Why does file permission change deployed by packaged rpm using rpmbuild in Red Hat Enterprise Linux 7?

Issue

• Consider a spec file containing

%install
install -m u=rwx,g=rx,o= -D bin/blah.jar ${RPM_BUILD_ROOT}%{_libexecdir}/foo/blah.jar

• Then in the %files section, the permissions are not changed i.e. say, %defattr(-,bubba,users,-)), installing the rpm results in blah.jar having permissions 644 instead of 640.
• No matter what permissions are used in the install command, they're reset to the default 640.
• How can one fix that?
• Refer the spec below
• The test spec file is as follows.

[root@newrhel7 SPECS]# cat foo.spec
Name:       foo 
Version:    1
Release:    0
Summary:    foo test
Group:      Applications/Kiosk
License:    GPL
URL:        http://www.redhat.com
Source0:    foo-1.0.tar.xz
BuildRequires:  java-1.8.0-openjdk-devel
Requires:   jre = 1.8.0
AutoReqProv:        yes
AutoReq:        yes
AutoProv:        yes
BuildArch:        x86_64

%description
test 

%prep
%setup -n foo

%build

%install
rm -rf ${RPM_BUILD_ROOT}
install -m u=rwx,g=rx,o= -d ${RPM_BUILD_ROOT}
install -m u=rwx,g=rx,o= -D foo.jar ${RPM_BUILD_ROOT}%{_libexecdir}/bar/foo.jar

%files
%defattr(-,root,root,-)
%{_libexecdir}/bar

%changelog
* Fri Jul 3 2015 User <testuser@redhat.com> 1.0-0
- Created