pub fn filter_env( vm_id: &str, env: &BTreeMap<String, String>, permissions: &Permissions, ) -> BTreeMap<String, String>