TRUSTWORTHY Database Property

The TRUSTWORTHY database property is used to indicate whether the instance of SQL Server trusts the database and the contents within it. By default, this setting is OFF, but can be set to ON by using the ALTER DATABASE statement. For example, ALTER DATABASE AdventureWorks2008R2 SET TRUSTWORTHY ON;.

To set this option, you must be a member of the sysadmin fixed server role.

This property can be used to reduce certain threats that can exist as a result of attaching a database that contains one of the following objects:

• Malicious assemblies with an EXTERNAL_ACCESS or UNSAFE permission setting. For more information, see CLR Integration Security.
• Malicious modules that are defined to execute as high privileged users. For more information, see Extending Database Impersonation by Using EXECUTE AS.

Both of these situations require a specific degree of privileges and are protected against by appropriate mechanisms when they are used in the context of a database that is already attached to an instance of SQL Server. However, if the database is taken offline, a user that has access to the database file can potentially attach it to an instance of SQL Server of his or her choice and add malicious content to the database. When databases are detached and attached in SQL Server, certain permissions are set on the data and log files that restrict access to the database files. For more information, see Securing Data and Log Files.
Because a database that is attached to an instance of SQL Server cannot be immediately trusted, the database is not allowed to access resources beyond the scope of the database until the database is explicitly marked trustworthy. Also, modules that are designed to access resources outside the database, and assemblies with either the EXTERNAL_ACCESS and UNSAFE permission setting, have additional requirements in order to run successfully.


Reference :Microsoft