By default on UBUNTU/DEBIAN users require membership in “adm” or “sudo” groups, to gain the right to use sudo freely. However there are many situations where you want regular users to be able to update and upgrade their system any time, even without using a password every time. For example:
To shutdown and power off a workstation i provide my users a desktop script, which first updates the apt cache, performs a safe-upgrade and then halts and powers off the computer if successful. So system keeps somewhat up to date and it wont bother the user.
So to grant every user the right to use my shut-down-script OR apt|aptitude update|safe-upgrade without being asked for their password i did this:
cat << 'EOF' > /etc/sudoers.d/allow-aptitude-upgrades ALL ALL=(root) NOPASSWD: /usr/bin/aptitude update, /usr/bin/aptitude full-upgrade -yy, /usr/bin/aptitude safe-upgrade -yy EOF