership-chaining-server-configuration-option.md) setting set to OFF unless multiple databases are deployed at a single unit.
52-
- Migrate usage to selective trust instead of using the TRUSTWORTHY property.
50+
- Migrate usage to selective trust instead of using the `TRUSTWORTHY` property.
5351

54-
The following code sample can be used to obtain a list of databases that have the TRUSTWORTHY property set to ON and whose database owner belongs to the **sysadmin** server role.
52+
The following code sample can be used to obtain a list of databases that have the `TRUSTWORTHY` property set to ON and whose database owner belongs to the **sysadmin** server role.
5553

5654
```sql
57-
SELECT SUSER_SNAME(owner_sid) AS DBOWNER, d.name AS DATABASENAME
58-
FROM sys.server_principals r
59-
INNER JOIN sys.server_role_members m ON r.principal_id = m.role_principal_id
60-
INNER JOIN sys.server_principals p ON p.principal_id = m.member_principal_id
61-
INNER JOIN sys.databases d ON suser_sname(d.owner_sid) = p.name
62-
WHERE is_trustworthy_on = 1 AND d.name NOT IN ('msdb') AND r.type = 'R' AND r.name = N'sysadmin'
55+
SELECT SUSER_SNAME(owner_sid) AS DBOWNER,
56+
d.name AS DATABASENAME
57+
FROM sys.server_principals r
58+
INNER JOIN sys.server_role_members m ON r.principal_id = m.role_principal_id
59+
INNER JOIN sys.server_principals p ON p.principal_id = m.member_principal_id
60+
INNER JOIN sys.databases d ON suser_sname(d.owner_sid) = p.name
61+
WHERE is_trustworthy_on = 1
62+
AND d.name NOT IN ('msdb')
63+
AND r.type = 'R'
64+
AND r.name = N'sysadmin';
65+
GO
6366
```
6467

65-
You can run the following query to determine the TRUSTWORTHY property of the `msdb` database:
68+
You can run the following query to determine the `TRUSTWORTHY` property of the `msdb` database:
6669

6770
```sql
68-
SELECT name, trustworthy_setting =
69-
CASE is_trustworthy_on
70-
WHEN 1 THEN 'Trustworthy setting is ON for msdb'
71-
ELSE 'Trustworthy setting is OFF for msdb'
72-
END
73-
FROM sys.databases WHERE database_id = 4
71+
SELECT name,
72+
trustworthy_setting = CASE is_trustworthy_on
73+
WHEN 1 THEN 'Trustworthy setting is ON for msdb'
74+
ELSE 'Trustworthy setting is OFF for msdb'
75+
END
76+
FROM sys.databases
77+
WHERE database_id = 4;
78+
GO
7479
```
7580

76-
If this query shows that the TRUSTWORTHY property is set to OFF, you can run the following query to set the TRUSTWORTHY property to ON.
81+
If this query shows that the `TRUSTWORTHY` property is set to OFF, you can run the following query to set the `TRUSTWORTHY` property to ON.
7782

7883
```sql
7984
ALTER DATABASE msdb SET TRUSTWORTHY ON;
80-
GO
85+
GO
8186
```
82-
87+
8388
## Next steps
8489

85-
- [Security Center for SQL Server Database Engine and Azure SQL Database](../../relational-databases/security/security-center-for-sql-server-database-engine-and-azure-sql-database.md)
86-
- [ALTER DATABASE (Transact-SQL)](../../t-sql/statements/alter-database-transact-sql.md)
87-
- [Extending Database Impersonation by Using EXECUTE AS](/previous-versions/sql/sql-server-2008-r2/ms188304(v=sql.105))
90+
- [Security Center for SQL Server Database Engine and Azure SQL Database](../../relational-databases/security/security-center-for-sql-server-database-engine-and-azure-sql-database.md)
91+
- [ALTER DATABASE (Transact-SQL)](../../t-sql/statements/alter-database-transact-sql.md)
92+
- [Extending Database Impersonation by Using EXECUTE AS](/previous-versions/sql/sql-server-2008-r2/ms188304(v=sql.105))

0 commit comments

Comments
 (0)