Comment # 1 on bug 1158538 from Christian Boltz

Correct me if I'm wrong, but - AFAIK at least refreshing the repos needs to be
done as root, right?

In the end, the script would look like that (pseudocode):

if running_as_root {
  zypper -q refresh
  reexec_as_nobody $0
} else {
  current_content_of_the_script # except changing 
      # zypper lu -> zypper --no-refresh lu)
}

Does that look correct and good?

One problem / possible regression I see is that errors in "zypper -q refresh"
will not end up in the zypper lu output, and therefore won't be visible
anymore. Any ideas how to avoid this problem?
(Ideally only zypper lu would run as root, but I'm afraid implementing this
without using sudo is very hard.)
(One option might be not to add --no-refresh to zypper lu so that it fails
again.)

Any ideas or opinions on this "detail"? ;-)