OS X used to ship with a version of locate which, when running locate.updatedb would throw a message warning that building the locate db as root could expose the location of all files to any user. As of Lion (10.7) this warning is no longer shown but I haven't found anything which would indicate it's no longer true. Combined with a few other limitations, a case can be made for installing slocate if Spotlight is just not for you.

Slocate has been the standard on Linux distributions for years, though it is losing favour to the more efficient mlocate. What they have in common is that the database is meant to be built as root and it includes ownership and permission information so lesser-priviledged users running m/slocate only get to see the files they have access to. To get slocate running on your mac you may choose to compile it from source or go the lazy route as I have and grab a binary distribution of it from MacPorts.

First, install MacPorts, available at http://www.macports.org/. Open a terminal session. If /opt/local/bin is not a part of your PATH cd there then run:

$ sudo ./port install slocate

Now that locate is installed it will be necessary to create the "slocate" group before creating the database or you will encounter an error like this:

slocate: warning: Could not find the group: slocate in the /etc/group file.
slocate: fatal error: This is a result of the group missing or a corrupted group file.

It is possible to create a new group from the command line with dscl but it requires you to choose a group number. To be tidy and use the internally incrementing group number let's create the group by opening System Preferences > Users & Groups. Click the lock to make changes. Click the + button under the user list. Select Group from the New dropdown. Type 'slocate' and click the "Create Group" button. Once the group has been created add your account to it by clicking the checkbox next to your avatar in the Membership list.

Now we need to create the initial database:

$ sudo slocate -u

If you want your slocate database to update automatically add the contents of /opt/local/etc/daily.slocate to /etc/daily.local or /etc/weekly.local, excluding the line #!/bin/sh - if one already exists.

If you try to use slocate as a regular user (which has been added to the slocate group) in any currently open shells you will encounter the error message:

slocate: fatal error: search_db: open: '/opt/local/var/db/slocate/slocate.db': Permission denied

terminate the shell and start a new one; the old instance of bash was not aware of your account being a part of the new slocate group.