Alternative to chroot jail

Wrappers which intercept system calls of specific programs at kernel level, in order to restrict the capability of an attacker who has taken ownership of a firewall process.

wrappers add security functionality to an operating system which helps improve firewalls… [which] implies that operating system controls are not very helpful – after all, not much about them has changed in 40 years.”

Not suprisingly, the developers found it hard to wrap programs running within the JVM, because the VM itself needs unfettered access to several critical system calls.

Question: if the barbarians control the gate, is there any perimeter defense left? After all, most machines which host firewalls do not have any thing of value.