I'm building a shared hosting SQL Server tool for linux, where users only receive access to their own database, with a SQL Login and SQL Database User that has
db_ddladmin rights to make sure they can not run any destructive actions on the database server (or choose settings we don't want them to).
We want to enable them to restore backups through a script. Obviously we'll run this restore with a sysadmin account to facilitate this for them (as a means of privilege escalation). Now on the Microsoft documentation site here the following notes are made (quoted verbatim)
We recommend that you do not attach or restore databases from unknown or untrusted sources. These databases could contain malicious code that might execute unintended Transact-SQL code or cause errors by modifying the schema or the physical database structure. Before you use a database from an unknown or untrusted source, run DBCC CHECKDB on the database on a nonproduction server and also examine the code, such as stored procedures or other user-defined code, in the database.
Herein lies my problem. How can I make sure that I do not risk my database server security when allowing end-users (unknown an untrusted sources) to restore arbitrary backup files? Since this process would be automated, there's no time for 'user intervention', but instead perhaps I need to (re)set some safe defaults and/or settings. Does anyone has guidance on what would be my best approach?