The auditd daemon errors-outs if the CONFIG_AUDIT kernel option isn't set, so there should be a check for it in its ebuild. The CONFIG_AUDITSYSCALL option might need to be set too, but I'm not sure. Here's what auditd said to the system log without those kernel options enabled: auditd: Error - audit support not in kernel auditd: Cannot open netlink audit socket auditd: The audit daemon is exiting. auditd: Cannot daemonize (Success) auditd: The audit daemon is exiting.
Implemented in 2.0.5.