Something like "contains any" in HQL

The following (simplified) classes are mapped to the database via Hibernate:

class SystemUser {
    Set<UserGroup> groups;
}

class UserGroup {
    Set<Integer> permissions;
}

How can I select all SystemUsers with a certain permission, say permissio开发者_开发百科n 3, with HQL?

Perhaps something like this:

select distinct u from SystemUser u join u.groups g 
where 3 in elements(g.permissions)