title: Allow only apt-get update and upgrade without password prompt
body: <p>I want to keep my system (and all installed packages) "always" on the latest version and therefore I'm thinking about creating special user for auto-updates. This user would get a cron-job which performs <code>sudo apt-get update -y &amp;&amp; sudo apt-get upgrade -y</code> once a week.
  Since this should be done automatically I'd like to edit the <code>/etc/sudoers</code> file (with <code>sudo visudo</code> of course) so that this user never gets a password prompt for these two commands.
  However the only solution I found so far is to disable the password prompt only for apt-get but not for specific sub commands.</p>
  
  <p>Since I want to keep it as safe as possible I'd need a way to ONLY allow update &amp; upgrade, no other sub-commands of apt-get.
  And yes, I'd also disable the execution of any other command via sudo, just to be on the safe side.</p>
  
  <p>Is there any way to achieve this or is the only way to allow the execution of <code>apt-get</code> without password prompts (thus also allowing <code>apt-get install</code>)?</p>
  
  <p>I'm using the Debian based distro Raspbian.</p>
  
  <p>Thanks for any help!</p>