diff --git a/bosh-stemcell/spec/support/os_image_shared_examples.rb b/bosh-stemcell/spec/support/os_image_shared_examples.rb
index <HASH>..<HASH> 100644
--- a/bosh-stemcell/spec/support/os_image_shared_examples.rb
+++ b/bosh-stemcell/spec/support/os_image_shared_examples.rb
@@ -184,10 +184,8 @@ shared_examples_for 'every OS image' do
       it { should be_owned_by('root') }
       # should be owned by root group (stig: V-38459)
       it { should be_grouped_into('root') }
-      it "should have mode 0644 or less permissive (stig: V-38461)" do
-        mode = File.stat('/etc/group').mode.to_s(8)[-4..-1].to_i(8)
-        expect(mode & '0644'.to_i(8)).to equal(mode)
-      end
+      # should have mode 0644 (stig: V-38461)
+      it { should be_mode('644') }
     end
   end
fix the bug of checking $chroot/etc/group permission

we occasionally found this bug of not checking /etc/group file
permission under chroot after os image was built. The reason is
File.stat method won't get the chroot context in Rspec setup by
os_image.rb. It will use the /etc/group file of stemcell build
machine's OS, not the stemcell's. so we use be_mode to precisely
match <I> since it is known value.