Many software systems in use today have enormous trusted computing bases (TCBs). We propose an architecture that makes it possible to shrink the TCB of many such systems. Our solution is based on a virtual-machine (VM) with added information-flow capabilities. In our architecture, all application programs run outside of the TCB under the control of the VM and cannot cause information leaks even if they try. We have implemented a prototype of this architecture and found that the resulting run-time overhead is much lower than expected. In many deployment contexts, it will be perfectly reasonable to make such a moderate performance sacrifice for the benefit of security.