Fedora Security :: Limiting Sudo - Giving Full Privileges To The Wheel Group In The Sudoers File

I have previously set up sudo via adding my name to the wheel group and then giving full privileges to the wheel group in the sudoers file. Now I choose to learn to limit that. Had noticed the most frequent use I have of sudo is to run yum update. This got me thinking, could I remove the wheel group privileges and add the following line in sudoers to limit the privilege to simply running yum, and furthermore, make it so I could run yum without a password:

## Allow root to run any commands anywhere
rootALL=(ALL) ALL
Troy ALL= NOPASSWD: /usr/bin/yum

I think that would in fact work (if I understood one of the pages here, it will work). However, upon further thinking I realized that in such a case then anyone sitting at my computer could then use yum, without a password, to install or remove any file on my system � probably not a good idea. As a result I have to ask, can I tighten the privilege even further such that the only privilege so given was to run �yum update� and nothing else? (for example if they ran �yum install� it would fail). If you can do it, how?

Last, I was going to limit the privilege, time wise and try wise, by adding the following to the sudoers file:

# Defaults specification
Defaults:Troy timestamp_timeout=0, passwd_tries=3

Will that really work to limit the elevated privilege so I don't have elevated privileges lingering about, or is there a better way to do so?