My sudoers is set up to let me run update and upgrade (with no args) without a challenge, but not install.