I just got this message today (I upgraded to High Sierra a couple weeks ago), and was also concerned about possible maliciousness. I'm not sure why
routined needs access to the Local Items keychain, but I figured I'd document here what I've figured out so far:
- Selecting cancel doesn't seem to have caused any problems, so I'd recommend that, rather than risking opening up your keychain unnecessarily.
routined seems to be involved in tracking recent location information.
- I did just travel for the holidays, so something location based might explain why I'm only seeing it now.
- Looking at running processes named
routined and running
strings on the binary didn't reveal anything malicious-looking (not a definitive examination, I know, but it's a start).
Other than that, my research was unfortunately mostly a dead end. All the links seemed to be references to the process's cache which includes tracking information, and all my google results seemed to be re-iterations (i.e. copy and pastes) from work by Sarah Edwards, who has a blog called Mac4n6.com. She has a "Contact Me" page, and I've reached out with a query for more information on this topic.
Other than that, hopefully someone more knowledgeable than myself will chime in. The only advice I can glean from other similar issues with keychain prompting users like this is the unfortunately unhelpful advice to try restarting the computer, recreating the user account, or re-installing the OS, none of which actually address the actual issue.