the filter only allows lines that do something with os.environ, instead of execing everything.