set vdr uid only for the exec call, not for the whole upstart job